SOC Engineer

CONTEXT

Our client, a major player in its sector, is investing in a more mature security operations capability to protect a hybrid estate that spans cloud services and on-premises systems. The environment is dynamic, the threat landscape is always moving, and the organisation needs engineers who can operate at Level 2 and Level 3 without losing sight of the bigger defensive picture. This is not only about watching alerts: it is about active threat hunting, deep incident analysis, clear documentation, and advising technical teams on how to secure networks and data systems in practice. The SOC team is expected to act as both controller and trusted advisor, translating suspicious signals into decisions and turning hard-won incident lessons into better procedures. The role suits someone who enjoys the rhythm of reactive response but also has the discipline to improve prevention, detection, and runbooks before the next incident arrives. The mission offers the chance to shape a stronger security posture in an organisation where resilience matters every day.

ACTIVITIES

• Perform active threat hunting across cloud and on-premises environments to uncover activity that automated alerts may miss.
• Investigate and handle security incidents at Level 2 and Level 3, from triage and containment to root-cause analysis and recommendations.
• Analyse network and system security events, correlate evidence, and produce clear incident reports for technical and non-technical stakeholders.
• Develop and maintain SOC documentation, procedures, playbooks, and escalation paths that make the team faster and more consistent.
• Advise infrastructure and application teams on secure network and data system configurations.
• Contribute to proactive security measures, detection improvements, and control hardening based on observed threats.
• Collaborate with other security and IT specialists to close gaps, improve visibility, and mature the overall security operations capability.

EXPECTED ACHIEVEMENTS

• Faster detection and response to threats across a mixed cloud and on-premises estate.
• Better incident handling quality through structured analysis, clear documentation, and reusable playbooks.
• Stronger preventive controls and security advice adopted by technical teams.
• A more mature SOC posture with improved threat hunting, escalation, and reporting practices.
• Reduced operational risk and greater confidence in the organisation’s ability to protect critical systems and data.

ENVIRONMENT

• Level 2 and Level 3 SOC operations covering cloud and on-premises security.
• Threat hunting, incident response, log analysis, and security event correlation.
• Network security, data system security, and advisory work with infrastructure and application teams.
• Documentation, playbooks, procedures, and continuous improvement of SOC processes.
• A collaborative security environment focused on proactive defence as well as reactive investigation.