Job at a glance
ROLE OVERVIEW This is a senior role with L3 analyst responsibilities with hands-on SOC management, with the technical depth of an L3 makes you a better operations leader, and the management lens makes you a sharper threat hunter. You are the final escalation point for complex incidents, the owner of threat hunting and detection engineering, and the day-to-day leader of the L1/L2 analyst team. You are equally comfortable doing deep forensic analysis and chairing a client Quarterly Business Review.
If you are a senior analyst ready to lead, or someone who refuses to step away from the tools, this role is built for you. KEY RESPONSIBILITIES A | Technical — L3 Analyst, Threat Hunting & DFIR • Proactively hunt for threats across client SIEM, EDR/XDR, and network telemetry using MITREATT&CK-based hypotheses • Build, tune, and maintain SIEM detection rules and SOAR playbooks; map coverage gaps against the ATT&CK matrix • Lead complex incident response end-to-end — scoping, containment, eradication, recovery, and post-incident review • Conduct host, memory(Volatility3), and network forensics to reconstruct attack timelines and identify attacker TTPs • Triage malware samples using sandbox and static/dynamic analysis; extract IoCs and translate findings into detections • Consume and operationalise threat intelligence feeds (MISP, commercial TIPs, open-source) across client environments • Produce clear, accurate incident reports and post-incident reviews suitable for technical teams and client boards • Mentor L1/L2 analysts on active cases and continuously raise the team's technical capability B | Management — SOC Operations, Team & Clients • Lead, develop, and performance-manage the L1 and L2 analyst team; conduct regular 1-to-1s and career development planning • Manage shift rosters and handovers to maintain 24/7 monitoring coverage across all client environments • Own client SLAs — track and report on MTTD, MTTA, MTTC, and MTTR; drive continuous improvement where targets are missed • Develop and maintain SOC runbooks, IR playbooks, escalation procedures, and SOPs • Act as incident commander during major incidents — coordinating response, managing client comms, and directing remediation • Produce monthly client security reports and lead Quarterly Business Reviews (QBRs) with client stakeholders • Oversee the SOC technology stack (SIEM, EDR, SOAR, TIP, ticketing) — licensing, health, configuration, and improvement • Support pre-sales activities including SOC capability demonstrations and onboarding scoping for new clients TECHNICAL SKILLS & KNOWLEDGE • SIEM: Microsoft Sentinel(KQL), Splunk (SPL), IBM QRadar, or Elastic — advanced rule writing, not just usage • EDR/XDR: TrendAI, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne — deep investigative and hunting use • SOAR: Playbook development in Splunk SOAR, Sentinel Logic Apps, Palo Alto XSOAR, or equivalent • DFIR Tooling: Volatility3, Autopsy/FTK, Velociraptor, KAPE, plaso/log2timeline • Network Forensics: Wireshark, Zeek, Suricata, NetFlow/IPFIX analysis • Malware Analysis: Any.run /Cuckoo sandbox, PEStudio, YARA rules, basic static/dynamic analysis • Frameworks: MITREATT&CK, NIST IR lifecycle, PICERL • OS Forensics: Windows event logs (Security, Sysmon), registry, prefetch; Linux syslog, bash history • Active Directory: AD attack paths (Pass-the-Hash, Kerberoasting, DCSync), BloodHound • Cloud: AWS CloudTrail, Azure Activity/Sign-In Logs, M365 Unified Audit Log • Scripting: Python or PowerShell for enrichment, automation, and IoC ingestion (advantageous) COMPETENCIES & SOFT SKILLS • Attacker mindset — you think like a threat actor to build better detections • Calm and decisive under pressure; the team and clients look to you when things are serious • Strong written communication — incident reports and executive summaries that are clear and genuinely useful • Coaching mindset — you invest in L1/L2 development and take satisfaction in the team improving • Commercially aware —understands that SOC performance is a business value driver, not just a technical exercise • Adaptable — able to switch between deep forensic work and a client-facing QBR within the same day EDUCATION & EXPERIENCE Education Bachelor's Degree in Cybersecurity, Computer Science, or IT.
Diploma holders with strong hands-on experience at senior SOC level are equally considered. Experience 5–7 years in security operations, with at least 2–3 years at L2/L3 level. Prior team lead, shift lead, or SOC lead experience is strongly preferred. MSSP experience across multiple client environments is a significant advantage. PREFERRED CERTIFICATIONS GIAC GCIH GIAC GCIA GIAC GCFA GIAC GREM GIAC GSOC CISSP CISM CompTIA CySA+ Microsoft SC-200 Splunk Power User / Admin CompTIA SecurityX BTL2 / OSCP (Advantageous)