SOC Engineer: Automate Detections & Threat Response

Primark; England; On-site; GBP 55,000 - 90,000; Full time

Job summary

Primark is seeking a SOC Engineer to join its Cyber Defence team. You will engineer, tune and maintain security monitoring, detections and automation across a complex retail tech landscape.

You will onboard log sources across cloud, identity, endpoints and networks, and drive improvements in threat visibility and incident response. Collaboration with IDAM, architecture, and third parties is essential.

Qualifications

• 4+ years in Security Operations, Security Engineering or Detection Engineering.
• Hands-on SIEM, monitoring, telemetry management and response automation.
• Experience onboarding, configuring and troubleshooting log sources across cloud/identity/endpoint/network/app.
• Strong understanding of threat detection, alert tuning, monitoring use cases and investigation workflows.
• Identify and resolve false positives, telemetry gaps and detection coverage weaknesses.
• Experience with Microsoft Sentinel, Splunk, EDR, XDR or SOAR platforms is highly desirable.
• Knowledge of KQL, SPL, Python or PowerShell and relevant cyber security certifications would be advantageous.

Responsibilities

• Engineer, maintain and optimise security monitoring, detection and response tooling across the SOC environment.
• Develop and tune detection rules, alert logic, correlation searches, playbooks and automation workflows.
• Onboard and maintain security log sources across cloud platforms, identity services, networks, endpoints and business applications.
• Support integrations between SOC tooling, threat intelligence, vulnerability management, identity controls and incident response processes.
• Investigate and resolve false positives, telemetry gaps and detection coverage weaknesses.
• Collaborate with Cyber Defence, Technology Operations, IDAM, Security Architecture and third-party providers to improve monitoring coverage.
• Drive continuous improvement initiatives focused on automation, detection quality, threat visibility and response effectiveness.

Skills

Security Operations

Detection Engineering

Incident Response

Monitoring use cases

Investigation workflows

Tools

Microsoft Sentinel

Splunk

EDR

XDR

SOAR

Job description

Primark is seeking a SOC Engineer to join its Cyber Defence team. You will engineer, tune and maintain security monitoring, detections and automation across a complex retail tech landscape.

You will onboard log sources across cloud, identity, endpoints and networks, and drive improvements in threat visibility and incident response. Collaboration with IDAM, architecture, and third parties is essential.