SOC Engineer: Threat Detection & Automation

PRIMARK; Reading; On-site; GBP 60,000 - 90,000; Full time

Job summary

Primark is seeking a SOC Engineer to join its Cyber Defence team and help enhance the tools, detections and automation that protect a global retail organisation. You will play a key role in improving security monitoring, strengthening threat detection capabilities and enabling effective incident response across a complex technology landscape.

Collaborating with Cyber Defence, Technology Operations and third‑party providers, you’ll drive continuous improvement in automation, detection quality and

Qualifications

• 4+ years of experience in Security Operations, Security Engineering or Detection Engineering.
• Hands-on experience with SIEM platforms, security monitoring, telemetry management and response automation.
• Experience onboarding, configuring and troubleshooting log sources across cloud, identity, endpoint, network and application environments.
• Strong understanding of threat detection, alert tuning, monitoring use cases and investigation workflows.
• Ability to identify and resolve false positives, telemetry gaps and detection coverage weaknesses.
• Knowledge of KQL, SPL, Python or PowerShell and relevant cyber security certifications would be advantageous.

Responsibilities

• Engineer, maintain and optimise security monitoring, detection and response tooling across the SOC environment.
• Develop and tune detection rules, alert logic, correlation searches, playbooks and automation workflows.
• Onboard and maintain security log sources across cloud platforms, identity services, networks, endpoints and business applications.
• Support integrations between SOC tooling, threat intelligence, vulnerability management, identity controls and incident response processes.
• Investigate and resolve false positives, telemetry gaps and tooling performance issues.
• Collaborate with Cyber Defence, Technology Operations, IDAM, Security Architecture and third-party providers to improve monitoring coverage.
• Drive continuous improvement initiatives focused on automation, detection quality, threat visibility and response effectiveness.

Skills

SIEM platforms

Security monitoring

Detection engineering

Incident response

Tools

Microsoft Sentinel

Splunk

EDR

XDR

SOAR

Job description

Primark is seeking a SOC Engineer to join its Cyber Defence team and help enhance the tools, detections and automation that protect a global retail organisation. You will play a key role in improving security monitoring, strengthening threat detection capabilities and enabling effective incident response across a complex technology landscape.

Collaborating with Cyber Defence, Technology Operations and third‑party providers, you’ll drive continuous improvement in automation, detection quality and