SOC Shift Lead

CBSbutler Ltd.; Hemel Hempstead; On-site; GBP 80,000 - 100,000

Job description

SOC Shift Lead

+Permanent opportunity

+£58,000 - £65,000

+SC / DV cleared role

+On site fulltime in Hemel Hempstead

Skills:

• SOC
• Microsoft Sentinel and Splunk
• SIEM

As a SOC Shift Lead, you will be required to conduct monitoring and triage of alerts associated with host and network security events for our client's critical infrastructure. You will support the SOC through both delivery of client work and adding skills and ideas to the already diverse team.

This role is based on site in Hemel Hempstead and involves shift work: 2 days at 6am to 6pm, 2 nights at 6pm to 6am, followed by 4 days off.

Please note you need to be eligible for DV Clearance for this role.

What you'll be doing:

• Monitor, triage, and investigate security incidents on critical client infrastructure.
• In-depth analysis of network traffic, logs, and system events to identify potential security threats and vulnerabilities.
• Line management.
• Maintain, improve, and develop team knowledge of SOC tools, security operations, and triage.
• Analyse and improve detection rules and use cases in line with Mitre Att&ck and threat-informed defence.
• Maintain and update security incident documentation, including incident reports, analysis findings, and recommended mitigation strategies.
• Represent the SOC in partner meetings.
• Ability to work shifts from our office in Hemel Hempstead.

What you'll bring:

• Demonstrable experience in a Security Operations Centre.
• People management experience to help develop analysts and lead careers.
• Demonstrable experience of using Microsoft Sentinel and Splunk.
• Knowledge and experience with the Mitre Att&ck Framework.
• Solid grasp of client-server applications, multi-tier web applications, relational databases, firewalls, VPNs, and enterprise AntiVirus products.
• Good understanding of networking principles including TCP/IP, WANs, LANs, and commonly used Internet protocols such as SMTP, HTTP, FTP, POP, LDAP.

It would be great if you had:

• Static malware analysis and reverse engineering.
• DV Clearance.
• Programming and scripting skills such as Python, Perl, Bash, PowerShell, C++.
• CREST Practitioner Intrusion Analyst/Blue Teams Level 1 or other SOC-related certifications.
• Experience with SIEM technologies, namely Sentinel and Splunk, with some experience with QRadar.

If you'd like to discuss this SOC Lead role, please send your updated CV to [e-mail] and I will get in touch.