Senior Soc Analyst

Role & responsibilities

Own the SOC operating model detection coverage, response playbooks, escalation paths and shift structure.

• Lead incident response end-to-end: detection, containment, eradication, recovery and post-incident RCA, mapped to MITRE ATT&CK.
  
• Design, build and tune detections and use-cases in the SIEM across client SaaS instances and the corporate/M365 environment.
  
• Run proactive threat hunting across cloud, endpoint, identity and network telemetry.
  
• Own the multi-cloud security-monitoring posture (Defender for Cloud / Sentinel, AWS GuardDuty / Security Hub, GCP SCC, OCI Cloud Guard).
  
• Coordinate vulnerability management and remediation tracking with Infrastructure and DevOps, and oversee closure of penetration-test findings.
  
• Interface with client security teams and support customer security questionnaires and assurance for the SaaS.
  
• Report security posture, incidents and SOC KPIs to leadership.
  
• Mentor and quality-assure the SOC Analyst; build runbooks and the SOC knowledge base.
  
• Drive automation / SOAR to reduce mean time to detect and respond (MTTD / MTTR).
• The pod integrates with the 247 support model and works closely with IT Infrastructure, DevOps/cloud and delivery.

Preferred candidate profile

• 3-5 years in SOC / security operations, incident response or threat detection, including hands-on IR leadership.
  
• Strong SIEM engineering (Sentinel, Splunk, QRadar or Elastic), detection use-case design and query languages (KQL, SPL).
  
• Deep understanding of MITRE ATT&CK, the incident lifecycle and forensic fundamentals.
  
• Solid multi-cloud security knowledge (Azure, AWS, GCP, OCI) and M365 / Entra ID identity threats, including AiTM / phishing.
  
• Experience with EDR, firewall and vulnerability-management tooling.
  
• Strong communication and stakeholder management able to brief leadership and clients.
  
• Bachelor's degree or equivalent work experience.