Security Operations Consultant

As a Security Operations Consultant in PA’s Digital Trust & Cyber Security practice, you will lead SOC analysts and incident responders for client engagements. You’ll blend operational leadership with advisory work to modernise clients’ SecOps, optimise SIEM/SOAR/EDR, and enhance cyber resilience. You operate across fast-paced client environments, solving complex security challenges with cross-functional teams. This role offers hands-on impact, stakeholder collaboration, and opportunities to shape security operations at scale.

• private healthcare for you and your family
• 25 days annual leave (plus bonus half day on Christmas Eve)
• generous pension
• community and charity involvement
• annual performance-based bonus
• PA share ownership

• Lead and develop SOC analysts and incident response specialists with clear operational direction
• Manage live cyber security incidents including investigation, containment, eradication, and post-incident reviews
• Assess and improve clients' Security Operations capabilities across people, processes, and technology
• Advise on evolution and optimisation of SIEM, SOAR, EDR and threat-detection tooling
• Develop and maintain incident playbooks, standard operating procedures, and automated response workflows
• Share expertise across the Digital Trust & Cyber Security community through coaching and mentoring

• SOC Leadership: experience supervising a SOC, CSOC, or Incident Response team
• Incident Response: hands-on experience managing live cyber incidents (e.g., ransomware, account takeovers, supply chain breaches)
• Technical Stack: experience with major SIEM/SOAR tools (e.g., Microsoft Sentinel, Splunk) and EDR/XDR (e.g., Defender for Endpoint, CrowdStrike)
• Security Frameworks: knowledge of MITRE ATT&CK, NIST CSF, NCSC Caf v4.0, ISO 27001
• Communication: ability to write concise incident reports and communicate with engineers and business leaders

• Client-facing mindset
• Strong stakeholder management
• Clear written and verbal communication
• Microsoft Sentinel
• Splunk
• Microsoft Defender for Endpoint