SOC L3 Analyst

AtkinsRéalis; The Wells; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Health insurance

Job summary

AtkinsRéalis in the United Kingdom is seeking a Level 3 Analyst to lead complex security investigations within a 24x7 Security Operations Centre. You will act as senior escalation, drive containment, eradication, recovery, and communicate with both technical and business stakeholders.

You will develop detections, automate tasks, mentor SOC analysts, and contribute to SOC process improvements, serving as Incident Commander during major incidents and ensuring security operations align with

Qualifications

• Lead complex and high-severity cyber security investigations and incident response in a 24x7 SOC.
• Act as Technical Incident Lead or Incident Commander during major cyber security incidents.
• Develop and tune security detections, use cases, and playbooks.
• Mentor SOC analysts and communicate with technical and non-technical stakeholders.

Responsibilities

• Incident investigation and response within a 24x7 SOC.
• Threat hunting and proactive investigations across endpoints, network, cloud, identities.
• Automation and orchestration to accelerate investigations and reduce manual tasks.
• Collaborate with cross-functional teams and contribute to SOC improvements.

Job description

The SOC Level 3 (L3) Analyst is responsible for leading the investigation, coordination and resolution of complex security incidents. Acting as a senior technical specialist, the role provides expert guidance on threat detection, incident response, and security operations while supporting the development of SOC capabilities and team expertise. The L3 Analyst maintains high standards of documentation and produces clear, concise communications tailored to both technical and non-technical stakeholders. During major security incidents, the role serves as the Incident Commander and primary point of contact, ensuring effective coordination, stakeholder engagement, and timely decision-making. In addition to operational responsibilities, the L3 Analyst contributes to the continuous improvement of SOC processes, use cases, and detection capabilities. The role requires strong automation and scripting skills to streamline repetitive tasks, enhance operational efficiency, and improve overall security outcomes. Reporting to the SOC Manager, the L3 Analyst is expected to demonstrate a deep understanding of emerging cyber security threats, technologies, and industry's best practices. The role contributes to the organization's cyber security strategy, roadmap, and continuous improvement initiatives, helping to ensure that security operations remain effective, resilient, and aligned with business objectives.Your role

• Lead complex and high-severity cyber security investigations and incident response activities within a 24x7 Security Operations Centre (SOC), acting as a senior technical escalation point, taking ownership of investigations, and driving incidents through containment, eradication, recovery, and closure.
• Act as Technical Incident Lead or Incident Commander, as appropriate, during major cyber security incidents, coordinating technical response activities, assessing risk, making informed decisions in ambiguous situations, and communicating effectively with technical teams, leadership, and business stakeholders.
• Conduct proactive threat hunting, advanced investigations, and forensic triage across endpoint, network, cloud, identity, and other enterprise environments to identify malicious activity, attacker persistence, and previously undetected compromise, while ensuring appropriate preservation and handling of investigative evidence.
• Analyze adversary tactics, techniques, and procedures (TTPs), threat intelligence, emerging threats, vulnerabilities, and investigation findings to develop hunting hypotheses, identify detection gaps, and continuously strengthen the organization's defensive capabilities.
• Develop, tune, test, and continuously improve security detections, analytics, use cases, investigation methodologies, playbooks, and response procedures, including validating detection coverage against realistic adversary behaviors and the MITRE ATT&CK framework.
• Drive automation and orchestration across security operations, using security queries, scripting, and automation to analyze data, accelerate investigations, reduce repetitive manual activities, and improve the consistency and effectiveness of response.
• Lead incident response exercises, tabletop scenarios, post-incident reviews, and continuous-improvement activities, translating lessons learned into measurable improvements to SOC processes, controls, detection capabilities, operational readiness, and cyber resilience.
• Collaborate with Security Engineering, Threat Intelligence, Vulnerability Management, Digital Forensics, IT, cloud and identity teams, and other stakeholders, while mentoring SOC analysts, producing high-quality technical and executive communications, supporting SOC metrics and SLAs, and participating in on-call/out-of-hours response for major incidents when required.

A typical day

• Incident investigation and response.
• Detection engineering and continuous improvement.
• Threat hunting.
• Security projects, Automation and security engineering.
• Mentoring and technical leadership.
  Demonstrable experience within a 24x7 Security Operations Centre (SOC) or Incident Response environment, ideally supporting a global organisation.
• Proven track record of improving threat detection, monitoring, incident response, and SOC operational maturity at scale.
• Strong hands-on experience with SIEM platforms, threat intelligence solutions, security orchestration and automation (SOAR), and enterprise security monitoring technologies.
• Good understanding of networking and Internet protocols, together with broad knowledge across multiple security domains and technologies.
• Strong analytical, problem-solving, and communication skills, with the ability to engage effectively with both technical and non-technical stakeholders.
• Demonstrates integrity, accountability, curiosity, adaptability, and a commitment to continuous learning and professional development., Relevant industry certifications (e.g., CISSP, GCIH, GCFA, GCIA, Security+, Azure Security, or equivalent) would be a plus.
• Incident Management, Curiosity, Critical thinking, Problem-solving, Technical Writing, Continuous improvement, Communication, Mentoring/Coaching.
• Advanced threat investigation, Threat actor TTP analysis (MITRE ATT&CK), Threat Hunting.

Desirable

• Agentic AI.
• Malware analysis.
• Digital forensics and evidence preservation.
  We're AtkinsRéalis, a world-class engineering services and nuclear organization. We connect people, data and technology to transform the world's infrastructure and energy systems. Together, with our industry partners and clients, and our global team of consultants, designers, engineers and project managers, we can change the world. We're committed to leading our clients across our various end markets to engineer a better future for our planet and its people., At AtkinsRéalis, we seek to hire individuals with diverse characteristics, backgrounds and perspectives. We strongly believe that world-class talent makes no distinctions based on gender, ethnic or national origin, sexual identity and orientation, age, religion or disability, but enriches itself through these differences.
  Explore the rewards and benefits that help you thrive - at every stage of your life and your career. Enjoy competitive salaries, employee rewards and a brilliant range of benefits you can tailor to suit your own health, wellbeing, financial and lifestyle choices. Make the most of a myriad of opportunities for training and professional development to grow your skills and expertise. And combine our hybrid working culture and flexible holiday allowances to balance a great job and fulfilling personal life.