SOC Engineer - Security Operations Centre (SOC)

About Resillion

Resillion is a global provider of digital assurance, cybersecurity, and testing services. We help organisations strengthen their security posture, protect critical assets, and deliver high-quality digital solutions.

Our teams operate across multiple specialist disciplines, including Digital Forensics, Incident Response, SOC Operations, Quality & Compliance, and Technical Consultancy. We are committed to excellence, continuous improvement, and delivering trusted, customer-focused services that meet the highest professional and accreditation standards.

---

Location: UK / Hybrid (regular overlap with India-based SOC team required)
Reporting To: Head of SOC
Department: Cyber Security - Security Operations Centre (SOC)
Employment Type: Full Time, Permanent

About the Role

We are seeking a SOC Engineer to join our growing Security Operations Centre (SOC). This is a hands-on technical role focused on monitoring, investigating, and responding to security events while supporting the development and continual improvement of our SOC services.

Working closely with SOC Analysts, Security Engineers, customers, and internal stakeholders, you will help ensure security technologies are effectively deployed, monitored, and optimised to protect customer environments. You will play an important role in incident response, threat detection, vulnerability management, and the ongoing enhancement of security operations processes.

This role is ideal for someone looking to further develop their cyber security career within a fast-paced MSSP environment.

---

Key Responsibilities

• Monitor, investigate, and analyse security alerts and incidents across customer environments.
• Perform triage and root cause analysis of security events and escalations.
• Support the containment, remediation, and recovery of cyber security incidents.
• Analyse threat intelligence sources to identify emerging threats and attack trends.
• Assist with the tuning and optimisation of SIEM platforms, with a preference for Microsoft Sentinel.
• Develop and maintain detection rules, analytics, dashboards, playbooks, and runbooks.
• Support vulnerability management activities, including vulnerability scanning, analysis, and reporting.
• Participate in security assessments and provide recommendations to strengthen customer security posture.
• Contribute to incident response processes and continuous improvement initiatives.
• Produce clear and accurate incident reports, customer updates, and technical documentation.
• Work collaboratively with SOC teams, customers, and other technical functions to resolve security issues.
• Assist with onboarding new customer environments into SOC monitoring services.
• Support security projects and implementation activities as required.
• Follow ITIL best practices relating to Incident, Problem, and Change Management.

---

Required Skills & Experience

• 2-5 years' experience in a Security Operations Centre (SOC), MSSP, or cyber security operations environment.
• Experience using SIEM technologies, preferably Microsoft Sentinel.
• Experience creating, tuning, and maintaining SIEM detection rules and monitoring content.
• Strong understanding of networking concepts, including TCP/IP, DNS, LAN, WAN, VPN, and common internet protocols.
• Good understanding of Windows Server, Linux, Microsoft Azure, and cloud technologies.
• Knowledge of security technologies including:
  • SIEM platforms
  • Firewalls
  • Endpoint Detection & Response (EDR)
  • Anti-virus solutions
  • IDS/IPS
  • Web proxies
  • Authentication and identity management solutions
  • Encryption technologies
• Experience investigating security incidents and following incident management processes.
• Understanding of malware analysis concepts and vulnerability management practices.
• Strong analytical and troubleshooting skills.
• Excellent written and verbal communication skills.
• Strong attention to detail and commitment to quality.
• Ability to work effectively within a collaborative team environment.

---

Desirable Skills & Qualifications

• SC-200 Microsoft Security Operations Analyst certification.
• AZ-500 Microsoft Azure Security Technologies certification.
• Experience using Microsoft Defender XDR technologies.
• Knowledge of Microsoft Kusto Query Language (KQL).
• Experience with CrowdStrike Falcon.
• Experience handling Cyber Incident Response activities aligned to the NIST framework.
• Exposure to SOAR technologies and automation.
• Understanding of MITRE ATT&CK framework.
• Experience working within a Managed Security Services Provider (MSSP) environment.
• Familiarity with security compliance frameworks and standards.

---

What Success Looks Like

• Delivering effective monitoring and response services for Resillion customers.
• Identifying and mitigating threats before they impact customer environments.
• Contributing to continual improvements across detection capabilities and operational processes.
• Maintaining high standards of customer service, documentation, and technical excellence.
• Supporting the growth and maturity of Resillion's Security Operations Centre.

---

This position offers an excellent opportunity to work across a diverse range of customer environments while developing expertise in modern cyber security operations, threat detection, incident response, and security engineering.