The L3 SOC Analyst leads complex incident investigations, drives automation, mentors junior analysts, and enhances SOC capabilities using advanced security technologies.
Location: United Kingdom
Type: Full-time, permanent
Due to the nature of the UK Government projects this role supports, this position is classified as a Reserved Post. In accordance with the Civil Service Nationality Rules, paragraph 1 of Schedule 23 and paragraph 5 of Schedule 22 of the Equality Act 2010, we can only accept applications from persons with UK residency (at least five years).
Successful candidates must undergo National Security Vetting (NSV). This role requires Security Check SC level clearance as a minimum. Any offer of employment is strictly conditional upon the candidate successfully obtaining and maintaining this clearance.
To meet the vetting criteria, you will be required to have been resident in the UK for a minimum of 5 years immediately prior to your application. Failure to obtain clearance or a lapse in residency history may result in the withdrawal of the employment offer, and you will not be entitled to any compensation from Saviynt as a result.
In line with the Immigration, Asylum and Nationality Act 2006, all shortlisted candidates will be required to provide original documentation verifying their Right to Work in the UK and their British Citizenship during the initial interview stage. We conduct thorough Baseline Personnel Security Standard (BPSS) checks as a precursor to all higher-level clearances.
Role Overview:
We are establishing a modern Security Operations Centre designed to deliver proactive, intelligence-driven security outcomes. Moving beyond traditional reactive monitoring, our SOC emphasises AI, automation, detection engineering, and deep cloud security visibility to identify and neutralise sophisticated threats at scale.
The L3 SOC Analyst will act as the senior technical escalation point within the SOC, leading complex investigations, driving automation initiatives, and mentoring junior analysts. This role requires strong hands-on expertise across cloud security, threat hunting, incident response, and orchestration technologies.
WHAT YOU WILL DO:
- Incident Response & Technical Escalation
- Act as the final escalation point for complex incidents originating from L1/L2 analysis.
- Lead investigations into high-severity security events, including those impacting AWS, Azure, Kubernetes clusters and hybrid environments.
- Perform advanced forensic analysis across endpoints, cloud workloads, and network telemetry to determine root cause, impact, and remediation actions.
- Correlate telemetry from SIEM, EDR, CSPM, and cloud-native sources to identify sophisticated attack chains.
- Security Automation & SOAR Engineering
- Design, develop, and maintain automated response playbooks within the SOAR platform to improve response efficiency.
- Build and maintain automation scripts (Python, go, etc.) for alert enrichment, evidence collection, and containment.
- Integrate security platforms via APIs to enable streamlined, automated detection and response workflows.
- Identify opportunities to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) through automation and process optimisation.
- Threat Hunting & Detection Engineering
- Conduct proactive threat hunting across enterprise and cloud environments using intelligence-driven and hypothesis-based methodologies.
- Serve as an SME for cloud security monitoring leveraging tools such as AWS GuardDuty, CloudTrail, CrowdStrike, and Proofpoint.
- Develop and tune SIEM detections, correlation rules, and EDR queries aligned to MITRE ATT&CK tactics and emerging threat intelligence.
- Mentorship & Continuous Improvement
- Provide technical mentoring and guidance to L1/L2 analysts to strengthen SOC capability.
- Maintain and enhance SOC documentation including SOPs, runbooks, and response playbooks.
- Analyse incident trends and operational metrics to recommend improvements in detection coverage, automation effectiveness, and security posture.
WHAT YOU BRING:
- Bachelor’s degree in Computer Science, Cybersecurity, or related discipline (or equivalent industry experience).
- Extensive experience in Security Operations with demonstrable time in a senior analyst, threat hunter, or L3 role.
- Strong hands-on experience in cloud security monitoring and incident response across AWS, Azure, or GCP.
- Proven scripting and automation capability using Python, Go, PowerShell,Bash,etc.
- Practical experience with SOAR platforms (e.g., CrowdStrike Fusion SOAR) and SIEM technologies (e.g., CrowdStrike Falcon, Splunk, QRadar, Microsoft Sentinel).
- Deep understanding of EDR tooling, host/network forensics, and detection engineering practices.
- Strong working knowledge of the MITRE ATT&CK framework and its application in threat detection and hunting.
Top Skills
AWS
Azure
Bash
Crowdstrike Falcon
Crowdstrike Fusion Soar
GCP
Go
Microsoft Sentinel
Mitre Att&Ck
Powershell
Python
Qradar
Splunk
Similar Jobs
Big Data • Fintech • Information Technology • Business Intelligence • Financial Services • Cybersecurity • Big Data Analytics
The General Insurance Account Director will drive GTM activity, develop account strategies, manage client relationships, and sell complex insurance solutions.
Top Skills:
CxDigital TransformationFraud PreventionGtm ActivityMeddiccRegulatory ComplianceUnderwriting Optimisation
Cloud • Computer Vision • Information Technology • Sales • Security • Cybersecurity
Responsible for driving sales of NG SIEM and log management solutions. Develop account strategies, close deals, and establish relationships with key decision-makers. Collaborate with cross-functional teams to maximize market presence.
Top Skills:
CybersecurityData AnalyticsData ManagementLog ManagementObservabilitySalesforceSIEM
Cloud • Computer Vision • Information Technology • Sales • Security • Cybersecurity
The Customer Value Architect drives customer onboarding and adoption of Falcon Flex, ensuring value realization and minimizing churn. They analyze business value, conduct executive reviews, and support account growth through strategic planning and customer relationship management.
Top Skills:
CybersecurityFalcon FlexSecurity Software Solutions
What you need to know about the London Tech Scene
London isn't just a hub for established businesses; it's also a nursery for innovation. Boasting one of the most recognized fintech ecosystems in Europe, attracting billions in investments each year, London's success has made it a go-to destination for startups looking to make their mark. Top U.K. companies like Hoptin, Moneybox and Marshmallow have already made the city their base — yet fintech is just the beginning. From healthtech to renewable energy to cybersecurity and beyond, the city's startups are breaking new ground across a range of industries.
