Security Operations Center Analyst

Job Description

Job Title: Level 2 SOC Analyst (Microsoft Stack)

Location: Remote-First (1 day per week in Midlands Office)

Salary: Up to £43,000 per annum

Working Hours: 9:00 AM – 5:00 PM (Monday to Friday)

Job Overview:

Our client, a prominent organization within the utilities space, is seeking a proactive and skilled Level 2 SOC Analyst with expertise in the Microsoft stack to join their Security Operations Centre (SOC) team. This is a remote-first role with one day per week in the Midlands office. The Level 2 SOC Analyst will be responsible for investigating and responding to advanced security incidents, leveraging Microsoft-based security tools and platforms, and collaborating with other teams to ensure the protection of critical infrastructure and data.

Key Responsibilities:

1. Incident Investigation & Response:
2. Analyse and investigate security alerts from Microsoft security tools (e.g., Microsoft Sentinel, Defender for Endpoint, etc.).
3. Perform in-depth analysis of security incidents to assess impact and severity, including handling incidents such as malware infections, phishing attacks, insider threats, and more.
4. Escalate and coordinate response efforts with senior analysts and management as necessary.
5. Microsoft Stack Security Management:
6. Utilize Microsoft security tools, including Microsoft Sentinel (SIEM), Defender for Endpoint, and other Microsoft security solutions, to monitor, detect, and respond to security threats.
7. Manage, configure, and fine-tune Microsoft security tools to optimize detection capabilities and reduce false positives.
8. Threat Monitoring & Intelligence:
9. Monitor and analyze logs, network traffic, and system behaviour using Microsoft-based security technologies to identify potential security risks and anomalous activities.
10. Integrate threat intelligence feeds into Microsoft security platforms to enhance threat detection and incident response capabilities.
11. Stay informed about the latest threats, vulnerabilities, and trends relevant to the utilities industry.
12. Collaboration & Communication:
13. Collaborate closely with Level 1 SOC analysts, IT teams, and other stakeholders to ensure timely response to security incidents and proactive threat hunting.
14. Communicate effectively with both technical and non-technical stakeholders, providing detailed incident reports and status updates.
15. Mentor and support junior team members, contributing to their skill development and knowledge.
16. Reporting & Documentation:
17. Document and log all security incidents, investigations, and responses accurately, ensuring compliance with internal processes and industry standards.
18. Prepare and present incident reports, including detailed analyses, to management and stakeholders.
19. Conduct post-incident reviews to identify lessons learned and improve future response efforts.
20. Continuous Improvement:
21. Contribute to the development of incident response procedures and playbooks to ensure best practices and standardized processes.
22. Participate in regular training and development to stay current with Microsoft security technologies, industry best practices, and emerging threats.

Qualifications:

1. Education & Experience:
2. Bachelor's degree in Cybersecurity, Information Technology, or related field (or equivalent experience).
3. 2+ years of experience in a Security Operations Centre (SOC) role, specifically with Microsoft security tools and platforms (e.g., Microsoft Sentinel, Defender, etc.).
4. Experience in a security monitoring and incident response capacity within an enterprise environment, ideally in the utilities or similar critical infrastructure sectors.
5. Skills & Competencies:
6. Proficient in Microsoft security technologies, including Microsoft Sentinel (SIEM), Defender for Endpoint, and other Microsoft-based security solutions.
7. Strong understanding of security protocols, networking, and systems architecture (e.g., TCP/IP, DNS, HTTP/S).
8. Experience in performing log analysis, identifying indicators of compromise (IoCs), and handling security events within Microsoft environments.
9. Ability to respond to and mitigate security incidents, including malware, phishing, and network intrusions.
10. Strong communication and documentation skills, with the ability to provide clear reports to stakeholders.
11. Ability to work independently and manage multiple priorities in a fast-paced environment.
12. Certifications (but not required):
13. Microsoft Certified: Security Operations Analyst Associate (Exam SC-200).
14. CompTIA Security+, Certified Information Systems Security Professional (CISSP), or other relevant security certifications.
15. GIAC Security Essentials (GSEC) or Certified Ethical Hacker (CEH).

Key Attributes:

1. Strong problem-solving and analytical abilities, with attention to detail.
2. Ability to work under pressure and handle high-stress situations effectively.
3. A collaborative mindset with the ability to work closely with cross-functional teams.
4. A passion for cybersecurity and staying up-to-date with the latest trends and threats.