Location
London

Hours
Full Time

Salary
Negotiable

About the Role
The Security Operations Analyst plays a central role in strengthening OCS’s cyber defence capability. This role exists to make our SecOps function measurably more effective every quarter by improving how we detect, investigate and respond to threats, and by removing the friction that holds analysts back. We are looking for a proactive engineer who does not wait to be told where the problems are. The successful candidate will actively identify weaknesses in detection coverage, configuration drift in security platforms, gaps in automation, and inefficiencies in processes. They will propose pragmatic fixes, build them, and measure the outcomes.

Main Duties & Responsibilities:
Detection engineering and tuning
Build, test and maintain high-quality detections across SIEM, XDR and email security platforms, mapped to the MITRE ATT&CK framework. Continuously tune existing detections to reduce false positives and improve fidelity using a data-driven approach. Identify gaps in detection coverage proactively and propose engineering work to close them. Develop and maintain detection-as-code practices including version control, peer review and CI/CD where appropriate.

Automation and tooling
Identify repetitive analyst tasks and engineer automation to remove them using SOAR, native platform automation, scripting or low-code approaches. Build and maintain integrations between security tools and adjacent platforms such as identity, endpoint management and ticketing. Develop and maintain dashboards that provide clear views of operational health for analysts and leadership.

Platform health and configuration
Own the configuration and ongoing health of assigned SecOps platforms including SIEM, EDR, email security and identity protection. Monitor for configuration drift, agent coverage gaps and ingestion failures, resolving them at source. Lead technical onboarding of new log sources, telemetry and integrations ensuring data is usable, normalized and well documented.

Threat hunting and proactive defence
Conduct regular threat hunts based on intelligence, recent incidents and known weaknesses, documenting hypotheses, methodology and findings. Translate hunt findings into durable detections, automation or process changes. Contribute to purple team exercises and adversary emulation with internal and external partners.

Incident response support
Provide deep technical support during significant incidents including forensic data collection, log analysis and containment engineering. Capture lessons learned and translate them into engineering improvements to prevent recurrence.

Continuous improvement
Maintain a backlog of identified weaknesses, ideas and improvements, working with the Senior SecOps Lead to prioritise. Document standards, runbooks and engineering decisions clearly to ensure knowledge is shared. Stay current with the threat landscape, vendor road maps and the broader security engineering community, bringing relevant ideas back into OCS.

Experience
Demonstrable hands-on experience as a security engineer or senior SOC analyst with engineering responsibilities. Strong working knowledge of at least one enterprise SIEM and one EDR or XDR platform, with the ability to write detections, tune content and operate at a deep technical level. Solid scripting ability in Python, PowerShell or KQL, with a working understanding of APIs and integration patterns. Practical understanding of common attack techniques mapped to MITRE ATT&CK and how they manifest in telemetry. Extensive SecOps experience with a multitude of different tools. Relevant industry certifications are required.

About you
A proactive mindset with examples of identifying problems, designing solutions and delivering them end to end. Strong written communication skills including the ability to document detections, runbooks and engineering decisions to a high standard. Organisational and time management skills. Strong interpersonal skills and ability to work under own initiative as well as part of a team. Willingness and ability to undertake national travel as required. Confidence to stand their ground and drive a Security First environment. Ability to learn new tools quickly and effectively.

Qualifications
Relevant industry certifications and extensive SecOps experience are essential. Previous experience as a security engineer or senior SOC analyst with engineering responsibilities is required.