Senior SOC Analyst

Senior SOC Analyst, Incident Response and Threat Hunting (Contract)

You'll be one of two senior analysts joining the UK hub of a global SOC, owning live caseload and leading investigations from first alert to root cause. This is a hands-on operational role for someone who enjoys the investigation itself, and macOS incident response experience will put you at the front of the queue.

• Location: City of London, onsite for every shift
• Shifts: four 10-hour shifts, 06:00 to 16:00, either Sunday to Wednesday or Wednesday to Saturday
• Contract: ASAP start, initially until March 2027
• Level: Senior, leading investigations technically (no line management)

What you'll actually do

• Manage your own caseload, handling triage, investigation and response day to day
• Run deep investigations and root-cause analysis across macOS, Linux and cloud workloads, then guide the business through eviction and recovery
• Build scripts and AI-assisted automation workflows to speed up triage and response, working with Splunk and a newly introduced agentic AI SOC platform
• Develop and tune alerts to catch anomalous and malicious activity
• Contribute to threat hunting, detection engineering and the team's improvement programmes
• Work closely with the Hunt, Threat Intelligence, Digital Forensics, Legal and Infrastructure teams during incidents

What you'll need

• Senior, hands-on experience in operational SOC or incident response work, with a clear method for how you investigate
• Incident response experience in at least two of: macOS endpoints, Linux in cloud environments, microservices and containers
• Strong networking knowledge. Many of the best fits here started in network or infrastructure engineering before moving into IR
• Scripting to automate investigation and response tasks
• Practical experience using AI tooling to build automation workflows
• Able to work the shift pattern onsite in London

Nice to have

• Splunk
• Proactive threat hunting
• Agentic AI SOC tooling

What's in it for you

Three days off after every four-day block, a 16:00 finish, and real input into how AI-driven tooling is used inside a global SOC.