The posting
ROLE OVERVIEW
This is a senior role with L3 analyst responsibilities with hands-on SOC management, with the technical depth of an L3 makes you a better operations leader, and the management lens makes you a sharper threat hunter. You are the final escalation point for complex incidents, the owner of threat hunting and detection engineering, and the day-to-day leader of the L1/L2 analyst team. You are equally comfortable doing deep forensic analysis and chairing a client Quarterly Business Review. If you are a senior analyst ready to lead, or someone who refuses to step away from the tools, this role is built for you.
KEY RESPONSIBILITIES
A | Technical — L3 Analyst, Threat Hunting & DFIR
• Proactively hunt for threats across client SIEM, EDR/XDR, and network telemetry using MITREATT&CK-based hypotheses
• Build, tune, and maintain SIEM detection rules and SOAR playbooks; map coverage gaps against the ATT&CK matrix
• Lead complex incident response end-to-end — scoping, containment, eradication, recovery, and post-incident review
• Conduct host, memory(Volatility3), and network forensics to reconstruct attack timelines and identify attacker TTPs
• Triage malware samples using sandbox and static/dynamic analysis; extract IoCs and translate findings into detections
• Consume and operationalise threat intelligence feeds (MISP, commercial TIPs, open-source) across client environments
• Produce clear, accurate incident reports and post-incident reviews suitable for technical teams and client boards
• Mentor L1/L2 analysts on active cases and continuously raise the team's technical capability
B | Management — SOC Operations, Team & Clients
• Lead, develop, and performance-manage the L1 and L2 analyst team; conduct regular 1-to-1s and career development planning
• Manage shift rosters and handovers to maintain 24/7 monitoring coverage across all client environments
• Own client SLAs — track and report on MTTD, MTTA, MTTC, and MTTR; drive continuous improvement where targets are missed
• Develop and maintain SOC runbooks, IR playbooks, escalation procedures, and SOPs
• Act as incident commander during major incidents — coordinating response, managing client comms, and directing remediation
• Produce monthly client security reports and lead Quarterly Business Reviews (QBRs) with client stakeholders
• Oversee the SOC technology stack (SIEM, EDR, SOAR, TIP, ticketing) — licensing, health, configuration, and improvement
• Support pre-sales activities including SOC capability demonstrations and onboarding scoping for new clients
TECHNICAL SKILLS & KNOWLEDGE
• SIEM: Microsoft Sentinel(KQL), Splunk (SPL), IBM QRadar, or Elastic — advanced rule writing, not just usage
• EDR/XDR: TrendAI, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne — deep investigative and hunting use
• SOAR: Playbook development in Splunk SOAR, Sentinel Logic Apps, Palo Alto XSOAR, or equivalent
• DFIR Tooling: Volatility3, Autopsy/FTK, Velociraptor, KAPE, plaso/log2timeline
• Network Forensics: Wireshark, Zeek, Suricata, NetFlow/IPFIX analysis
• Malware Analysis: Any.run /Cuckoo sandbox, PEStudio, YARA rules, basic static/dynamic analysis
• Frameworks: MITREATT&CK, NIST IR lifecycle, PICERL
• OS Forensics: Windows event logs (Security, Sysmon), registry, prefetch; Linux syslog, bash history
• Active Directory: AD attack paths (Pass-the-Hash, Kerberoasting, DCSync), BloodHound
• Cloud: AWS CloudTrail, Azure Activity/Sign-In Logs, M365 Unified Audit Log
• Scripting: Python or PowerShell for enrichment, automation, and IoC ingestion (advantageous)
COMPETENCIES & SOFT SKILLS
• Attacker mindset — you think like a threat actor to build better detections
• Calm and decisive under pressure; the team and clients look to you when things are serious
• Strong written communication — incident reports and executive summaries that are clear and genuinely useful
• Coaching mindset — you invest in L1/L2 development and take satisfaction in the team improving
• Commercially aware —understands that SOC performance is a business value driver, not just a technical exercise
• Adaptable — able to switch between deep forensic work and a client-facing QBR within the same day
EDUCATION & EXPERIENCE
Education
Bachelor's Degree in Cybersecurity, Computer Science, or IT. Diploma holders with strong hands-on experience at senior SOC level are equally considered.
Experience
5–7 years in security operations, with at least 2–3 years at L2/L3 level. Prior team lead, shift lead, or SOC lead experience is strongly preferred. MSSP experience across multiple client environments is a significant advantage.
PREFERRED CERTIFICATIONS
- GIAC GCIH
- GIAC GCIA
- GIAC GCFA
- GIAC GREM
- GIAC GSOC
- CISSP
- CISM
- CompTIA CySA+
- Microsoft SC-200
- Splunk Power User / Admin
- CompTIA SecurityX
- BTL2 / OSCP (Advantageous)
