SOC L3 Analyst

Candu Energy; Epsom; On-site; GBP 60,000 - 80,000; Full time

Job summary

Candu Energy is seeking a Level 3 Analyst to lead complex security investigations and drive incident response within a 24x7 SOC. The role requires senior technical escalation, containment, eradication and recovery leadership, with emphasis on automation and effective stakeholder communication.

You will mentor SOC analysts, collaborate with cross-functional teams, and contribute to detection development, playbooks and continuous improvement initiatives to strengthen cyber resilience across the

Qualifications

• Demonstrable experience in a 24x7 SOC or incident response environment.
• Proven ability to lead investigations and coordinate responses.
• Strong analytical and communication skills with stakeholders.

Responsibilities

• Lead complex and high-severity cyber security investigations and incident response in a 24x7 SOC.
• Act as Technical Incident Lead or Incident Commander during major incidents.
• Conduct proactive threat hunting and forensic triage across endpoints, network and cloud.
• Develop, tune and improve detections, playbooks and response procedures.
• Mentor SOC analysts and support on-call responses when required.

Skills

Incident response experience

Threat hunting

Automation

Communication skills

Mentoring

Tools

SIEM platforms

SOAR

Threat intelligence tools

Automation scripting

Job description

Job Description

Overview

The SOC Level 3 (L3) Analyst is responsible for leading the investigation, coordination and resolution of complex security incidents. Acting as a senior technical specialist, the role provides expert guidance on threat detection, incident response, and security operations while supporting the development of SOC capabilities and team expertise.

The L3 Analyst maintains high standards of documentation and produces clear, concise communications tailored to both technical and non-technical stakeholders. During major security incidents, the role serves as the Incident Commander and primary point of contact, ensuring effective coordination, stakeholder engagement, and timely decision-making.

In addition to operational responsibilities, the L3 Analyst contributes to the continuous improvement of SOC processes, use cases, and detection capabilities. The role requires strong automation and scripting skills to streamline repetitive tasks, enhance operational efficiency, and improve overall security outcomes.

Reporting to the SOC Manager, the L3 Analyst is expected to demonstrate a deep understanding of emerging cyber security threats, technologies, and industry's best practices. The role contributes to the organization's cyber security strategy, roadmap, and continuous improvement initiatives, helping to ensure that security operations remain effective, resilient, and aligned with business objectives.

Your role

Lead complex and high-severity cyber security investigations and incident response activities within a 24x7 Security Operations Centre (SOC), acting as a senior technical escalation point, taking ownership of investigations, and driving incidents through containment, eradication, recovery, and closure.

Act as Technical Incident Lead or Incident Commander, as appropriate, during major cyber security incidents, coordinating technical response activities, assessing risk, making informed decisions in ambiguous situations, and communicating effectively with technical teams, leadership, and business stakeholders.

Conduct proactive threat hunting, advanced investigations, and forensic triage across endpoint, network, cloud, identity, and other enterprise environments to identify malicious activity, attacker persistence, and previously undetected compromise, while ensuring appropriate preservation and handling of investigative evidence.

Analyse adversary tactics, techniques, and procedures (TTPs), threat intelligence, emerging threats, vulnerabilities, and investigation findings to develop hunting hypotheses, identify detection gaps, and continuously strengthen the organization's defensive capabilities.

Develop, tune, test, and continuously improve security detections, analytics, use cases, investigation methodologies, playbooks, and response procedures, including validating detection coverage against realistic adversary behaviours and the MITRE ATT&CK framework.

Drive automation and orchestration across security operations, using security queries, scripting, and automation to analyse data, accelerate investigations, reduce repetitive manual activities, and improve the consistency and effectiveness of response.

Lead incident response exercises, tabletop scenarios, post-incident reviews, and continuous-improvement activities, translating lessons learned into measurable improvements to SOC processes, controls, detection capabilities, operational readiness, and cyber resilience.

Collaborate with Security Engineering, Threat Intelligence, Vulnerability Management, Digital Forensics, IT, cloud and identity teams, and other stakeholders, while mentoring SOC analysts, producing high-quality technical and executive communications, supporting SOC metrics and SLAs, and participating in on-call/out-of-hours response for major incidents when required.

A typical day

• Incident investigation and response.
• Detection engineering and continuous improvement.
• Threat hunting.
• Security projects, Automation and security engineering.
• Mentoring and technical leadership.

About you

Demonstrable experience within a 24x7 Security Operations Centre (SOC) or Incident Response environment, ideally supporting a global organisation.

Proven track record of improving threat detection, monitoring, incident response, and SOC operational maturity at scale.

Strong hands-on experience with SIEM platforms, threat intelligence solutions, security orchestration and automation (SOAR), and enterprise security monitoring technologies.

Good understanding of networking and Internet protocols, together with broad knowledge across multiple security domains and technologies.

Strong analytical, problem-solving, and communication skills, with the ability to engage effectively with both technical and non-technical stakeholders.

Demonstrates integrity, accountability, curiosity, adaptability, and a commitment to continuous learning and professional development.

Required skills

Relevant industry certifications (e.g., CISSP, GCIH, GCFA, GCIA, Se