Reading (GB)
IT
Fulltime
Published: 2026-07-22
What do we do?
Introducing Thinkproject Platform
Pioneering a new era and offering a cohesive alternative to the fragmented landscape of construction software, Thinkproject seamlessly integrates the most extensive portfolio of mature solutions with an innovative platform, providing unparalleled features, integrations, user experiences, and synergies.
By combining information management expertise and in-depth knowledge of the building, infrastructure, and energy industries, Thinkproject empowers customers to efficiently deliver, operate, regenerate, and dispose of their built assets across their entire lifecycle through a Connected Data Ecosystem.
What your day will look like
We are looking for a highly experienced and technically skilled Lead Security Operations Centre (SOC) Analyst to join our team and take ownership of the day to day operation and continuous improvement of our Security Operations Centre. This role combines deep technical expertise with operational leadership, people management, and project delivery responsibilities, ensuring the SOC remains effective in identifying, investigating, and responding to advanced security threats, issues, and vulnerabilities across the organisation.
As the lead member of the team, you will oversee SOC operations, manage and coordinate complex security investigations, and provide technical leadership during all incidents. You will lead investigations into sophisticated threats such as advanced persistent threats (APTs), malware outbreaks, and targeted attacks, whilst performing hands on analysis of security events, forensic evidence collection, and root cause analysis. You will also drive the development and enhancement of detection capabilities across SIEM, EDR, and other monitoring technologies, while continuously improving SOC processes, procedures, workflows, automation, and playbooks to increase operational effectiveness and maturity.
You will actively engage in threat hunting, leveraging your deep understanding of application code, infrastructure and hosting architectures (cloud and on premises), the software development lifecycle (SDLC), and CI/CD pipeline solutions to identify risks that span traditional and cloud native environments.
You will collaborate closely with Security Engineering, IT, DevOps, and application teams to improve detection coverage, enhance monitoring capabilities, and strengthen the organisation's overall security posture. Alongside your technical responsibilities, you will provide line management for SOC analysts, including mentoring, coaching, performance management, and professional development, whilst overseeing workload prioritisation, SOC reporting, and the successful delivery of projects associated with SOC tooling, automation, compliance, and operational maturity.
This role encompasses reactive incident response, proactive detection engineering, threat hunting, vulnerability management, and operational leadership. You will also contribute to strategic initiatives including penetration testing coordination, security assessments, audit preparation, threat intelligence activities, and the maintenance of SOC documentation and reporting.
This role sits within the Product Operations and Corporate IT branch, reporting to the Director of Cyber Security and Networking, and operates as part of the broader Cyber Security, Network, and Security Engineering teams.
Main responsibilities:
Independently investigate and respond to security alerts and events from SIEM, EDR, and other security tools across endpoints, networks, cloud platforms, and applications.
Lead proactive threat hunting activities, leveraging threat intelligence, application logs, and infrastructure telemetry to uncover indicators of compromise or stealthy threat activity.
Perform in-depth analysis of logs, API configurations and traffic, container environments, network data, application and infrastructure architecture, as well as data center hosting environments to support threat detection, incident investigation, and root cause analysis.
Manage complex cybersecurity incidents end-to-end, including containment, eradication, recovery, and post-incident analysis, while coordinating closely with cross-functional stakeholders.
Deploy, operate, configure, and tune SIEM platforms and detection tools to enhance signal accuracy, reduce alert fatigue, and maintain effective detection coverage.
Design, build, and maintain incident response playbooks and automation workflows to increase the efficiency, speed, and consistency of incident response processes.
Simultaneously manage multiple active investigations and day-to-day SOC operations, effectively prioritising tasks and managing time under pressure.
Conduct forensic analysis during investigations, including evidence preservation, malware analysis, memory examination, and root cause identification.
Collaborate with DevOps, IT, and development teams to ensure timely containment, mitigation, and remediation of vulnerabilities and threats.
Coordinate outputs from security assessment tools and penetration tests, ensuring clear ownership and timely closure of identified issues.
