SOC / Cyber Threat Detection Analyst - SANS/GIACCyber Threat Detection AnalystLocation: Wokingham, Berkshire (On-site) Salary: Competitive (dependent on experience) + excellent benefits & training Security Clearance: Ideally SC Cleared or eligible for SCRole OverviewAs a Cyber Threat Detection Analyst, you will play a hands-on role within an advanced cyber defence function, focused on proactive threat hunting, adversary behaviour analysis, and high-fidelity threat detection across enterprise environments.This role goes beyond reactive alert handling. You will actively hunt for malicious activity using telemetry, SIEM data, and threat intelligence, develop hypotheses based on MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs), and support incident management and response activities when threats are identified.We are open to experienced SOC Analysts where threat hunting, investigations, and proactive detection have formed a significant part of their role, and who are looking to further develop in a more hunting-led environment.This position is well suited to analysts who enjoy thinking like an attacker, have worked alongside or supported red team or purple team activities, and want to deepen their expertise in threat detection and detection engineering.Skills & Experience We're SeekingExperience in threat hunting, cyber threat detection, SOC, blue team, or cyber defence environments, with ideally around five years hands on experience.Strong hands-on experience using SIEM platforms, including:Microsoft Sentinel (KQL)Splunk (SPL)Elastic Security/Kibana (KQL, ESQL)Practical and operational understanding of MITRE ATT&CK, attacker techniques, and adversary tradecraftExperience working with Indicators of Compromise (IOCs) and threat intelligence feedsSolid experience across the security event life cycle, including detection, investigation, and incident managementHands-on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or Carbon BlackStrong knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, Firewalls, VPNs, Proxy technologies)Experience analysing telemetry from Windows, Linux, identity, endpoint, and network sourcesStrong analytical mindset with the ability to clearly communicate findings, impact, and riskKey ResponsibilitiesConduct proactive threat hunting activities across log, endpoint, and network telemetry to identify suspicious, stealthy, or previously unknown threatsDevelop and execute hunt hypotheses aligned to MITRE ATT&CK TTPs, adversary behaviours, and emerging threat intelligenceWrite, refine, and optimise SIEM queries using KQL, SPL, Elastic/ESQL, and Kibana Query LanguagePerform IOC analysis, enrichment, and validation, integrating internal and external threat intelligence sourcesLead investigations from initial detection through scoping, root cause analysis, and impact assessmentSupport incident management and incident response activities, including containment, remediation, escalation, and lessons learnedCollaborate closely with SOC teams, incident responders, red teams, and purple teams to validate detections and improve defensive coverageContribute to detection logic improvements, use-case development, and continuous enhancement of hunting methodologiesProduce clear investigation write-ups, timelines, and recommendations for technical and non-technical stakeholdersSecurity Certifications (Highly Beneficial)SANS/GIAC certifications, including but not limited to:GCIH - Incident HandlerGCIA - Intrusion AnalystGCED - Enterprise DefenderGCTI - Cyber Threat IntelligenceGMON - Continuous MonitoringGDAT - Defending Advanced ThreatsGCAT - Advanced Threat IntelligenceOSCP or equivalent offensive security qualificationsCrest certifications, such as:Crest Practitioner Intrusion Analyst (CPIA)Crest Registered Intrusion Analyst (CRIA)Crest Certified Threat Intelligence Analyst (CCTIA)Crest Certified Blue Team Professional (CCBTP)Microsoft SC-200 or related detection and response certificationsOther recognised cyber security or threat intelligence credentials