About the role
Hours: Monday to Friday, 9:00am to 5:30pm
On-call: None
If you’re an experienced SOC analyst who enjoys investigating why an alert fired, improving the rule behind it and finding ways to make the next response faster, this role could be a strong next step.
You’ll work with customers to improve how their security teams detect and respond to threats. The work is hands-on: developing detection rules, identifying gaps in logging and coverage, and building automations and playbooks that analysts can use in live operations. You’ll also lead technical discussions with customers and explain your recommendations clearly.
What you’ll do
Build, test and tune detections across SIEM and XDR tools.
Write queries, particularly in KQL, to identify suspicious activity and reduce unnecessary alerts.
Map detection use cases to MITRE ATT&CK and assess whether the right log sources are available.
Create SOAR workflows and incident response playbooks that support SOC teams.
Use scripting and APIs to improve enrichment, investigation and response.
Run customer workshops and document detection coverage, gaps and recommended improvements.
Help develop reusable detection content and a consistent approach to testing and version control.
What you’ll bring
Strong SOC experience with hands-on responsibility for creating or improving detections, beyond alert monitoring and triage.
Practical SIEM experience; Microsoft Sentinel would be particularly useful.
Confidence writing KQL or another security query language.
Experience building automations or playbooks using Logic Apps, Cortex XSOAR or a comparable tool.
Scripting skills in Python, PowerShell or similar, including API integrations.
A sound understanding of attacker behaviour, log sources and MITRE ATT&CK.
The ability to discuss technical findings and recommendations directly with customers.
Experience with Microsoft Defender, CrowdStrike, Cortex, Azure security telemetry or detection as code would be useful, but you do not need to have worked with every platform listed.
This is a senior, customer-facing position for someone who wants to spend more time improving detection and response capability. You’ll work across different environments and have scope to influence how detections, automations and playbooks are designed and delivered.
NRG is committed to equal opportunities and an inclusive recruitment process. We welcome applications from people of all backgrounds and do not tolerate discrimination based on protected characteristics. We aim to remove barriers, treat applicants fairly and make reasonable adjustments where needed.