Job Description

Vacancy Name

Senior SOC Analyst (Team Leader)

Req Number

VN274

Employment Type

Full-Time

Location

Leeds/Hybrid

Position Summary

About Claranet

Founded at the beginning of the dot.com bubble in 1996, our CEO Charles Nasser had a light bulb moment to develop a truly customer-focused IT business. Since then, Claranet has grown from an Internet Service Provider (ISP) in the UK to being one of the leading business modernisation experts, who deliver solutions across 11+ countries.



At Claranet, we're experienced in implementing progressive technology solutions which help our customers solve their epic business challenges. We're committed to understanding their problems, delivering answers quickly, and making a lasting impact to their business.



We are agile, focused and experienced in business modernisation. Our approach helps customers make genuine, significant shifts in their business strategy, to deliver financial savings, boost innovation, and create a resilient business. We continually invest in our people and the latest technologies, so our customers get peace of mind knowing that they have access to the best talent and services.



In the UK we have over 500 staff working in London, Gloucester, Warrington, Bristol, and Leeds, or as homeworkers.

Working for Claranet

Here at Claranet we pride ourselves on going the extra mile for and with our employees (yes, we really mean with). We offer an extensive benefits package that you can tailor to your needs, inclusive of a matching contribution pension scheme, healthcare, insurance, dental, discounted gyms and app supported benefit access.



But what we think makes us different is 'Team Claranet,' our dedicated internal part of the business that supports you with matters close to your heart. We proudly support local charities in each of our office locations, support employees with paid charity leave, organise key charity fundraising event per year and have a dedicated committee responsible for supporting employee's fundraising efforts.



Claranet are one of the 10 founding members of TC4RE (Technology Community for Racial Equality.) Being a part of a group of leading UK technology organisations, we are dedicated to building a more diverse and inclusive workforce.

Our Vision

Our vision is to become the most trusted technology solutions partner; renowned for being the best and brightest, having lasting impact with our customers and delivering exceptional returns to our stakeholders.

Duties and Responsibilities

Essential Roles & Responsibilities

As a Senior SOC Analyst (Team Leader), you apply your advanced security operations expertise to lead a team of SOC Analysts while performing advanced investigations and, when required, first-line triage to maintain queue health and SLA compliance. You are responsible for high-quality service delivery through detailed analysis, evidence-led response actions, and operational leadership. In addition to handling escalated alerts, you provide line management, oversee ticket quality, contribute to training and onboarding, and drive continual improvement. You work core business hours with participation in the on-call rota, ensuring consistent service support for customers and operational continuity across teams.

Key Responsibilities

Incident Investigation and Response

- You take ownership of escalated incidents, performing detailed investigations and, when necessary, stepping into first-line triage to guarantee prompt alert handling and escalation.

Team Leadership

- You provide day-to-day leadership and line management for a team of SOC Analysts, conducting performance reviews, appraisals, one-to-one meetings, and development planning.

Quality Assurance

- You own QA for the team's outputs, ensuring consistency, accuracy, and completeness of incident handling and documentation across the team.

Training and Onboarding

- You lead knowledge-transfer sessions, support structured onboarding of new team members, and coordinate internal training to drive skill development and reinforce SOC best practices.

Continual Improvement

- You identify opportunities to optimise workflows, enhance detection logic, and contribute to service-improvement initiatives across the SOC, including backlog reduction, knowledge-base expansion, and feedback loops from lessons learned.

Customer Communications

- You provide timely incident updates and lead bridging calls with customers during high-priority incidents, ensuring that communications are clear, evidence-led, and aligned to customer expectations.

Threat Hunting Oversigh

t - You lead and coordinate proactive threat hunting across customer environments, using hypothesis-based approaches to identify undetected threats and validate detection coverage.

Essential Duties

Advanced Investigation and Escalated Response

o Perform in-depth investigations using correlated data from all available tooling.

o Reconstruct attack chains and identify root causes using MITRE ATT&CK.

o Recommend and coordinate response actions to mitigate impact during active incidents.

IOC and Threat Analysis

o Investigate indicators of compromise using commercial and open-source threat intelligence.

o Validate alerts and determine their relevance to customer environments, providing context on adversary behaviour and recommending follow-up actions when threats are confirmed.

