{"id":3199539,"url":"https://alion.io/job/govstack-senior-soc-analyst-incident-response","title":"Senior SOC Analyst - Incident Response","company":{"id":2665675,"name":"Govstack","domain":"govstack.com","url":"https://alion.io/company/govstack-2","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"B","score":75,"open_postings":6,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-24T06:02:35Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom","Manchester, United Kingdom","Chester, United Kingdom","Leeds, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":83000,"max_usd":153000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":36},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"Red Teaming","optional":false}],"status":"live","first_seen_at":"2026-09-01T11:09:33Z","employer_posted_date":"2026-09-01","last_verified_at":"2026-10-25T03:16:14Z","board_verified":true,"closed_at":null,"days_open":53,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":53},"description":"Help protect the systems, information and digital services that enable GHD to deliver for clients and communities around the world.\nAs cyber threats become more sophisticated and connected environments grow in complexity, effective incident response depends on more than technology alone. At GHD, we combine disciplined investigation, practical judgement and close collaboration to understand threats quickly, contain risk and continually strengthen our security operations.\nThe opportunity\nWe are looking for an accomplished Senior SOC Analyst - Incident Response to lead and coordinate complex, high-severity incidents across a large enterprise environment. Reporting to the SOC Manager, you will own investigations end to end, shape critical response decisions and help strengthen how incidents are detected, contained and learned from across the organisation.\nThis is not a conventional alert-triage role. It is for a seasoned, hands-on responder who can establish facts when evidence is incomplete, coordinate technical teams during live incidents and apply sound incident response methodology even when tooling is degraded. Microsoft Sentinel and Defender XDR will be central to your work, but calm judgement, investigative discipline and clear communication will matter just as much.\nWhat you will do\nLead and coordinate high-severity and complex security incident investigations from initial assessment through containment, recovery and review.\nEstablish incident scope, business impact and likely root cause using Microsoft Sentinel, Defender XDR and evidence from across the enterprise environment.\nDirect response actions in partnership with infrastructure, identity, cloud, application and wider IT teams.\nMaintain clear investigation records, preserve evidence and produce accurate, defensible incident outcomes and post-incident reports.\nDevelop, tune and maintain Sentinel analytics rules, improving signal quality and reducing false positives.\nConduct hypothesis-driven threat hunting using Sentinel and Defender Advanced Hunting.\nConvert purple-team and attack-simulation findings into practical detection and response improvements.\nAct as a technical mentor to junior and mid-level analysts, reviewing investigations and helping define playbooks, investigation standards and escalation thresholds.\nWork closely with the organisation’s managed security service provider to maintain high-quality triage and escalation.\nBrief technical and non-technical stakeholders clearly during active incidents, providing concise insight to support prioritisation and decision-making.\nWhat success looks like\nYou are the person colleagues look to when an incident becomes complex, fast-moving or uncertain.\nYou turn fragmented technical evidence into a clear view of scope, impact, likely cause and immediate priorities.\nYou coordinate decisive containment while protecting evidence, maintaining accurate records and keeping stakeholders informed.\nYou improve detections, playbooks and escalation standards so that lessons from incidents create lasting capability.\nYou raise the confidence and investigative discipline of analysts around you through constructive review and mentoring.\nWhat you will bring\nAt least five years’ experience in security operations and incident response, ideally within a large, complex or global organisation.\nDemonstrable experience leading or owning major security investigations and coordinating stakeholders through the full response lifecycle.\nDeep, hands-on expertise in Microsoft Sentinel, including incidents, investigations and analytics.\nStrong knowledge of Microsoft Defender XDR, identity-based attacks and hybrid cloud environments.\nThe ability to form, test and refine investigative hypotheses using evidence from multiple sources.\nCalm, decisive judgement under pressure, with the confidence to act when information is incomplete.\nClear written and verbal communication, including the ability to brief both technical specialists and senior non-technical stakeholders.\nA collaborative, curious and disciplined approach to incident handling and continuous improvement.\nAdditional experience that would be valuable\nExperience coaching analysts or raising capability within a SOC.\nExposure to breach and attack simulation, purple teaming or collaboration with red teams.\nPractical knowledge of Entra ID, Microsoft 365 and Azure environments.\nOne or more relevant certifications, such as Microsoft SC-200 or AZ-500, GCED, GCIA, GCIH, CISSP or CISM.\nPractical investigative capability and real-world incident leadership matter more to us than certifications alone.\nWhy GHD?\nGHD is a global professional services company working across water, energy and resources, environment, property and buildings, and transportation. Privately owned by our people, we connect engineering, architecture, environmental, advisory and construction expertise to create lasting community benefit.\nYou will join a collaborative security environment where technical depth, measured judgement and knowledge-sharing are valued. Your expertise will influence incident response practice across the SOC, and you will have the opportunity to turn lessons from challenging investigations into lasting security improvements.\nOur commitment to you\nWe will give you the trust, tools and connected expertise to do your best work, recognise your contribution and support your continued development. We are committed to an inclusive and flexible culture where different perspectives are heard and people can succeed while balancing their individual circumstances with the needs of clients, teams and the organisation.\nReady to respond when it matters?\nIf you are motivated by complex investigations, decisive incident leadership and the opportunity to strengthen security operations in a global organisation, we would like to hear from you. Apply online with your CV and cover letter.\nGHD is an equal opportunity employer. We value a diverse workforce and an inclusive culture, and we want everyone to be able to participate fully in our recruitment process. Please let us know if you require any reasonable adjustments.","description_format":"text","description_chars":6127,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Government","Internet Services","Public Administration & Local Government"],"lifecycle":[{"event":"open","at":"2026-10-24T07:39:25Z"}],"visa":[],"liveness":{"score":31,"band":"fade","label":"Fading","p_open":1,"p_active":0.698,"p_room":0.44,"age_days":53,"expected_fill_days":36,"reasons":["conf:1","win:tail","crowd:brand"],"computed_at":"2026-10-25T04:50:11Z"},"pay":null,"html_url":"https://alion.io/job/govstack-senior-soc-analyst-incident-response","json_url":"https://alion.io/job/govstack-senior-soc-analyst-incident-response.json","meta":{"generated_at":"2026-10-25T04:50:11Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6467,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2665675},"rest":"https://alion.io/mcp/rest/get_company?id=2665675"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgovstack-senior-soc-analyst-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgovstack-senior-soc-analyst-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgovstack-senior-soc-analyst-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/govstack-senior-soc-analyst-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgovstack-senior-soc-analyst-incident-response"}]}