{"id":2121927,"url":"https://alion.io/job/caa-security-operation-centre-soc-analyst","title":"Security Operation Centre (SOC) Analyst","company":{"id":98304,"name":"CAA","domain":"caa.co.uk","url":"https://alion.io/company/caa-2","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Crawley, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":null,"max":38000,"currency":"GBP","period":"year","gross":null,"usd_annual":50221},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Azure","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true}],"status":"closed","first_seen_at":"2026-09-18T00:00:00Z","employer_posted_date":"2026-09-18","last_verified_at":"2026-10-12T02:26:05Z","board_verified":false,"closed_at":"2026-10-12T02:26:05Z","days_open":24,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":24},"description":"Salary: Up to £38,000 - (dependent on experience)\nContract Type: Fixed Term Contract - (12 - 18 months)\nLocation: Gatwick - Hybrid\nClosing Date: Friday 9th October 2026\nInterview Date: w/c 19th October 2026\nVisa Restrictions: This position does not offer visa sponsorship.\nWe are the UK's aviation and aerospace regulator and recognised as a world leader in its field. Our activities are diverse, enabling the aviation industry to meet the highest safety standards, and we pride ourselves on our ability to adapt to the constantly evolving aviation environment.\nThe Role\nWith the establishment of a dedicated Security Operations Centre (SOC) at the CAA in early 2026, we are entering a transformative phase in our cyber defence capability. This strategic initiative marks a significant investment in strengthening our ability to detect, respond to, and recover from cyber threats in real time. SOC Analysts are responsible for monitoring, triaging, and investigating security events that could impact the CAA’s operations, systems, or data. Working as part of an in-house SOC, the role focuses on first and second-line defence activities and supports continuous improvement to our security monitoring and response capabilities.\nCore Accountabilities\nWorking in a team of analysts, the SOC Analyst is expected to handle investigations with autonomy and good judgment. This is an excellent opportunity for someone with prior SOC experience to develop their technical depth while contributing to a fast-moving and maturing security function.\nAbout You\nMinimum essential requirements for the role:\nExperience in a SOC, threat detection, or security operations environment\nWorking knowledge of SIEM and EDR platforms (especially Microsoft Sentinel and Defender)\nWorking understanding of Windows, Active Directory, and basic networking concepts\nFamiliarity with the incident response process and evidence handling\nAnalytical mindset and strong attention to detail in order to identify indicators of compromise (IOCs)\nAbility to work under pressure and manage multiple investigations\nCompTIA Security+ certification or equivalent foundational knowledge\nStrong communication and collaboration skills to effectively work with IT, network, and application teams during investigations\nDesirable skills for the role:\nExperience using KQL (Kusto Query Language) for writing or modifying queries withing Microsoft Sentinel\nExposure to PowerShell, Logic Apps or scripting languages for automation and investigative tasks\nUnderstanding of MITRE ATT&CK or other threat models\nKnowledge of threat intelligence concepts and IOCs\nExperience with cloud environments, particularly Microsoft Azure\nRelevant certifications (e.g. SC-200, CySA+, or equivalent)\nAdditional Information\nFor many appointments within the CAA, these roles require access to operationally sensitive infrastructure and/or Nationally Protected information. For these roles the post holders must undergo National Security Vetting and achieve the appropriate level of clearance.\nSC - To be vetted we will usually expect a reasonable period of residency in the UK so that meaningful checks can be undertaken. For this role this will need to be 5 years.\nIf you do not meet these requirements, we may not be able to accept your application.\nFor more information on CTC and SC clearance please visit - Vetting explained - GOV.UK (www.gov.uk)\nThe CAA values high ethical standards and personal integrity among employees. If invited for interview you will be asked to complete a declaration of interest.\nRelocation & Property\n\nThe CAA will be relocating from Aviation House (Our Gatwick Office) to new premises in a few years’ time. Our move is driven by strategic, operational and environmental considerations.\nWe will be moving to a new local home, up to a 15-mile radius of Aviation House, to minimise disruption for our valued colleagues and customers.\nWe are now working with colleagues and visitors to understand what we need in our new office, before we start our property search. We will sell Aviation House and land, vacate the site and move to new premises, but we do not expect to move before 2028\nInclusivity\nWe are proud to be an equal opportunity employer and celebrate our diversity ensuring all are backgrounds included here at the CAA. As a member of the Disability Confident scheme, applicants who meet the minimum criteria for a role with us will be guaranteed an interview.\nOur Benefits\nWe offer a range of excellent benefits such as:\nFlexible & hybrid working arrangements available\n28 days annual leave + public holidays (additional 5 days leave purchase scheme)\nGenerous pension scheme (Up to 12% employer contribution)\nWellbeing Room at Gatwick\nMental Health and Suicide First Aiders\nEmployee Assistance Programme, talking therapies and neurodiversity support via Occupational Health & access to Headspace for colleagues and 5 dependents\nFree onsite gym at Gatwick or discounted gym membership for London \nEV charging points\nEmployee Development courses internally and via Skillsoft\nOur Values\n\nDo The Right Thing, Never Stop Learning, Build Collaborative Relationships, Respect Everyone - For more information please Click Here\n\nWe reserve the right to close this vacancy early if we receive sufficient applications for the role. Therefore, if you are interested, please submit your application as early as possible.\n\nNo recruitment agencies please.","description_format":"text","description_chars":5415,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Gym membership","Hybrid work"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["Incident Response","Space & Aerospace","Launch Services","Commercial Aviation"],"lifecycle":[{"event":"open","at":"2026-10-09T00:03:08Z"},{"event":"close","at":"2026-10-12T02:26:05Z"}],"visa":[],"liveness":null,"pay":{"stated_usd_annual":50221,"is_top_pay":false},"html_url":"https://alion.io/job/caa-security-operation-centre-soc-analyst","json_url":"https://alion.io/job/caa-security-operation-centre-soc-analyst.json","meta":{"generated_at":"2026-10-12T04:47:59Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7462,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":98304},"rest":"https://alion.io/mcp/rest/get_company?id=98304"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcaa-security-operation-centre-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcaa-security-operation-centre-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcaa-security-operation-centre-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/caa-security-operation-centre-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcaa-security-operation-centre-soc-analyst"}]}