Threat Hunting

o Lead and participate in threat hunts using hypothesis-driven approaches mapped to TTPs and MITRE ATT&CK.

o Leverage telemetry and queries in tooling to identify suspicious indicators not surfaced through existing detection logic.

o Document hunting activities, findings, and detection coverage gaps to support tuning and continual detection improvement.

Team Oversight

o Provide feedback and coaching on triage techniques, escalation decisions, and ticket quality.

o Monitor performance, manage formal HR processes, and support professional development through regular one-to-ones and quarterly appraisals.

o Provide concise on-call handovers and status reporting to maintain continuity between core and shift teams, escalating risks or operational issues as needed.

Documentation and Reporting

o Ensure clear, evidence-based documentation of incidents and investigations, including rationale for response actions and IOC validation.

o Perform case-closure quality assurance to confirm investigation completeness and capture lessons learned.

o Support knowledge-base development and post-incident reporting activities, ensuring reusable insights are recorded to improve future incident handling and analyst onboarding.

Collaboration with Other Teams

Security Optimisation - You work closely with the Security Optimisation Manager to share insights and support customer improvement initiatives. SOC Engineering - You partner with engineering to raise platform issues, contribute to detection lifecycle development, and surface recurring gaps in visibility or response coverage. Service Development - You support the continual improvement of SOC services by identifying operational inefficiencies, proposing improvements, and collaborating on service roadmap initiatives. Customer Success and Managed Services - You provide informed, customer-focused updates during high-priority incidents, collaborating with both customer-facing and technical teams.

Position Specifications

Position Specification

Required Qualifications and Experience

You may be required to hold or obtain UK Non-Police Personnel Vetting (NPPV) and/or a Security Check (SC) clearance as part of this role. A minimum of 4+ years of SOC operational experience, with demonstrated ability across security analysis, incident response, and working escalated cases. Proven leadership capability with experience line managing analysts, conducting performance reviews, and overseeing HR-related duties. Experience providing ticket quality assurance and training delivery. Familiarity with leading SIEM, endpoint and XDR security platforms, in multi-tenant MSSP environments. Willingness to obtain or hold relevant security certifications, such as SBT BTL2 and CREST CRIA.

Technical Knowledge

Operating Systems - Proficient with Windows and Linux environments. Able to interpret logs (e.g. Sysmon, Event Viewer, Syslog), assess process behaviour, and identify privilege misuse. Endpoint Tools - Experience in endpoint detection and response across diverse customer environments, including alert triage, telemetry analysis, and supporting threat response. SIEM and Log Correlation - Able to perform detailed analysis within multi-tenant SIEM environments, interpreting data from diverse sources (including network, identity, and endpoint). Detection and Threat Hunting - Able to plan and execute threat hunting activities using ATT&CK-aligned techniques, drawing on all available telemetry to investigate anomalous activity and validate detection coverage across multiple customer environments. Networking Fundamentals - Understand core protocols (TCP/IP, DNS, HTTP), packet analysis, and log interpretation from firewalls, switches, and proxies. Incident Response Process - Familiar with the full incident response lifecycle and able to support investigation, containment, and recovery activities under defined playbooks. Threat Intelligence - Able to consume, interpret, and apply threat intelligence sources to enrich investigations and support proactive detection improvements. Automation and Scripting - Understand the principles of scripting (e.g. PowerShell, Python, Bash) to support investigation and automate analysis tasks.

Behavioural and Professional Competencies

Communication - Able to lead customer conversations during active incidents and translate technical details into clear, defensible recommendations. Team Leadership - Provide structure, guidance, and feedback to analysts, and drive knowledge sharing through documentation and training. Decision Making - Confident in leading incident investigations and making timely, evidence-led decisions about escalation or containment. Adaptability - Able to pivot across customers, technologies, and attacker behaviours in a fast-paced MSSP environment. Customer Empathy and Commercial Awareness - Understand the operational and business impact of incidents, prioritising investigation and response actions accordingly. Problem Solving - Investigate and resolve complex issues across endpoint, network, and SIEM data layers with a risk-informed mindset.

Professional Development and Career Progression

Claranet supports ongoing professional growth. As a Senior SOC Analyst (Team Leader), you are encouraged to build advanced investigative, technical and leadership skills, and play a key role in driving continual improvement within the SOC. You may progress into a Principal SOC Analyst or technical specialist role, or expand into engineering or service leadership, depending on your strengths and interests.

Salary

Competitive