Principal SOC Analyst

Join our team as a Principal SOC Analyst, where you will act as a Level 3 escalation point within the MDR/SOC function. You will provide advanced technical support to Level 2 analysts during complex or high-severity investigations, and contribute to the continuous improvement of the MDR service. This role requires strong hands-on experience in security operations, incident response, threat analysis, and detection tuning. You will also support the development of Operational Technology (OT) security monitoring and incident response capabilities.

• Act as a Level 3 escalation point for advanced security investigations, providing technical guidance and direction to Level 2 analysts.
• Lead advanced incident investigations, including scoping, containment, eradication, and remediation recommendations, while performing in-depth analysis of security events.
• Contribute to the continuous improvement of the MDR service by supporting the definition of security monitoring strategies, improving detection logic, and tuning security technologies.

• Ability to analyse endpoint, network, identity, cloud and application telemetry in support of complex investigations
• Experience with OT security platforms or NDR (e.g. Armis, Nozomi, Clarity, Dragos, Darktrace) is a plus
• Understanding of IT/OT convergence challenges and network segmentation practices (e.g. IEC 62443)
• Experience with cloud security monitoring across Microsoft Azure, AWS or Google Cloud is beneficial
• Experience supporting industrial or critical infrastructure environments is a plus
• Strong experience with security event triage, correlation, investigation and escalation
• Minimum 2–3 years of experience in a SOC, MDR, incident response, CSIRT or cyber security operations role
• Experience supporting customer-facing technical discussions, including investigation reviews, tuning recommendations and posture improvement activities
• Working knowledge of SIEM, EDR, SOAR, NIDS, DLP and threat intelligence platforms
• Knowledge of OT threat landscape and frameworks (e.g. MITRE ATT&CK for ICS)
• Ability to produce clear technical documentation, investigation reports and customer-facing recommendations
• Strong understanding of incident response lifecycle, including preparation, identification, containment, eradication, recovery and lessons learned
• Strong understanding of attacker tactics, techniques and procedures, including MITRE ATT&CK
• Experience supporting customers or internal stakeholders with security optimization, detection tuning and cyber security posture improvement
• Understanding of OT / ICS environments (SCADA, DCS, PLCs, HMIs, industrial networks)
• Ability to perform host-based and network-based threat analysis
• Deep operational knowledge of SIEM, EDR, Network Intrusion Detection Systems, SOAR, DLP and related security monitoring technologies
• Strong understanding of enterprise network architecture, TCP/IP, firewalls, proxies, VPNs, DNS, email security and cloud environments
• Experience analysing packet captures, endpoint artefacts, logs, scripts, documents and potentially malicious files
• Experience with Microsoft Sentinel, Microsoft Defender, Splunk, QRadar, CrowdStrike, SentinelOne, Palo Alto, Suricata, Zeek, Snort or similar technologies is highly beneficial
• Strong hands-on experience in Security Operations Centre or MDR environments
• Experience with threat hunting, detection engineering or purple team activities is beneficial
• Ability to manage multiple complex incidents and make effective decisions under pressure
• Experience working with threat hunting methodologies and security detection frameworks
• Strong written and verbal communication skills, with the ability to explain technical findings to both technical and non-technical stakeholders
• Proven experience handling complex security incidents and supporting advanced investigations
• Experience with SIEM query languages and detection logic, such as KQL, SPL, Sigma or equivalent
• Familiarity with industrial protocols (e.g. Modbus, OPC, IEC 104, DNP3) is beneficial
• Understanding of security protocols, encryption technologies and common authentication mechanisms
• Experience tuning security controls and detection content to improve alert fidelity and reduce false positives
• Security industry certifications such as GCIH, GCFA, GCIA, GNFA, GCTI, GSEC, CISSP, CySA+, SC-200, AZ-500 or equivalent are highly beneficial
• OT-related certifications or training (e.g. GICSP, GRID, IEC 62443) are advantageous