Participate in and lead security testing exercises to evaluate and strengthen detection capabilities and response procedures.
Drive continuous improvement of SOC operations by identifying logging gaps, proposing monitoring enhancements, and introducing new detection or response technologies.
Maintain comprehensive documentation of investigations, incidents, tuning efforts, and threat intelligence to support reporting, knowledge sharing, and audit readiness.
Stay current with evolving threat landscapes, adversary techniques, and emerging security tools and practices to strengthen SOC capabilities.
Adapt SOC processes, solutions, and procedures to enhance the monitoring of the organization's IT network health.
Ensure security operations and incident response practices are aligned with industry-recognized frameworks such as ISO 27001.
Implement solutions within CI/CD pipelines to identify and block security issues reaching production environments
Support the development and refinement of SOC procedures, training materials, and operational standards to enhance maturity and consistency across the team.
Act as the operational lead for the SOC, overseeing day-to-day activities, workload prioritisation, incident coordination, and service delivery to ensure effective security monitoring and response capabilities.
Provide line management, coaching, mentoring, and professional development support to SOC analysts, fostering a high-performing and collaborative security operations culture.
What you need to fulfill the role
You Must Have:
Language & Communication
Proficiency in spoken and written English, with the ability to communicate effectively across both technical and non-technical audiences
The ability to communicate difficult or sensitive information tactfully
Education & Experience:
Bachelor’s degree in cyber security or a related field, or equivalent professional experience
Strong knowledge of cybersecurity principles, threat landscapes, and incident response procedures
Awareness of current and emerging cyber threats affecting SaaS organisations
Technical Skills:
Hands-on experience with implementation, ongoing management and maturing of Security Information and Event Management (SIEM) tools, Endpoint Detection and Response (EDR) platforms, threat intelligence platforms, and vulnerability identification tools
Experience integrating custom-built applications into SIEM platforms
Experience with implementation of automation solutions, enhancing SOC efficiency and speeding incident response
Familiarity with Security Orchestration, Automation, and Response (SOAR) platforms, including developing and maintaining automated response playbooks
Experience with threat hunting focused on application code, application, infrastructure and hosting architecture, leveraging coding skills and a solid understanding of the software development lifecycle (SDLC) and infrastructure components
Experience managing security issues identified through internal tools and external assessments, ensuring remediation is completed in line with company policies and standards
Knowledge of common security frameworks and best practices
Experience implementing solutions to detect and block security risks in CI/CD pipelines to prevent vulnerable code from being deployed into production
SOC Operations:
Experience in complex incident response and investigation, including forensic evidence handling and root cause analysis
Experience managing business-as-usual (BAU) security operations workload alongside project-based work, both independently and in coordination with other team members
Experience managing outputs from cybersecurity assessment tools, coordinating timely mitigation and remediation with key stakeholders.
Experience coordinating outsourced penetration tests, ensuring smooth execution without service disruption
Experience conducting security assessment exercises to evaluate SOC operational effectiveness and the organization’s ability to respond to cybersecurity incidents
Experience in tuning detection rules and alerts to improve accuracy and reduce false positives in security monitoring
Technical Expertise:
Experience with Azure, Azure AD, and AWS technologies and services
Experience conducting forensic analysis of cybersecurity incidents
Teamwork & Leadership:
A positive, self-motivated attitude
The ability to work effectively in a team environment, collaborating with cross-functional teams to achieve shared objectives
Strong time management and prioritization skills, with the ability to manage your own workload
The ability to perform effectively under pressure, priorities tasks, and make sound decisions in high-stress or emergency situations
A proactive mindset with the ability to critically evaluate your own work, identify improvement opportunities, and automate, simplify, or standardize processes where appropriate.
