SOC Engineer - SC Cleared - Inside IR35

JR United Kingdom; London; On-site; GBP 60,000 - 90,000; Full time

Job summary

A leading company is seeking a skilled SOC Engineer to support the design and optimization of a security operations capability in a critical public sector environment. The role involves hands-on engineering work, deploying Microsoft technologies, and collaborating with cross-functional teams to maintain security operations and enhance detection capabilities.

Qualifications

• Experience configuring Microsoft Security Stack solutions.
• Proficiency in KQL for developing detection logic.
• Hands-on experience with security operations in public sector environments.

Responsibilities

• Engineer and maintain security tooling like Microsoft Sentinel and Defender.
• Develop detection logic and implement SOAR playbooks.
• Collaborate with teams to enhance telemetry quality.

Skills

Security Tool Engineering

Microsoft Sentinel

Microsoft Defender

KQL

Threat Response

Job description

Social network you want to login/join with:

SOC Engineer - SC Cleared - Inside IR35, london

col-narrow-left

Client:

SR2 | Socially Responsible Recruitment | Certified B Corporation

Location:

london, United Kingdom

Job Category:

Other

-

EU work permit required:

Yes

col-narrow-right

Job Views:

4

Posted:

10.06.2025

Expiry Date:

25.07.2025

col-wide

Job Description:

A skilled SOC Engineer is required to support the design, configuration, and optimisation of a mature security operations capability within a critical public sector environment. The successful candidate will be responsible for the deployment, tuning, and continual improvement of advanced detection and response tooling, with a focus on the Microsoft Security Stack and Azure-native technologies.

This is a hands-on engineering role with cross-functional engagement across detection teams, infrastructure, and threat response.

Key Responsibilities

• Engineer and maintain security tooling, including:
• Microsoft Sentinel – connector management, rule tuning, data enrichment
• Microsoft Defender solutions (Endpoint, Identity, Cloud Apps)
• Develop and refine detection logic using KQL, and implement SOAR playbooks via Logic Apps.
• Integrate data sources from hybrid environments (cloud/on-premise) into the SIEM.
• Optimise alert fidelity and reduce false positives through rule refinement and log tuning.
• Support the SOC function by identifying and addressing detection gaps.
• Collaborate with infrastructure and operations teams to ensure telemetry quality and visibility.
• Contribute to engineering playbooks, architectural documentation, and automation pipelines.
• Support threat hunting, red/blue team simulation readiness, and post-incident forensic analysis.