Security Operations Centre (SOC) Engineer

What success looks like

• Security alerts are monitored, assessed and responded to appropriately.
• Security incidents are accurately identified, documented and escalated.
• 24/7 clients receive consistent and professional after-hours support.
• Tickets and incidents have clear ownership and progression.
• Escalations contain sufficient technical context to enable efficient resolution.
• Security trends, recurring issues and risks are identified and reported.

Core accountabilities: Security Monitoring & Incident Detection

• Continuously monitor security tools and alerting platforms.
• Review security alerts and determine appropriate action.
• Identify suspicious activity and potential threats.
• Escalate security concerns according to defined processes

Security incident triage and response

• Assess and validate security incidents.
• Perform initial investigation and impact assessment.
• Support containment activities within agreed processes.
• Maintain accurate incident records and investigation notes.
• Escalate incidents requiring additional expertise or authority.

After-hours 1st line service desk coverage

• Provide first-line support for contracted 24/7 clients outside standard business hours. • Answer, log and categorise incoming requests. • Perform basic troubleshooting and resolution within agreed capability. • Progress tickets appropriately and maintain ownership. Escalate technical issues to senior engineers where required

Escalation and handover management

• Follow defined escalation routes for technical and security issues.
• Ensure escalations contain accurate information, troubleshooting completed and relevant context.
• Engage senior engineers and management when required based on impact or complexity.
• Support smooth handover between teams.

Security and incident reporting

• Maintain accurate security and service documentation.
• Track security incidents, trends, and recurring issues.
• Contribute to incident reporting and service improvement activities.
• Identify opportunities to improve monitoring, processes and knowledge sharing.

Key Performance Indicators (KPIs): Security and service performance:

• Security alerts and tickets responded to within agreed SLA • After-hours client support delivered within agreed SLA • Security incidents progressed within expected timescales Ownership and quality:

• 100% of tickets/incidents have clear ownership and next action
• Ticket and incident notes meet quality st

.special-hidden { display: none; }