Experience mentoring, coaching, or providing technical leadership to junior team members
Experience coordinating and prioritising team activities within a security operations environment
It Would Be Good to Have:
Language Skills:
Proficiency in German (spoken and written)
SOC Operations
Experience conducting red or purple team exercises to validate detection capabilities and improve response playbooks
Familiarity with security operations in containerized environments and microservices architectures (e.g., Kubernetes, Docker)
Technical Skills:
Understanding of advanced detection engineering techniques, such as creating custom correlation rules and behavioral analytics in SIEM platforms
Exposure to secure software development practices and security testing of APIs, containers, and cloud-native applications
Experience conducting both external and internal penetration testing of applications and infrastructure.
Technical Expertise:
Experience with Microsoft Sentinel SIEM Solutions
Experience working within a SaaS or software-driven organization, particularly in multi-tenant or cloud-native environments.
Experience with AI technologies, including understanding the cybersecurity threats they pose to organizations and how they can be leveraged to enhance operational effectiveness.
What we offer
Hybrid working | Work from abroad | Flexible working hours | Thinkproject Academy | Free English lessons | Unlimited learning | Headspace community access | Women's Network | Corporate volunteering | Social events
We are a passionate bunch here. To join Thinkproject is to shape what our company becomes. We take feedback from our staff very seriously and give them the tools they need to help us create our fantastic culture of mutual respect. We believe that investing in our staff is crucial to the success of our business.
Your contact: Mehal Mehta
Please submit your application, including salary expectations and potential date of entry
Working at thinkproject.com - think career. think ahead.
#LI-MM1
#LI-Hybrid
#content_zone { max-width: 834px; } #scheme_detail_data { width: 100%; display: table; margin-bottom: 10px; } .scheme-border { border: 1px solid rgba(220,223,226,0.8); } .scheme-margin { margin-top: 10px; } .scheme-display .scheme-content { font-size: 16px; padding: 14px 24px; background-color: #ffffff; line-height: 1.6; } .scheme-display .scheme-title { word-break: break-word; } .scheme-display .scheme-title h2 { margin: 0px; font-size: 28px; line-height: 2; padding: 0px; } .scheme-display .scheme-title ul { margin-bottom: 16px; } .scheme-display .video { width: 100%; height: 400px; } .scheme-display h2.scheme-headline { margin: 0px 0px 18px 0px; padding: 0px; } .scheme-display .content-images { position: relative; overflow: hidden; display: block; box-sizing: border-box; padding: 0px; } .scheme-display .content-images: not(: has(.content-images-frame)) { height: 335px; } #header_image { display: none; } #jobTplContainer ul.scheme-additional-data { margin-bottom: 0px; min-width: 40%; } .scheme-additional-data { float: left; margin: 0; padding: 0; list-style: none; } .scheme-additional-data li { list-style: none; margin: 4px 15px 0px -3px !important; } .scheme-additional-data li.left { float: left; } .scheme-display .slide-images: nth-child(2), .scheme-display .slide-images: nth-child(3) { display: none; } .scheme-display .slide-images { width: 100%; position: absolute; top: 50%; left: 50%; -webkit-transform: translate(-50%,-50%); -ms-transform: translate(-50%,-50%); } .scheme-display .content-images-frame { position: relative; width: 100%; height: 335px; overflow: hidden; } .scheme-display .content-images-description { display: block; text-align: left; font-size: 1rem; line-height: 1.4; color: #000; padding: 8px 24px; border-bottom: 1px solid rgba(220,223,226,0.8); } .scheme-content .user-image { width: 100px; height: 100px; border-radius: 50%; float: left; line-height: 100px; background: no-repeat center center; background-size: cover; } .scheme-content .user-data { height: 100px; margin-left: 80px; } .scheme-content .user-data li { list-style: none; } i.fa-fw { margin-right: 5px; margin-left: 5px; } @media (max-width: 768px) { .scheme-additional-data li { display: block; float: none; } .scheme-display .content-images { height: 250px; } } @media (max-width: 650px) { .scheme-display .content-images { height: 250px; } } @media (max-width: 450px) { .scheme-display .content-images { height: 133px; } } #frame_zone { background-color: #ffffff; }
