Salary: £18,000 - 21,000 per year Requirements: 7 years in Security Operations, Threat Hunting, or Incident Response Proven experience leading investigations involving advanced persistent threats, insider threats, or targeted attacks Strong hands-on expertise with SIEM platforms (e.g. Sentinel, Splunk, Elastic) Experience with EDR/XDR solutions (e.g. Defender, CrowdStrike, SentinelOne) Strong knowledge of network and cloud security telemetry Understanding of MITRE ATT&CK framework Familiarity with Windows, Linux, and cloud attack techniques Knowledge of malware behaviors, credential abuse, lateral movement, and persistence mechanisms Demonstrated ability to lead and mentor technical teams Strong investigative mindset with attention to detail Excellent written and verbal communication skills Ability to translate technical findings into business and risk context Desirable: Experience with detection engineering or SOAR automation Desirable: Purple team or red team collaboration experience Desirable: Forensic analysis experience (memory, disk, network) Desirable: Exposure to regulatory environments (e.g. ISO 27001, NIST, GDPR) Responsibilities: Lead proactive, hypothesis-driven threat hunting activities across endpoint, network, cloud, identity, and SaaS environments Develop and maintain threat hunting playbooks aligned to MITRE ATT&CK techniques Identify stealthy, low-and-slow, and novel attack patterns not detected by automated controls Translate threat intelligence into actionable hunt hypotheses Continuously refine detection logic based on hunt outcomes and emerging threats Lead complex and high-severity security investigations from triage through containment and remediation Act as the technical escalation point for advanced SOC investigations Conduct root cause analysis and attacker kill-chain reconstruction Produce clear, defensible investigation documentation suitable for executive, legal, and regulatory audiences Coordinate incident response activities with IR, IT, Legal, Risk, and external partners as required Define investigation standards, workflows, and quality benchmarks Mentor and upskill SOC analysts in hunting methodologies and investigative techniques Review and improve alert fidelity, detection coverage, and response effectiveness Provide technical oversight for tooling such as SIEM, EDR/XDR, NDR, SOAR, and cloud-native security platforms Collaborate with detection engineers to convert hunt findings into new or improved detections Identify visibility gaps and recommend logging, telemetry, and tooling improvements Validate detection performance through purple team activities and simulation Consume and operationalise internal and external threat intelligence Maintain awareness of attacker tactics, tools, and campaigns relevant to the organization Act as a key interface between SOC, Threat Intel, Red Team, and Vulnerability Management Track and report on hunt coverage, outcomes, dwell time, MTTR, and investigation quality Provide regular insights to senior leadership on threat trends and risk posture Technologies: Cloud Linux Network Security Splunk Windows DevOps More: We are seeking a SOC Lead - Threat Hunting & Investigations to join our team in Bath with a hybrid working model of 3 days onsite and 2 days remote. In this role, you will be responsible for leading advanced threat detection and complex security investigations across our enterprise. We offer a competitive day rate of £700 outside of IR35 and an opportunity to make a significant impact as you mentor analysts and enhance our SOC capabilities. last updated 20 week of 2026