Soc Engineer

PRIMARK; Reading; On-site; GBP 60,000 - 90,000; Full time

Job summary

Primark is seeking a SOC Engineer to join its Cyber Defence team and help enhance the tools, detections and automation that protect a global retail organisation. You will play a key role in improving security monitoring, strengthening threat detection capabilities and enabling effective incident response across a complex technology landscape.

Collaborating with Cyber Defence, Technology Operations and third‑party providers, you’ll drive continuous improvement in automation, detection quality and

Qualifications

• 4+ years of experience in Security Operations, Security Engineering or Detection Engineering.
• Hands-on experience with SIEM platforms, security monitoring, telemetry management and response automation.
• Experience onboarding, configuring and troubleshooting log sources across cloud, identity, endpoint, network and application environments.
• Strong understanding of threat detection, alert tuning, monitoring use cases and investigation workflows.
• Ability to identify and resolve false positives, telemetry gaps and detection coverage weaknesses.
• Knowledge of KQL, SPL, Python or PowerShell and relevant cyber security certifications would be advantageous.

Responsibilities

• Engineer, maintain and optimise security monitoring, detection and response tooling across the SOC environment.
• Develop and tune detection rules, alert logic, correlation searches, playbooks and automation workflows.
• Onboard and maintain security log sources across cloud platforms, identity services, networks, endpoints and business applications.
• Support integrations between SOC tooling, threat intelligence, vulnerability management, identity controls and incident response processes.
• Investigate and resolve false positives, telemetry gaps and tooling performance issues.
• Collaborate with Cyber Defence, Technology Operations, IDAM, Security Architecture and third-party providers to improve monitoring coverage.
• Drive continuous improvement initiatives focused on automation, detection quality, threat visibility and response effectiveness.

Skills

SIEM platforms

Security monitoring

Detection engineering

Incident response

Tools

Microsoft Sentinel

Splunk

EDR

XDR

SOAR

Job description

Technology at Primark

Our technology team is actively shaping the next wave of advancements. Engaged with innovative initiatives, your expertise will propel our business into the future. Collaborating with a creative team of tech enthusiasts, you'll contribute your unique skills to fuel our technological advancements.

Join Primark's Cyber Defence team as a SOC Engineer and help enhance the tools, detections and automation that protect a global retail organisation. You'll play a key role in improving security monitoring, strengthening threat detection capabilities and enabling effective incident response across a complex technology landscape.

What you'll do

• Engineer, maintain and optimise security monitoring, detection and response tooling across the SOC environment.
• Develop and tune detection rules, alert logic, correlation searches, playbooks and automation workflows.
• Onboard and maintain security log sources across cloud platforms, identity services, networks, endpoints and business applications.
• Support integrations between SOC tooling, threat intelligence, vulnerability management, identity controls and incident response processes.
• Investigate and resolve false positives, missed detections, telemetry gaps and tooling performance issues.
• Collaborate with Cyber Defence, Technology Operations, IDAM, Security Architecture and third-party providers to improve monitoring coverage.
• Drive continuous improvement initiatives focused on automation, detection quality, threat visibility and response effectiveness.

What you'll bring

• 4+ years' experience in Security Operations, Security Engineering or Detection Engineering.
• Hands-on experience with SIEM platforms, security monitoring, telemetry management and response automation.
• Experience onboarding, configuring and troubleshooting log sources across cloud, identity, endpoint, network and application environments.
• Strong understanding of threat detection, alert tuning, monitoring use cases and investigation workflows.
• Ability to identify and resolve false positives, telemetry gaps and detection coverage weaknesses.
• Experience with technologies such as Microsoft Sentinel, Splunk, EDR, XDR or SOAR platforms is highly desirable.
• Knowledge of KQL, SPL, Python or PowerShell and relevant cyber security certifications would be advantageous.

About Primark

At Primark, people matter. They're the beating heart of our business and the reason we've grown from our first store in Dublin in 1969 to over 80,000 colleagues and over 500 stores in 20 countries today and growing.

So, what's a career at Primark all about? The positive impact you're making, the experiences you're having and the people you're with. It's that feeling that turns a job into something more. Celebrating the wins, working at pace, and pulling through the challenging times with passion, courage, and your team by your side. It's what drives us every day.

You're our driving force. Embrace what sets you apart, own your career and develop in ways you never expected. Leave your mark. And do it your way.

If you need any reasonable adjustments or have an accessibility request, during your recruitment journey, such as extended time or breaks between online assessments, a sign language interpreter, mobility access, or assistive technology please contact your talent acquisition specialist.

All offers of employment are subject to background checks, including right to work, reference education and for some roles criminal, and financial checks. If you have any concerns, please reach out to our talent acquisition team to discuss.