NCC Group

Global cyber security and resilience provider

SOC Lead

Security Operations & Incident ResponseUpdated on Nov 13

Full-timeLondon, UKNo salary listedHybrid

About the Job

Requirements

Extensive experience working in a Security Operations Centre, Cyber Security, or Incident Response role.
Strong hands-on experience with Splunk Enterprise Security.
Experience leading security investigations and major incident response activities.
Knowledge of MITRE ATT&CK, SIEM technologies, threat intelligence, and security best practices.

Responsibilities

Lead day-to-day SOC operations and provide technical guidance to SOC Analysts.
Monitor, investigate, and respond to security incidents and alerts.
Develop, optimise, and maintain Splunk Enterprise Security use cases, correlation searches, dashboards, and reports.
Conduct threat hunting and advanced forensic investigations.
Coordinate incident response activities and provide detailed post-incident analysis.
Collaborate with IT, security, and business stakeholders to improve security posture.
Support SOC processes, playbooks, and continuous improvement initiatives.

Desired Qualifications

Relevant certifications such as Splunk Certified Cybersecurity Defence Analyst, CISSP, GCIA, GCIH, or equivalent.

We are seeking an experienced Lead SOC Analyst to oversee Security Operations Centre (SOC) activities, lead incident response efforts, and mentor a team of analysts. The successful candidate will have strong expertise in cyber threat detection, incident investigation, and the Splunk Enterprise Security (ES) platform.

Lead day-to-day SOC operations and provide technical guidance to SOC Analysts.
Monitor, investigate, and respond to security incidents and alerts.
Develop, optimise, and maintain Splunk Enterprise Security use cases, correlation searches, dashboards, and reports.
Conduct threat hunting and advanced forensic investigations.
Coordinate incident response activities and provide detailed post-incident analysis.
Collaborate with IT, security, and business stakeholders to improve security posture.
Support SOC processes, playbooks, and continuous improvement initiatives.

Extensive experience working in a SOC, Cyber Security, or Incident Response role.
Strong hands-on experience with Splunk Enterprise Security.
Experience leading security investigations and major incident response activities.
Knowledge of MITRE ATT&CK, SIEM technologies, threat intelligence, and security best practices.
Relevant certifications such as Splunk Certified Cybersecurity Defence Analyst, CISSP, GCIA, GCIH, or equivalent are desirable.

About the Company

NCC Group

Global cyber security and resilience provider

NCC Group provides cyber security and resilience services to organizations and governments around the world. It helps protect digital systems by offering a range of capabilities such as security testing, risk assessment, and resilience planning, backed by a global team of experts and supported by technology-enabled tools. The company’s approach combines human expertise with technical solutions to identify vulnerabilities, assess risk, and implement concrete steps to improve security and continuity. What sets NCC Group apart is its large, worldwide team and its emphasis on practical, end-to-end cyber resilience—working with clients from assessment through to implementation and ongoing assurance. The goal is to create a more secure digital future by helping customers manage cyber risk, reduce threats, and maintain business continuity at scale.

Company size: 1,001-5,000
Company stage: IPO
Headquarters: Manchester, United Kingdom
Founded: 1999

Recently Posted Jobs

Explore more opportunities at NCC Group

See more jobs