Senior Incident Response

Stott and May Inc.; London (OH); On-site; USD 93,000 - 146,000; Full time

Job summary

Stott and May Inc. in London seeks a Senior SOC Analyst for a contract role. You will lead day-to-day threat detection, triage, investigation and incident response from the client’s London SOC.

The position emphasizes operational response, with collaboration across teams and a focus on rapid containment, forensics, and proactive investigations. Immediate start and end-March-2027 contract.

Qualifications

• 5+ years directly triaging, managing, investigating and remediating high-severity security incidents.

Responsibilities

• Drive technical response actions to protect the organisation and its global users from fast-moving and AI-driven threats.
• Develop and tune alerts to quickly identify anomalous or malicious activity across the client’s infrastructure.
• Use AI-driven and agentic tools alongside your own investigative skills to run comprehensive investigations and root-cause analysis.
• Guide the business in uncovering, evicting and recovering from attacks by sophisticated threat actors.
• Collaborate with the Hunt, Cyber Threat Intelligence, Digital Forensics, Legal and Infrastructure teams to keep operations coordinated and efficient.
• Turn chaotic incident signals into clear paths forward in complex, ambiguous situations, protecting critical infrastructure, customers, users and data.

Skills

Incident triage

Threat hunting

Global investigations

Linux CLI

Cloud forensics

Tools

Splunk

Docker

Kubernetes

Job description

Senior SOC Analyst – Contract Role

Role overview

Contract role for a Senior SOC Analyst / Incident Response Specialist, on-site

Details

• Role type: Contract
• Level: Senior
• Start: ASAP
• Duration: Initially until end of March 2027
• Location: 100% on-site at the client's SOC, Central London
• Shift pattern: 4 days x 10-hour shifts,

About the role

The client needs a senior analyst who can hit the ground running and help lift the SOC's caseload. The focus is operational: day-to-day threat detection, triage, investigation and incident response, including answering tickets, rather than engineering or project implementation.
The SOC runs on Splunk and is implementing an agentic AI SOC platform. As needed, you will also contribute to detection engineering, threat hunting and proactive investigations.

Responsibilities

• Drive technical response actions to protect the organisation and its global users from fast-moving and AI-driven threats.
• Develop and tune alerts to quickly identify anomalous or malicious activity across the client's infrastructure.
• Use AI-driven and agentic tools alongside your own investigative skills to run comprehensive investigations and root-cause analysis.
• Guide the business in uncovering, evicting and recovering from attacks by sophisticated threat actors.
• Collaborate with the Hunt, Cyber Threat Intelligence, Digital Forensics, Legal and Infrastructure teams to keep operations coordinated and efficient.
• Turn chaotic incident signals into clear paths forward in complex, ambiguous situations, protecting critical infrastructure, customers, users and data.

Minimum qualifications

• 5+ years directly triaging, managing, investigating and remediating high-severity security incidents.
• Proven experience leading deep, complex global investigations across many disparate data sources, teams and regions.
• Deep hands-on Linux/Unix command line experience for low-level system interrogation, log analysis and artefact collection.
• Hands-on cloud forensics and incident response across multi-cloud infrastructure, including container-level forensics (e.g. Docker, Kubernetes, container runtime logs) during active investigations.
• Ability to navigate an active breach, make progress without prescriptive direction, drive remediation with integrity, and lead change through post-incident lessons learned.

Preferred experience

• Operational and incident response experience in at least two of: macOS endpoints, Linux in cloud environments, microservices and containers.
• Practical AI tooling experience, including building automation workflows and scripts to enhance SOC triage and response.
• Splunk experience.
• Exposure to detection engineering, threat hunting and proactive investigations, while keeping day-to-day SOC operations as the main focus.