Senior SOC Analyst

About Resillion

Resillion is a global provider of digital assurance, cybersecurity, and testing services. We help organisations strengthen their security posture, protect critical assets, and deliver high-quality digital solutions. Our teams operate across multiple specialist disciplines, including Digital Forensics, Incident Response, SOC Operations, Quality & Compliance, and Technical Consultancy. We are committed to excellence, continuous improvement, and delivering trusted, customer-focused services that meet the highest professional and accreditation standards.

Key Responsibilities

• Lead the investigation and analysis of complex security incidents, determining root cause, impact, and remediation activities.
• Act as a senior escalation point for SOC Analysts, providing mentoring, guidance, and technical leadership during incident investigations.
• Conduct advanced threat hunting activities across customer environments to proactively identify malicious activity and emerging threats.
• Analyse and contextualise Threat Intelligence from multiple sources to enhance detection capabilities and improve response effectiveness.
• Lead the evaluation of customer security postures and recommend improvements to strengthen defensive capabilities.
• Drive continuous improvement initiatives across incident response, detection engineering, and SOC operational processes.
• Own the creation, review, and optimisation of SOC Playbooks, Runbooks, and operational procedures.
• Develop, tune, and maintain SIEM use cases, correlation rules, alert logic, dashboards, and reporting capabilities.
• Provide technical leadership for vulnerability management activities, ensuring effective prioritisation and remediation guidance.
• Collaborate with Incident Response, Engineering, Threat Intelligence, and customer teams during security incidents and service improvements.
• Produce detailed technical and executive-level incident reports, recommendations, and service review documentation.
• Support customer onboarding activities, including log source integration, detection design, and security monitoring strategy.

Required Skills and Qualifications

• Extensive security monitoring and incident investigation experience with one or more SIEM platforms, preferably Microsoft Sentinel.
• Strong experience developing, tuning, and optimising SIEM detection rules, analytics, dashboards, and alerting frameworks.
• Advanced knowledge of threat detection methodologies, attack frameworks such as MITRE ATT&CK, and threat hunting techniques.
• Strong understanding of networking principles including TCP/IP, WANs, LANs, DNS, HTTP/S, VPNs, and commonly used Internet protocols.
• Strong hands-on experience across Windows, Linux, Active Directory, Microsoft Azure, and cloud security technologies.
• Deep understanding of security technologies including SIEM, EDR/XDR, Firewalls, IDS/IPS, Web Proxies, Email Security, Identity and Access Management, and Encryption technologies.
• Proven experience managing and responding to security incidents throughout the full incident lifecycle.
• Experience conducting malware analysis, vulnerability management, and forensic triage activities.
• Previous MSSP/SOC experience with excellent stakeholder management and communication skills.
• Ability to mentor and support junior analysts while maintaining high operational standards.
• Strong analytical, troubleshooting, and problem-solving skills with excellent attention to detail.
• Comfortable working within a rotational shift environment

Desirable Skills and Qualifications

• Microsoft certifications such as AZ-500, SC-200, SC-300, or equivalent security-focused certifications.
• Strong knowledge of Microsoft Kusto Query Language (KQL) and detection engineering practices.
• Hands-on experience with CrowdStrike Falcon and Microsoft Defender XDR.
• Experience leading or supporting Cyber Incident Response engagements aligned to NIST frameworks.
• Knowledge of threat intelligence platforms and threat hunting methodologies.
• Industry certifications such as CISSP, GCIA, GCIH, GCFA, CySA+, or Security+.
• Familiarity with ITIL practices regarding Incident, Problem, and Change Management.
• Experience automating security operations through scripting (PowerShell, Python, or similar).

Why Join Resillion?

• Opportunity to work within a growing and highly skilled Security Operations team.
• Exposure to a wide range of customer environments and security technologies.
• Career development and certification support.
• Collaborative and supportive working environment.
• Flexible hybrid working options.
• Opportunity to help organisations protect themselves against evolving cyber threats.

Apply

If you have experience in security operations, enjoy investigating threats and incidents, and are looking to develop your cybersecurity career within a leading digital assurance and cyber services organisation, we'd love to hear from you.