Senior Soc Analyst

Senior SOC Analyst - Threat Hunting & Detection Engineering

Contract: 6 Months
Location: UK (Hybrid)
Day Rate: Competitive
Sector: Life & Pensions / Financial Services

Overview

We are seeking an experienced SOC / Senior SOC Analyst to join a leading Life & Pensions organisation, supporting the continued maturity of its Cyber Security Operations capability. This role is focused on proactive threat detection, threat hunting, incident investigation, and detection engineering within a Microsoft security technology stack.

The successful candidate will operate beyond traditional alert monitoring, taking ownership of identifying emerging threats, enhancing security monitoring capabilities, and improving the effectiveness of security controls across the organisation. Working closely with Security Operations, Infrastructure, Cloud, Compliance, and Risk teams, you will play a key role in strengthening cyber resilience within a highly regulated financial services environment.

Key Responsibilities

• Conduct proactive threat hunting activities using intelligence-led and hypothesis-driven methodologies across cloud, endpoint, identity and infrastructure environments.
• Design, develop and optimise detection use cases, analytics rules and alerting mechanisms within Microsoft Sentinel.
• Investigate and triage complex security incidents, providing senior-level analysis, containment recommendations and remediation guidance.
• Act as an escalation point for security events and incidents identified by SOC analysts and automated tooling.
• Develop and maintain detection engineering standards to improve visibility and reduce false positives.
• Build, refine and optimise KQL queries, workbooks, dashboards and analytics rules within Microsoft Sentinel.
• Enhance monitoring coverage across Microsoft Defender technologies including Defender for Endpoint, Defender for Identity and Defender for Cloud.
• Leverage threat intelligence feeds, MITRE ATT&CK techniques and industry threat trends to improve detection capabilities.
• Support incident response activities and post-incident reviews, identifying opportunities for control and process improvements.
• Contribute to security automation initiatives through SOAR playbooks, scripting and workflow optimisation.
• Produce high-quality investigation reports, detection documentation, playbooks and operational procedures.
• Mentor junior analysts and support the ongoing development of SOC capabilities and best practices.
• Collaborate with infrastructure, cloud, architecture, governance and risk teams to ensure findings are remediated effectively.
• Support security and regulatory initiatives across FCA, PRA and broader financial services control frameworks.

Essential Skills & Experience

• Proven experience working within a Security Operations Centre (SOC) environment as a SOC Analyst, Senior SOC Analyst, Threat Hunter or Detection Engineer.
• Strong hands-on experience with Microsoft Sentinel, including:
• KQL query development
• Analytics rules creation and tuning
• Workbooks and dashboards
• Incident investigation and hunting
• Data connector management
• Strong experience across the Microsoft Defender suite, including:
• Microsoft Defender for Endpoint
• Microsoft Defender for Identity
• Microsoft Defender for Cloud
• Microsoft Defender XDR
• Demonstrable threat hunting experience within enterprise environments.
• Experience developing, tuning and maintaining detection logic and detection use cases.
• Strong understanding of incident response methodologies and cyber threat analysis.
• Experience investigating endpoint, identity, network and cloud-based security incidents.
• Ability to work independently while managing multiple priorities and security investigations.
• Excellent stakeholder engagement and communication skills.
• Previous experience working within Financial Services, Banking, Insurance, Life & Pensions or other regulated environments.
• Strong understanding of security operations processes, controls and governance.

Desirable Skills & Experience

• Experience using the MITRE ATT&CK framework for threat hunting and detection development.
• Knowledge of attack techniques, adversary behaviours and threat actor tactics.
• Experience developing SOAR playbooks and automation workflows.
• Scripting experience using Python, PowerShell or automation tooling.
• Experience with threat intelligence platforms and threat-led security operations.
• Familiarity with cloud security monitoring across Microsoft Azure environments.
• Exposure to DORA, FCA, PRA or other financial services regulatory frameworks.
• Experience supporting cyber resilience and operational resilience programmes.

Certifications (Desirable)

• Microsoft SC-200 Security Operations Analyst
• CISSP
• GCIH
• GCFA
• GCIA
• Microsoft Security Certifications
• Azure Security Certifications

Guidant, Carbon60, Lorien & SRG - The Impellam Group Portfolio are acting as an Employment Business in relation to this vacancy.