Senior SOC Analyst

Senior SOC Analyst, Incident Response and Threat Hunting (Contract) You'll be one of two senior analysts joining the UK hub of a global SOC, owning live caseload and leading investigations from first alert to root cause. This is a hands-on operational role for someone who enjoys the investigation itself, and macOS incident response experience will put you at the front of the queue.

• Rate: £500 to £700 per day, Inside IR35
• Location: City of London, onsite for every shift
• Shifts: four 10-hour shifts, 06:00 to 16:00, either Sunday to Wednesday or Wednesday to Saturday
• Contract: ASAP start, initially until March 2027
• Level: Senior, leading investigations technically (no line management) What you'll actually do
• Manage your own caseload, handling triage, investigation and response day to day
• Run deep investigations and root-cause analysis across macOS, Linux and cloud workloads, then guide the business through eviction and recovery
• Build scripts and AI-assisted automation workflows to speed up triage and response, working with Splunk and a newly introduced agentic AI SOC platform
• Develop and tune alerts to catch anomalous and malicious activity
• Contribute to threat hunting, detection engineering and the team's improvement programmes
• Work closely with the Hunt, Threat Intelligence, Digital Forensics, Legal and Infrastructure teams during incidents What you'll need Essential
• Senior, hands-on experience in operational SOC or incident response work, with a clear method for how you investigate
• Incident response experience in at least two of: macOS endpoints, Linux in cloud environments, microservices and containers
• Strong networking knowledge. Many of the best fits here started in network or infrastructure engineering before moving into IR
• Scripting to automate investigation and response tasks
• Practical experience using AI tooling to build automation workflows
• Able to work the shift pattern onsite in London Nice to have
• Splunk
• Proactive threat hunting
• Detection engineering
• Agentic AI SOC tooling What's in it for you Three days off after every four-day block, a 16:00 finish, and real input into how AI-driven tooling is used inside a global SOC.