Senior SOC Analyst - Incident Response

Help protect the systems, information and digital services that enable GHD to deliver for clients and communities around the world.

As cyber threats become more sophisticated and connected environments grow in complexity, effective incident response depends on more than technology alone. At GHD, we combine disciplined investigation, practical judgement and close collaboration to understand threats quickly, contain risk and continually strengthen our security operations.

The opportunity

We are looking for an accomplished Senior SOC Analyst - Incident Response to lead and coordinate complex, high-severity incidents across a large enterprise environment. Reporting to the SOC Manager, you will own investigations end to end, shape critical response decisions and help strengthen how incidents are detected, contained and learned from across the organisation.

This is not a conventional alert-triage role. It is for a seasoned, hands-on responder who can establish facts when evidence is incomplete, coordinate technical teams during live incidents and apply sound incident response methodology even when tooling is degraded. Microsoft Sentinel and Defender XDR will be central to your work, but calm judgement, investigative discipline and clear communication will matter just as much.

What you will do

• Lead and coordinate high-severity and complex security incident investigations from initial assessment through containment, recovery and review.
• Establish incident scope, business impact and likely root cause using Microsoft Sentinel, Defender XDR and evidence from across the enterprise environment.
• Direct response actions in partnership with infrastructure, identity, cloud, application and wider IT teams.
• Maintain clear investigation records, preserve evidence and produce accurate, defensible incident outcomes and post-incident reports.
• Develop, tune and maintain Sentinel analytics rules, improving signal quality and reducing false positives.
• Conduct hypothesis-driven threat hunting using Sentinel and Defender Advanced Hunting.
• Convert purple-team and attack-simulation findings into practical detection and response improvements.
• Act as a technical mentor to junior and mid-level analysts, reviewing investigations and helping define playbooks, investigation standards and escalation thresholds.
• Work closely with the organisation’s managed security service provider to maintain high-quality triage and escalation.
• Brief technical and non-technical stakeholders clearly during active incidents, providing concise insight to support prioritisation and decision-making.

What success looks like

• You are the person colleagues look to when an incident becomes complex, fast-moving or uncertain.
• You turn fragmented technical evidence into a clear view of scope, impact, likely cause and immediate priorities.
• You coordinate decisive containment while protecting evidence, maintaining accurate records and keeping stakeholders informed.
• You improve detections, playbooks and escalation standards so that lessons from incidents create lasting capability.
• You raise the confidence and investigative discipline of analysts around you through constructive review and mentoring.

What you will bring

• At least five years’ experience in security operations and incident response, ideally within a large, complex or global organisation.
• Demonstrable experience leading or owning major security investigations and coordinating stakeholders through the full response lifecycle.
• Deep, hands-on expertise in Microsoft Sentinel, including incidents, investigations and analytics.
• Strong knowledge of Microsoft Defender XDR, identity-based attacks and hybrid cloud environments.
• The ability to form, test and refine investigative hypotheses using evidence from multiple sources.
• Calm, decisive judgement under pressure, with the confidence to act when information is incomplete.
• Clear written and verbal communication, including the ability to brief both technical specialists and senior non-technical stakeholders.
• A collaborative, curious and disciplined approach to incident handling and continuous improvement.

Additional experience that would be valuable

• Experience coaching analysts or raising capability within a SOC.
• Exposure to breach and attack simulation, purple teaming or collaboration with red teams.
• Practical knowledge of Entra ID, Microsoft 365 and Azure environments.
• One or more relevant certifications, such as Microsoft SC-200 or AZ-500, GCED, GCIA, GCIH, CISSP or CISM.

Practical investigative capability and real-world incident leadership matter more to us than certifications alone.

Why GHD?

GHD is a global professional services company working across water, energy and resources, environment, property and buildings, and transportation. Privately owned by our people, we connect engineering, architecture, environmental, advisory and construction expertise to create lasting community benefit.

You will join a collaborative security environment where technical depth, measured judgement and knowledge-sharing are valued. Your expertise will influence incident response practice across the SOC, and you will have the opportunity to turn lessons from challenging investigations into lasting security improvements.

Our commitment to you

We will give you the trust, tools and connected expertise to do your best work, recognise your contribution and support your continued development. We are committed to an inclusive and flexible culture where different perspectives are heard and people can succeed while balancing their individual circumstances with the needs of clients, teams and the organisation.

Ready to respond when it matters?

If you are motivated by complex investigations, decisive incident leadership and the opportunity to strengthen security operations in a global organisation, we would like to hear from you. Apply online with your CV and cover letter.

GHD is an equal opportunity employer. We value a diverse workforce and an inclusive culture, and we want everyone to be able to participate fully in our recruitment process. Please let us know if you require any reasonable adjustments.