SOC Engineer

Salary: £70,000 - 70,000 per year

Requirements:

• Deep experience with Microsoft Sentinel, Defender suite, and KQL
• Strong scripting and automation skills, including PowerShell, Python, and Logic Apps
• Solid understanding of MITRE ATT&CK, NCSC CAF, and NIST CSF
• Strong stakeholder management skills with the ability to translate technical complexity for non-technical audiences
• Degree in Computer Science, Cyber Security, or equivalent experience
• Desirable: SC-200 or AZ-500 certification, ServiceNow SecOps experience, and experience in regulated sectors such as nuclear, defence, or CNI

Responsibilities:

• Engineer and maintain Microsoft Sentinel, Defender XDR, and Log Analytics platforms
• Onboard and normalise log sources across hybrid and cloud environments
• Write and tune KQL detection rules and analytics logic
• Build SOAR playbooks and automation workflows to reduce manual effort
• Manage telemetry ingestion, parsers, and data retention to optimise cost
• Produce platform health reports and identify coverage gaps
• Mentor junior engineers and contribute to team development
• Act as the technical SME during incidents

Technologies:

• Cloud
• PowerShell
• Python
• Security
• ServiceNow

More:

We are recruiting for an exciting opportunity within a highly regulated environment. We are looking for SOC Engineers at both Junior and Senior levels to join our growing Cyber Security team, where we engineer and optimise Microsoft Sentinel, Defender XDR, and SOAR capabilities. This is an engineering-focused role, not a pure triage or analyst position, and offers the opportunity to build, tune, automate, and scale our detection platform. We offer 30 days annual leave plus bank holidays, hybrid working with flexible on-site arrangements, a clear progression pathway from Junior to Senior to Lead, and a training and certifications budget. You will work with cutting-edge Microsoft security technology and help shape SOC engineering strategy in a critical environment.

last updated 30 week of 2026