Senior SOC Analyst – Threat Hunting & Detection Engineering

Contract: 6 Months
Location: UK (Hybrid)
Day Rate: Competitive
Sector: Life & Pensions / Financial Services

Overview

We are seeking an experienced SOC / Senior SOC Analyst to join a leading Life & Pensions organisation, supporting the continued maturity of its Cyber Security Operations capability. This role is focused on proactive threat detection, threat hunting, incident investigation, and detection engineering within a Microsoft security technology stack.

The successful candidate will operate beyond traditional alert monitoring, taking ownership of identifying emerging threats, enhancing security monitoring capabilities, and improving the effectiveness of security controls across the organisation. Working closely with Security Operations, Infrastructure, Cloud, Compliance, and Risk teams, you will play a key role in strengthening cyber resilience within a highly regulated financial services environment.

Key Responsibilities

• Conduct proactive threat hunting activities using intelligence-led and hypothesis-driven methodologies across cloud, endpoint, identity and infrastructure environments.
• Design, develop and optimise detection use cases, analytics rules and alerting mechanisms within Microsoft Sentinel.
• Investigate and triage complex security incidents, providing senior-level analysis, containment recommendations and remediation guidance.
• Act as an escalation point for security events and incidents identified by SOC analysts and automated tooling.
• Develop and maintain detection engineering standards to improve visibility and reduce false positives.
• Build, refine and optimise KQL queries, workbooks, dashboards and analytics rules within Microsoft Sentinel.
• Enhance monitoring coverage across Microsoft Defender technologies including Defender for Endpoint, Defender for Identity and Defender for Cloud.
• Leverage threat intelligence feeds, MITRE ATT&CK techniques and industry threat trends to improve detection capabilities.
• Support incident response activities and post-incident reviews, identifying opportunities for control and process improvements.
• Contribute to security automation initiatives through SOAR playbooks, scripting and workflow optimisation.
• Produce high-quality investigation reports, detection documentation, playbooks and operational procedures.
• Mentor junior analysts and support the ongoing development of SOC capabilities and best practices.
• Collaborate with infrastructure, cloud, architecture, governance and risk teams to ensure findings are remediated effectively.
• Support security and regulatory initiatives across FCA, PRA and broader financial services control frameworks.