Cyber Security Operations Analyst (SecOps)
Permanent
Location: South Manchester (Hybrid – onsite 2 days a week)
Salary: £45,000 - £55,000 (+ benefits)

Skills: SecOps, Microsoft Sentinel, SIEM, Incident Response, Microsoft Defender

We are recruiting for an experienced Cyber Security Operations Analyst to join an established IT Managed Services Provider, supporting security operations across a diverse portfolio of customer environments.

This is an exciting opportunity to join a growing Cyber Security function, working closely with the Cyber Security Manager to investigate security incidents, strengthen monitoring capabilities and support the continued development of managed security services.

The business has invested significantly in developing its Cyber Security offerings over the past 18 months and is currently transitioning from FortiSIEM to Microsoft Sentinel, creating an opportunity to work with evolving security technologies and processes.

The successful candidate will combine strong security incident investigation skills with broader technical knowledge of Microsoft cloud, infrastructure and networking environments.

Key Responsibilities

• Monitor, investigate and respond to Cyber Security alerts, threats and incidents across multiple customer environments.
• Analyse security events, logs and technical evidence to assess threats, identify vulnerabilities and determine appropriate remediation actions.
• Work with SIEM technologies, including Microsoft Sentinel, supporting the ongoing development and improvement of security monitoring capabilities.
• Provide advanced technical support for complex security and cloud-related incidents escalated through the Service Desk.
• Take ownership of security investigations, coordinating with internal technical teams, vendors and customers to resolve incidents.
• Produce daily, weekly and monthly security reports, highlighting incidents, vulnerabilities, trends and recommendations.
• Investigate security issues involving Microsoft 365, Azure, endpoint protection, identity management and network infrastructure.
• Support incident response activities, root cause analysis and post-incident reviews.
• Develop and maintain security documentation, incident response playbooks, procedures and knowledge articles.
• Identify opportunities to improve security monitoring, automation, reporting and operational processes.
• Work closely with the Cyber Security Manager to support the ongoing development of managed security services.

Essential Skills & Experience

• Previous experience in a Cyber Security Operations, SOC Analyst, Security Analyst or technically focused IT support role.
• Hands-on experience investigating security alerts, incidents and potential threats.
• Experience working with SIEM technologies and analysing security events from multiple sources.
• Strong understanding of Microsoft security technologies and environments, including Microsoft 365, Azure, Windows and Entra ID.
• Knowledge of common Cyber Security threats, attack techniques, vulnerabilities and indicators of compromise.
• Familiarity with endpoint security, EDR/XDR, firewalls and identity protection technologies.
• Strong technical troubleshooting skills, with the ability to investigate and resolve complex security and cloud-related issues.
• Experience working within a structured incident management or technical support environment.
• Excellent communication and reporting skills, with the ability to explain technical findings to customers and non-technical stakeholders.

Desirable Skills & Experience

• Hands-on experience with Microsoft Sentinel and Microsoft Defender XDR.
• Experience with FortiSIEM or involvement in SIEM platform migrations.
• Knowledge of Kusto Query Language (KQL).
• Experience with Microsoft Defender for Endpoint, Defender for Identity or Defender for Cloud.
• Knowledge of vulnerability management tools such as Nessus or Qualys.
• Understanding of the MITRE ATT&CK framework.
• Previous experience within an MSP, MSSP or Security Operations Centre.
• Relevant Cyber Security certifications, such as Microsoft SC-200, AZ-500 or CompTIA Security+.
• Experience developing security reporting, automation or incident response playbooks.

This is an excellent opportunity for a technically capable Cyber Security professional who enjoys investigating incidents, solving complex problems and contributing to the development of modern security operations capabilities.