Location:On-site Hertfordshire Area
Clearance: Must hold or be eligible for DV Clearance
Schedule: 2 days, 2 nights, 4 off (12-hour shifts)
We are seeking a Team Leader to join our Security Operations Centre (SOC) based on-site in Hertfordshire. You'll be responsible for leading a team of analysts on a shift pattern, providing tactical leadership, ensuring high-quality triage and analysis, and contributing to continuous improvement of detection and response operations.
This is a fantastic opportunity to play a key role in securing critical national infrastructure while developing your career within a high-assurance environment.
Key Responsibilities
- Lead a shift team of SOC Analysts, providing guidance, mentoring, and support on a 24/7 operational rota.
- Oversee real-time monitoring, triage, investigation, and escalation of security alerts.
- Act as point of escalation for high-priority incidents and ensure correct response procedures are followed.
- Drive improvements in detection rules, response procedures, and knowledge-sharing using frameworks like MITRE ATT&CK.
- Ensure accurate documentation of incidents and shift handover notes.
- Represent the SOC in stakeholder meetings as required, delivering briefings and updates.
- Maintain high situational awareness of threat landscape relevant to client environment.
- Support onboarding and continuous training of new analysts.
- Foster a positive, performance-driven team culture in a high-tempo environment.
- Proven experience working in a SOC, including shift-based or high-tempo environments.
- Strong familiarity with SIEM technologies (especially Microsoft Sentinel and Splunk).
- Confident understanding of networking fundamentals (TCP/IP, DNS, firewalls, proxies, VPNs).
- Exposure to MITRE ATT&CK and threat-informed detection engineering.
- Experience leading or mentoring junior analysts in a technical security environment.
- Strong decision-making and incident management capabilities.
- Clear and concise written and verbal communication skills.
Desirable Qualifications
- Experience working within the defence or critical national infrastructure space.
- Exposure to threat intelligence and/or static malware analysis.
- Familiarity with scripting languages (Python, PowerShell, Bash, etc.).
Note: Candidates must be eligible for DV (Developed Vetting) security clearance, which typically requires sole UK nationality and long-term UK residency.
