SOC Engineer - FTC

In this role you will advance the maturity of the SIEM platform and related security solutions for a global legal firm. You will work with cross-functional teams to onboard log sources, optimize data pipelines, and develop advanced detection use cases, strengthening security monitoring and response. The role suits a security professional who enjoys building scalable SOC environments and driving continuous improvement. You’ll contribute to security service enhancements, incident handling, and governance in a fast-paced, technically focused environment.

• Enhance SIEM performance and detection fidelity across ingestion, parsing, and correlation
• Onboard new log sources from cloud, network, endpoint, and application environments; develop parsers and ingestion playbooks
• Design and implement MITRE ATT&CK-aligned detection use cases; tune rules, dashboards, and alert workflows
• Support SOC analysts with advanced SIEM queries and data analysis during investigations
• Document data models, integrations, and detection logic; ensure compliance with security controls and standards
• Collaborate with teams and vendors to ensure high-quality telemetry; contribute to automation and SOAR-enabled response
• Assist with security incident response, change, and problem management as part of operational improvements
• Occasionally support out-of-hours changes or critical security incidents

• Degree (Level 4+) in a computing-related subject or equivalent experience
• Background across IT infrastructure and information security roles
• Certifications such as GIAC, SC-200/SC-100, CISSP, SSCP, CSIS
• Strong scripting skills (Python, PowerShell, PowerApps)
• Excellent communication and stakeholder engagement abilities
• Proactive, self-driven analytical mindset

• Strong communication
• Proactive and self-driven
• Analytical mindset
• SIEM platforms: Splunk, Microsoft Sentinel, QRadar, Elastic, ArcSight, LogRhythm, Exabeam
• Log formats and ingestion methods (JSON, syslog, XML, CEF; APIs, Kafka, Event Hubs, agents)
• Detection engineering; threat modelling; attacker behaviour analysis