SOC Analyst – L2 (Security Operations Center)

We are looking to augment our internal Security Operations Centre (SOC) capability with L1, L2 and L3 resources to strengthen operations alongside our existing external Managed Security Service. Our requirement is weighted more towards L2 capability, with a smaller number of L1 and balanced L3 resources. The focus is on operational SOC analysts with strong hands-on experience across the Microsoft security ecosystem. The key capabilities we are looking for are: • L1: Alert monitoring, triage, initial investigation and escalation in line with defined SLAs and playbooks. • L2: Deeper incident investigation, SIEM analysis, detection/rule configuration and tuning, threat analysis, and escalation of higher-severity incidents. • L3: Advanced investigation and detection engineering, including development and optimisation of log-based use cases, SOAR automation and orchestration , complex incident support and technical escalation. • Incident response: L2/L3 resources should be able to support major incidents, including coordinating or acting as incident commander on incident bridges and driving investigations through containment and closure. Core Skills: Strong hands-on experience with Microsoft Sentinel, Defender XDR, KQL and Microsoft security technologies . Experience across wider SOC capabilities such as SOAR, EDR/XDR, NDR, WAF, DLP, PAM, email, cloud and application security monitoring is desirable. • Focus: Hands-on operational SOC capability, investigation, response and detection improvement. SIEM administration is not the requirement. • Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field; relevant experience may substitute. • Possession of advanced certifications such as CISSP, GCIA, GCIH, or similar demonstrates a commitment to cybersecurity mastery. • Minimum of 3-5 years of hands-on experience in a Security Operations Center or related cybersecurity role, with a proven track record. • Deep understanding of network protocols, operating systems (Windows, Linux), and common attack frameworks (e.g., MITRE ATT&CK).