About the role
You will monitor security alerts, investigate suspicious activity and respond quickly when something is wrong. You will improve our detection rules and playbooks, and escalate complex incidents to senior analysts.
What you will do
- Monitor and triage alerts in Microsoft Sentinel or Splunk
- Investigate incidents and escalate them with clear evidence
- Hunt for threats across endpoints, networks and cloud
- Contain incidents and support recovery
- Improve detection rules and use cases mapped to MITRE ATT&CK
- Write clear incident reports
Minimum qualifications
- Bachelor's degree in Cyber Security, Computer Science or a related field, or equivalent practical experience
- 3+ years in a SOC
- Current CompTIA Security+, BTL1 or CREST CPIA
- Daily work in Microsoft Sentinel (KQL) or Splunk (SPL)
- Detection rules you wrote, mapped to MITRE ATT&CK
- Incident handling to NIST SP 800-61
- Willing to pass BPSS screening and work shifts
- English at CEFR C1 or above (IELTS 7.0 or equivalent)
Expert knowledge
- Detection engineering: writing and tuning KQL or SPL rules to cut false positives
- Windows and Linux log sources: event IDs, Sysmon and audit logs
- Incident response lifecycle and evidence handling to NIST SP 800-61
- Threat intelligence: mapping alerts to MITRE ATT&CK and using indicators safely
Preferred qualifications
- Microsoft SC-200 or Splunk Core Certified Power User
- GIAC GCIA or GCIH
- Eligible for UK SC clearance
- Threat hunting reports you can share
Before any offer we verify your certificates, qualifications, references and right to work in the UK. Security roles also need background screening (BPSS) and may need security clearance.
SOWTK is an equal opportunity employer. We welcome applicants of every background and do not discriminate on any characteristic protected by the Equality Act 2010.