What youll be doing:
UK Sovereign SOC
Security Analyst (Level 2)
The SOC Analyst (L2) plays a critical role in the detection, investigation, and management of security alerts and incidents escalated from SOC Analyst (L1) teams. The position focuses on indepth analysis, incident validation, tactical response coordination, and continuous improvement of security monitoring and response capabilities.
Operating within a 24/7 Security Operations Centre, the L2 Analyst serves as a technical escalation point for junior analysts, working closely with internal IT and security teams as well as customers to contain and remediate security incidents. The role contributes directly to improving detection quality, response efficiency, and the overall effectiveness of SOC operations.
What You Will Be Responsible For
You will investigate security alerts and events escalated from Level 1 analysts, validating and classifying activity to determine whether it represents a confirmed security incident. This includes performing detailed analysis to understand root cause, scope, impact, and attacker behaviour using SIEM platforms and supporting telemetry.
You will coordinate and support incident response activities in line with defined SOC and customer processes, assisting with containment, eradication, and recovery actions. During highseverity or customerimpacting incidents, you will follow major incident procedures and ensure timely, accurate escalation to stakeholders. You will provide technical guidance to L1 analysts during live incidents and help maintain investigation quality under pressure.
You will execute defined SOAR playbooks as part of incident response and provide structured feedback to improve automation, response consistency, and efficiency. You will maintain awareness of SOC performance metrics and service levels, such as MTTD and MTTR, and actively contribute to improving investigation quality and response outcomes.
You will apply threat intelligence to investigations and alert triage, maintaining awareness of emerging threats, vulnerabilities, and attacker techniques. Incident learnings and threat insights will be fed back into detection logic to continuously enhance SOC monitoring capabilities.
You will also contribute to the development and tuning of SOC detection use cases, ensuring alerting remains relevant, effective, and aligned to current threat activity. This includes supporting onboarding of new services, identifying detection gaps, and recommending improvements to tooling, processes, and coverage.
Clear and accurate documentation is a key part of the role. You will maintain investigation records, runbooks, and playbooks, produce postincident reports for customers and internal stakeholders, and contribute to operational and service reporting. You will help document and implement improvements to event and incident management processes.
Collaboration is essential. You will work closely with IT, security, and technical teams to resolve incidents and reduce risk, act as a mentor and escalation point for L1 analysts, and support continual service improvement by identifying recurring issues and proposing corrective actions.
What Youll Bring
You will have handson experience working with SIEM platforms such as Splunk, Microsoft Sentinel, or QRadar, and a strong understanding of incident response workflows and escalation management. You will be comfortable analysing security telemetry, understanding attacker behaviour, and applying log and artefactbased investigation techniques.
You will demonstrate strong analytical thinking, sound decisionmaking, and the ability to remain effective during highpressure incidents. Clear, professional communicationboth written and verbalis essential, as is the ability to work independently while following and improving structured operational processes.
What experience youll bring:
- 24 years experience in the IT security industry, ideally within a SOC or NOC environment, including experience operating at SOC L1 level
- Relevant cybersecurity certifications desirable (e.g. GIAC, CySA+, SC200)
- Experience working with cloud platforms such as Microsoft Azure and/or AWS
- Proficiency with Microsoft Office tools, particularly Excel and Word
Security & Working Requirements
- Eligibility for, or holding, UK SC Clearance
- Willingness to work within a 24/7 shiftbased SOC environment, including oncall duties.
- Full time in Birmingham, probably 4 days on, 4 days off.
Who we are:
At NTT DATA, you have endless opportunities to think big, act bold and take ownership. As a $30+ billion business and technology services, AI and digital infrastructure leader, we co-innovate solutions with clients and partners globally for business and societal impact. Serving 75% of the Fortune Global 100, with experts in over 70 countries, we encourage experimentation and recognize great work. Proudly a Global Top Employer, NTT DATA is part of NTT Group, which invests over $3 billion annually in R Make this the place where you belong, learn, and build your network. Make this the place whereyougrow.
what well offer you:
We offer a range of tailored benefits that support your physical, emotional, and financial wellbeing. Our Learning and Development team ensure that there are continuous growth and development opportunities for our people. We also offer the opportunity to have flexible work options.
You can find more information about NTT DATA UK & Ireland here: https://uk.nttdata.com/
We are an equal opportunities employer. We believe in the fair treatment of all our employees and commit to promoting equity and diversity in our employment practices. We are also a proud Disability Confident Committed Employer - we arecommitted to creating a diverse and inclusive workforce. We actively collaborate with individuals who have disabilities and long-term health conditions which have an effect on their ability to do normal daily activities, ensuring that barriers are eliminated when it comes to employment opportunities. In line with our commitment, we guarantee an interview to applicants who declare to us, during the application process, that they have a disability and meet the minimum requirements for the role. If you require any reasonable adjustments during the recruitment process, please let us know.Join us in building a truly diverse and empowered team.
Back to search
Email to a friend
Apply now
