Lead Security Analyst

Key Responsibilities

• Set the detection engineering standard — author, tune, and peer-review detections in KQL, SPL, EQL, or Sigma; manage the false-positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves.
  
  
• Own the threat-landscape narrative for your engagement — turn intelligence from NCSC advisories, sector feeds, and threat actor reporting into hunt themes, coverage gap analysis, and detection priorities that the SOC and client stakeholders can act on.
  
  
• Run the intelligence cycle as a managed discipline — maintain a collection plan, produce timely and rigorous intelligence products, and build feedback loops that keep the cycle honest and improving.
  
  
• Establish and lead security incident response practice — build playbooks, define the severity model, run exercises, and lead the team's response to significant incidents; run blameless post-mortems that the team actually learns from.
  
  
• Design the log and telemetry pipeline that detections run on — including bespoke application telemetry in cloud environments, not just commodity endpoint feeds; ensure the right signals are collected, parsed, and retained for both detection and investigation.
  
  
• Be the trusted technical interface for client security stakeholders — communicate what the SOC is detecting, investigating, and covering without losing fidelity; surface risks early and honestly, and align the team's priorities to the client's risk picture.
  
  
• Grow the analysts around you — pair on detection authorship and incident response as a default, set pairing as the team norm, and actively build the capability of L1 and L2 analysts through structured mentoring and coaching so knowledge isn't concentrated in one person.
  
  
• Contribute to the Cyber practice beyond your engagement — feed detection content, runbooks, and lessons learned back into shared practice resources; contribute to analyst assessment and hiring; and engage with public-sector security communities including NCSC CISP and relevant ISACs.

Skills, Knowledge & Expertise

• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• CompTIA Advanced Security Practitioner (CASP+)
• Experience leading detection engineering in a SOC or similar environment — including writing and tuning detections in KQL, SPL, EQL, or Sigma, and managing coverage against MITRE ATT&CK
  
  
• Experience designing or improving a log and telemetry pipeline, including application-level telemetry from cloud-hosted services (AWS is a strong preference at this grade), with an understanding of how to design monitoring for failure modes and degraded states
  
  
• Evidence of running the intelligence cycle as a managed discipline — collection planning, production, and feedback — rather than consuming finished intelligence
  
  
• Working knowledge of UK government security standards and frameworks, including NCSC CAF Objective C, GovAssure, and OFFICIAL handling requirements
  
  
• Experience establishing incident response practice — playbooks, severity models, and exercises — not just responding to individual incidents
  
  
• Evidence of growing the technical capability of less experienced analysts through pairing, structured mentoring, or coaching, including setting clear goals and tracking progress over time
  
  
• Experience anchoring delivery on client outcomes rather than task completion — challenging the brief where it serves the client and making value visible rather than reporting effort
  
  
• Evidence of contributing reusable assets — detection playbooks, runbooks, templates, or accelerators — back into a practice or community, rather than leaving knowledge within a single team
  
  

• Familiarity with SOAR tooling and automation of triage and enrichment workflows
  
  
• Experience working in Kanban-led operating models, including managing triage queues, WIP limits, and class-of-service for incidents
  
  
• Experience running or contributing to skills-based technical assessments that evaluate demonstrated capability rather than credentials or years of experience
  
  

Job Benefits