About the job
Phoenix Software is at the forefront of facilitating digital transformation across UK organizations. We empower businesses to innovate through cloud and hybrid infrastructures, leveraging data, AI, security measures, and collaboration tools.
We are seeking a Senior SOC Analyst to spearhead complex incident response efforts. In this pivotal role, you will guide clients through severe security incidents while enhancing our Security Operations Center's (SOC) overall capabilities.
Key Responsibilities
- Incident Response & Forensics:
Lead significant security incidents from detection to remediation, coordinating containment efforts, analyzing attacker behavior, and aiding clients during crucial decision-making processes. - Threat Hunting & Detection Engineering:
Proactively identify threats using advanced KQL analytics, improve SIEM/EDR detections, fine-tune rules, and create signatures in alignment with MITRE ATT&CK. - Malware Analysis & Reverse Engineering:
Conduct malware triage and behavioral analysis, utilizing reverse-engineering tools as necessary to support investigations and enhance detection capabilities. - Reporting & Client Communication:
Generate clear, high-quality investigation reports, timelines, and intelligence summaries that effectively communicate technical findings to diverse audiences. - SOC Leadership & Continuous Improvement:
Contribute to SOC playbooks, mentor junior analysts, assist in onboarding new clients, and help refine SOC processes and tools. - On-call Support:
Participate in the 24/7 on-call rotation to provide expert guidance during critical incidents.
What We Are Looking For
- Robust experience in DFIR, SOC operations, or incident response.
- Proven ability to lead complex investigations and manage high-severity security incidents.
- Confident decision-maker capable of guiding clients through critical situations.
- Strong communicator who can convey technical information to various audiences.
- Collaborative approach, eager to work closely with cross-functional teams.
- Experience mentoring junior analysts and aiding in skill development.
- Comfortable in fast-paced, high-pressure environments.
- Proactive mindset focused on enhancing SOC processes, playbooks, and detection capabilities.
Key Skills
- Expertise in SIEM solutions, particularly Microsoft Sentinel & Defender XDR.
- Extensive experience in DFIR/SOC/incident response.
- Advanced proficiency in KQL.
- Familiarity with Python/PowerShell for automation purposes.
- Core competencies in digital forensics.
- Experience with tools like Velociraptor, KAPE, and sandbox environments.
- Solid understanding of detection engineering.