Senior SOC Engineer

1. SIEM Engineering & Management - Deploy, configure, and maintain the QRadar SIEM platform. - Onboard and normalise log sources across on-premises and cloud environments. - Develop and optimise analytical rules for threat detection, anomaly detection, and behavioural analysis. 2. Playbook Development & Automation - Design and implement incident response playbooks for scenarios such as phishing, lateral movement, and data exfiltration. - Integrate playbooks with SOAR platforms (e.g., Microsoft Logic Apps, XSOAR) to streamline triage and automate response. - Refine playbooks based on threat intelligence and incident insights. 3. Threat Detection & Response - Monitor and analyse security alerts and events to identify potential threats. - Conduct investigations and coordinate incident response activities. - Collaborate with threat intelligence teams to enhance detection logic. 4. Threat Modelling & Use Case Development - Lead threat modelling exercises using frameworks such as MITRE ATT&CK, STRIDE, and Cyber Kill Chain. - Translate threat models into actionable detection use cases and SIEM rules. - Prioritise detection engineering based on business risk and impact. 5. Reporting & Collaboration - Produce reports and dashboards to communicate security posture and incident trends. - Partner with IT, DevOps, and compliance teams to enforce secure configurations. - Provide mentorship to junior analysts and engineers. - Maintain documentation of security procedures, incident response plans, runbooks, and playbooks. - Contribute to monthly reporting packs in line with contractual obligations. 6. Additional Contributions - Support pre-sales teams with technical requirements for new opportunities. - Demonstrate SOC tools and capabilities to clients. - Participate in continual service improvement initiatives, recommending changes to address recurring incidents.