T2 SOC Analyst (SC/DV)

Oscar; Stoke-on-Trent; On-site; GBP 45,000 - 55,000; Full time

Benefits offered by this job

Shift allowance

DV clearance environment

Job summary

Oscar in Stoke-on-Trent is seeking an experienced Tier 2 SOC Analyst to own security incidents, investigations and threat analysis within a 24/7 SOC. You'll move beyond triage to drive detection improvement and incident response, while working with SIEM/EDR tooling and cross-functional teams.

Initially office-based in Stoke-on-Trent, you’ll transition to a 3-on/3-off shift pattern with a shift allowance on top of a £50,000 base salary.

Qualifications

• 1–5 years of experience in a SOC or security operations environment.
• Hands-on exposure to SIEM platforms, EDR, threat intelligence.
• Experience with vulnerability management.
• Comfortable owning incidents rather than escalating everything.
• Certifications are beneficial but not required.

Responsibilities

• Investigating and responding to medium and high-severity security incidents
• Performing detailed analysis of alerts, logs and suspicious activity
• Working with SIEM, EDR and wider security tooling
• Escalating and coordinating containment and remediation activity
• Producing incident, vulnerability and SOC reporting
• Sharing knowledge with junior SOC members

Skills

Security monitoring

Alert triage

SIEM

EDR

Threat analysis

Threat intelligence

Vulnerability management

Detection engineering

Tools

SIEM platforms

EDR technologies

Job description

I'm currently working with a high-profile UK security organisation that is looking to add an experienced Tier 2 SOC Analyst to its growing Security Operations function.

This is a great opportunity for someone who has moved beyond purely monitoring and alert triage and wants to take genuine ownership of security incidents, investigations, threat analysis and detection improvement.

The role supports a 24/7 SOC environment protecting highly sensitive UK environments, so you'll be working on meaningful security challenges rather than simply dealing with a high volume of alerts.

£50,000 base salary + shift allowance

Stoke-on-Trent

3 days on / 3 days off

DV cleared environment

The Opportunity:

You'll initially be office-based in Stoke-on-Trent, getting fully embedded within the team and environment.

Once established, you'll move onto a 3-on / 3-off shift pattern, working shifts. A shift allowance will be paid on top of the £50,000 base salary.

As a Tier 2 analyst, you'll sit above the first line of defence and become a key escalation point for more complex security events.

You'll be involved across areas including:

• Investigating and responding to medium and high-severity security incidents
• Performing detailed analysis of alerts, logs and suspicious activity
• Working with SIEM, EDR and wider security tooling
• Escalating and coordinating containment and remediation activity
• Acting as a technical escalation point for Tier 1 analysts
• Identifying indicators of compromise and supporting threat intelligence activity
• Improving detection rules, correlation logic and SOC playbooks
• Investigating recurring alerts and reducing false positives
• Supporting vulnerability management and remediation activity
• Contributing to post-incident reviews and lessons learned
• Producing incident, vulnerability and SOC reporting
• Working closely with wider infrastructure, network, architecture and development teams
• Sharing knowledge and helping develop more junior members of the SOC

What are we looking for?

You'll ideally have 1–5 years' experience within a SOC or security operations environment, with solid hands-on exposure to areas such as:

• Security monitoring and alert triage
• SIEM platforms
• EDR technologies
• Threat analysis / threat intelligence
• Vulnerability management
• Detection engineering or SIEM tuning

I'm particularly interested in speaking with analysts who can demonstrate that they've dealt with real security incidents and are comfortable taking ownership rather than simply escalating everything to someone else.

Relevant certifications such as BTL1/BTL2, Security+, CEH, CISSP, CCSP or vendor/SIEM-specific qualifications are beneficial, but practical capability is more important.

Security Clearance:

Due to the nature of the environment, candidates will need to hold SC and be eligible for DV security clearance.