Senior Security Operational Centre Engineer

In this role you will engineer and deploy high-quality detections for Microsoft Sentinel and Splunk to protect critical systems in real time. You’ll translate threat intelligence into actionable detection logic and work at the heart of a live SOC. You’ll collaborate across security teams to continuously improve detections and reliability, contributing to national security-focused client work in a hybrid setting.

• 25 days annual leave
• 4 x life Insurance
• matched contributory pension to 6%
• 3% flex benefit
• single private medical cover
• ca allowance

• Develop, test and deploy detection content across Microsoft Sentinel and Splunk SIEM
• Write and optimise detection logic using KQL and SPL
• Translate monitoring requirements into effective detections
• Fine-tune alerts to reduce false positives and improve SOC efficiency
• Validate detections against telemetry for accuracy
• Assist onboarding of log sources across cloud, infrastructure, identity and network
• Collaborate with SOC, Threat Intelligence and Security Architecture teams
• Investigate detection issues and improve performance and reliability
• Drive continuous improvement through automation, scripting and best practices
• Document detections for operational usability

• Experience in SOC engineering, detection engineering or SIEM engineering
• Hands-on experience with Microsoft Sentinel and Splunk
• Strong knowledge of KQL and SPL
• Experience building, testing and maintaining detection rules
• Understanding of SIEM lifecycle management and security telemetry
• Knowledge of cloud environments and IT infrastructure
• Familiarity with MITRE ATT&CK framework
• Ability to analyse threats and translate them into detection capability

• Collaborative mindset
• Analytical thinking
• Problem-solving
• Microsoft Sentinel
• Splunk
• KQL