SOC Engineer - FTC

Job reference: JEM/44664Sector: Professional ServicesRegion: United Kingdom, LondonSOC Engineer required for global legal firm. You will be responsible for advancing the maturity of the SIEM platform alongside other strategic security solutions, working closely with internal teams to improve the organisation's overall security posture.

This position focuses on onboarding new log sources, optimising data pipelines, developing advanced detection use cases, and strengthening overall security monitoring and response. It's an excellent opportunity for a security professional who enjoys building scalable, high-performing SOC environments and driving continuous improvement.

The RoleThis role also involves contributing to security service improvements and core operational processes, including incident, change, and problem management, as well as supporting the design, implementation, and review of security controls.

There may occasionally be a requirement to support out-of-hours changes or respond to critical security incidents. Key ResponsibilitiesSIEM Engineering & OptimisationEnhance and optimise SIEM performance, coverage, and detection fidelityAssess and improve SIEM architecture, including ingestion pipelines, parsing, and correlation logicImplement automation and orchestration (SOAR) to streamline response activitiesLog Source Onboarding & IntegrationIdentify and onboard new log sources across cloud, network, endpoint, and application environmentsDevelop custom parsers, connectors, and ingestion playbooksCollaborate with internal teams and vendors to ensure reliable, high-quality telemetryDetection EngineeringDesign and implement detection use cases aligned to MITRE ATT&CK and threat intelligenceBuild and tune correlation rules, anomaly detections, dashboards, and alerting workflowsContinuously refine detections to reduce false positives and improve effectivenessSOC & Incident Response SupportPartner with SOC analysts to validate and improve detection logicSupport investigations through advanced SIEM queries and data analysisAct as a subject matter expert on complex security incidentsDocumentation & GovernanceMaintain clear documentation of data models, integrations, and detection logicEnsure alignment with security standards, controls, and compliance requirementsSkills & ExperienceTechnical ExpertiseHands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, Elastic, ArcSight, LogRhythm, or ExabeamStrong understanding of log formats (JSON, syslog, XML, CEF) and ingestion methods (APIs, Kafka, Event Hubs, agents)Experience in detection engineering, threat modelling, and attacker behaviour analysisProven ability to build and tune correlation rules, dashboards, and alertsFamiliarity with SOAR tools and automation workflowsSecurity KnowledgeSolid understanding of networking, Windows/Linux systems, cloud platforms (Azure, AWS, GCP), identity systems, and endpoint security toolsKnowledge of MITRE ATT&CK, cyber kill chain, and threat hunting techniquesRequirementsDegree (Level 4+) in a computing-related subject or equivalent experienceBackground across IT infrastructure and information security rolesRelevant certifications (eg GIAC, SC-200/SC-100, CISSP, SSCP, CSIS)Strong Scripting skills (Python, PowerShell, PowerApps)Excellent communication skills with the ability to engage stakeholders at all levelsProactive, self-driven approach with strong analytical capabilityDesirable ExperienceData Loss Prevention (DLP)Secure remote access solutionsNetwork security technologiesThreat intelligence and open-source security toolsExperience with SaaS, IaaS, PaaS, and DaaS environmentsBusiness continuity and disaster recovery planningKnowledge of data privacy regulations

Report this job