Security Operations Center Analyst

• Investigate and validate security incidents escalated by Level 1 analysts, distinguishing genuine threats from false positives using SentinelOne telemetry and endpoint data
• Assess the severity of incidents by considering asset criticality, user identity and potential business impact, ensuring appropriate prioritisation and timely response
• Conduct detailed forensic investigations to identify attack vectors, root causes and attacker behaviour across endpoint, identity and network data
• Document investigations with clear technical finding, indicators of compromise (IOCs)v and MITRE ATT&CK mappings
• Perform containment and remediation activities, including endpoint isolation, malicious process termination and recovery actions where appropriate
• Work closely with IT teams to coordinate remediation efforts and escalate major incidents to senior incident response teams when required
• Support the continuous improvement of detection capabilities by recommending tuning changes, refining detection rules and reducing false positives
• Collaborate with detection engineering teams to implement new threat intelligence into behavioural detections and custom security rules
• Develop and maintain SOC playbooks, investigation procedures and automated response workflows to improve consistency and reduce response times
• Contribute to internal knowledge sharing by producing documentation and supporting the onboarding of new SOC team members