24/7 SOC Analyst

Nomios' mission is to build a 'secure and connected' future. Organisations across Europe depend on us to help secure and connect their digital infrastructures. In support of our continued UK growth, we are seeking an experienced SOC Analyst to join our 24/7 Security Operations Centre. Candidates must have previous hands-on SOC experience, with a strong preference for experience gained within a managed service provider (MSP) or managed security service provider (MSSP) supporting multiple customer environments.

Please note: this role has a planned start date of January 2027. We welcome applications from candidates who can commence employment at that time.

You will be working across a diverse set of customer environments as part of our Security Operations Centre, focusing on investigation, understanding attacker behaviour and contributing to the continual improvement of SOC capabilities.

Your role as Security Operations Centre (SOC) Analyst

As a 24/7 SOC Analyst, you will be on the frontline of our Security Operations Centre, monitoring, investigating and escalating security events across multiple customer environments. You will apply established SOC experience from day one, work confidently within customer-specific workflows and service commitments, and collaborate with Senior and Lead Analysts on complex investigations. You will use platforms including Microsoft Sentinel and Defender, Palo Alto Networks XSIAM, XDR and XSOAR, SentinelOne, CrowdStrike Falcon and Google SecOps to establish what happened, how activity progressed and what action is required.

You will join a modern, continuously evolving SOC run by people who are technical at heart and understand what analysts need to succeed. Career development is a core focus, with clear pathways into Threat Intelligence, SOC Engineering, SOC Professional Services, senior SOC roles and Incident Response for those who want to specialise. You’ll be part of a collaborative, agile team that values curiosity, humour and a genuine interest in technology. The environment is built around continuous improvement, with everyone having a voice in shaping how the department evolves. Regular team events and knowledge-sharing sessions create a supportive, engaging place to work.

Key Responsibilities

Detect and investigate

• Monitor and triage alerts across SIEM, EDR or XDR, email and web security platforms.

• Investigate suspicious activity and determine whether escalation is required.

• Follow SOC runbooks and investigation workflows.

• Build clear timelines of activity and maintain accurate investigation notes.

• Escalate complex cases to Senior and Lead Analysts with appropriate context.

• Review vulnerability management output and provide basic prioritisation insight.

Hunt and improve

• Take part in directed threat hunting activities.

• Suggest improvements to detections, dashboards and runbooks.

• Support testing of new use cases and detection logic.

Collaborate and communicate

• Provide clear written updates for customers and internal stakeholders.

• Participate in shift handovers to maintain continuity.

• Work closely with Senior and Lead Analysts to develop your skills and technical depth.

We hire result-orientated, smart, and high-energy individuals who bring a can-do attitude and a willingness to go the extra mile and deliver exceptional outcomes. You should be organised and rigorous, with excellent analytical skills. Good communication with internal stakeholders is vital, as is the ability to work as part of a dynamic team.

Required skills:

• Previous hands-on experience working in a Security Operations Centre. This role is not suitable for candidates seeking their first SOC Analyst position.

• For candidates from an MSP or MSSP background, a minimum of one year's hands-on experience using comparable SOC technologies and supporting multiple customer environments.

• Experience triaging, investigating and escalating security alerts across SIEM, EDR or XDR platforms.

• Strong understanding of attacker behaviours, TTPs and common malware execution chains, including phishing leading to script or binary execution.

• Ability to identify indicators of compromise, build clear investigation timelines and distinguish legitimate administrative activity from suspicious behaviour.

• Ability to read and interpret Windows event logs, authentication logs, process trees, network telemetry and other relevant log sources.

• Understanding of core network protocols including DNS, HTTP, SMB and LDAP, together with operational knowledge of Windows, macOS and Linux.

• Working knowledge of MITRE ATT&CK and experience applying it during investigations or detection development.

• Clear written and verbal communication skills, with the ability to provide accurate customer updates, investigation notes and shift handovers.

• Strong Microsoft 365 skills, particularly Excel, Word and PowerPoint, plus experience of Salesforce or a comparable case-management platform.

Desirable skills:

• Hands-on experience with Microsoft Sentinel and Defender; Palo Alto Networks XSIAM, XDR and XSOAR; SentinelOne; CrowdStrike Falcon; or Google SecOps.

• Experience using VirusTotal, ANY.RUN, Shodan, Qevlar, Vectra AI, Tracebit or Thinkst Canary as part of investigations, threat hunting or security validation.

• Ability to query in KQL, CQL, S1QL, XQL or similar languages, and to improve detections, dashboards, runbooks or detection logic.

• Hands-on technical certifications, particularly those assessed through practical labs or examinations rather than solely through multiple-choice testing.

• A relevant degree in cyber security, digital forensics, incident response, networking, information technology, computing or programming.

• Practical AI experience beyond browser-based prompting, such as building agents or agentic workflows; working with VS Code, Codex, Claude Code or Cowork; or using Copilot, Claude or ChatGPT for threat hunting, detection-rule creation and detection-as-code workflows through GitHub or GitLab.

• Scripting or programming experience that supports investigation, automation, enrichment or detection engineering.

Job Specifics

• Location: This role is home-based with occasional visits to the office in Basingstoke

• Hours: 12-hour shifts: 2 days, 2 nights; 4 days/nights off. Flexibility with hours will be required in the event of a major incident

• Security clearance: Eligibility for SC clearance (lived in the UK for five years consecutively) required. DV clearance eligibility is advantageous.

• Start date: January 2027

Why would you choose to come and work with us?

We invest in our people. You will get to work in a dynamic, fast-paced environment where you are free to use your initiative in support of our strategic objectives. You will work alongside high calibre sales, technical, and operational experts as part of a supportive, tight-knit team, within which every individual has an important part to play and makes a real difference. Nomios offers a highly competitive salary and commission scheme along with industry-leading benefits.

Ready to make an impact? Apply now!

Nomios is an equal opportunity employer and is committed to creating and sustaining an environment in which everyone is provided with an equal opportunity to grow and develop, and no individual will be unjustly discriminated against. This includes, but is not limited to, discrimination because of age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion and belief, sex and sexual orientation.