{"id":2094526,"url":"https://alion.io/job/ubds-digital-sioc-analyst","title":"Security & Infrastructure Operations Centre (SIOC) Analyst","company":{"id":8401,"name":"UBDS Digital","domain":"ubdsdigital.com","url":"https://alion.io/company/ubds-digital","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":93,"open_postings":11,"ghost_share":0,"stale_share":0.273,"repost_share":0,"time_to_fill_p50_days":31,"computed_at":"2026-10-12T06:55:09Z"}},"role":"Analytics","role_family":"Analytics","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Manchester, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":43000,"max_usd":88000,"period":"year","method":"role_country_seniority_unknown","sample_n":179},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Azure","optional":true}],"status":"live","first_seen_at":"2026-10-08T16:16:33Z","employer_posted_date":"2026-10-08","last_verified_at":"2026-10-12T14:28:51Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"At UBDS, we help organisations transform through cloud, cyber security, AI and digital innovation. As our Managed Services capability grows, we're looking for a SIOC Analyst to join our Security and Infrastructure Operations Centre, helping protect and support critical customer environments.\nThis is a hands-on cyber security role focused on security monitoring, threat detection, incident investigation and response. You'll work across complex cloud and enterprise environments, investigating security events, responding to incidents and supporting Digital Forensics and Incident Response (DFIR) activities.\nOur technology landscape is primarily Microsoft and AWS, alongside SIEM and wider security tooling.\nLocation: Manchester (Office-based)\nWorking Pattern: Monday to Friday | Rotating shifts between 08:00-20:00 | On-call rota\nWhat You'll Do\nYou'll:\nMonitor and investigate security alerts, events and suspicious activity across customer environments.\nTriage security alerts and determine severity, impact and appropriate response actions.\nInvestigate potential security incidents across endpoints, identities, cloud environments, networks and applications.\nUse SIEM and security tooling to analyse logs, correlate events and identify suspicious behaviour.\nSupport incident response activities from initial detection and investigation through to containment, remediation and recovery.\nPerform initial DFIR activities, including evidence collection, log analysis, timeline analysis and investigation of compromised systems or accounts.\nInvestigate phishing, malware, suspicious authentication activity, account compromise and other common security threats.\nSupport security monitoring and investigation across Microsoft and AWS cloud environments.\nAnalyse indicators of compromise and support threat hunting activities.\nEscalate complex or high-severity incidents to senior security specialists and incident response teams.\nSupport vulnerability, security and threat management activities where required.\nDocument investigations, findings, actions and recommendations clearly.\nContribute to incident reports and post-incident reviews.\nHelp develop and improve security monitoring use cases, detection rules and operational playbooks.\nIdentify recurring threats and opportunities to improve detection and response capabilities.\nWork closely with customers, cloud engineers, infrastructure teams and other security specialists during investigations.\nContribute to continual improvement across the SIOC and wider Managed Services capability.\nSkills & Experience\nThis is not an exhaustive list of requirements. We're looking for someone with experience across several of these areas and an appetite to continue developing their cyber security and incident response capability.\nExperience working within a SOC, SIOC, Cyber Security Operations or similar operational security environment.\nExperience monitoring, triaging and investigating security alerts and incidents.\nHands-on experience using SIEM or security monitoring platforms.\nExperience investigating security events using logs and telemetry from multiple sources.\nGood understanding of common cyber threats, attack techniques and indicators of compromise.\nUnderstanding of incident response processes, including identification, containment, remediation and recovery.\nExperience or knowledge of Microsoft security technologies and environments.\nUnderstanding of Microsoft identity and endpoint security, including Entra ID and Microsoft Defender technologies.\nExperience or understanding of security monitoring within AWS environments.\nSome practical knowledge of DFIR principles and investigation techniques.\nUnderstanding of endpoint, identity, network and cloud security concepts.\nAbility to analyse technical information and build a clear picture of what has happened during an incident.\nStrong analytical and problem-solving skills with a methodical approach to investigations.\nAbility to prioritise multiple alerts and incidents within a fast-paced operational environment.\nStrong written and verbal communication skills, including the ability to clearly document and communicate security incidents.\nDFIR Capability\nWe're particularly interested in candidates who have some exposure to Digital Forensics and Incident Response or who want to develop further in this area.\nUseful experience could include:\nSecurity incident investigation and evidence gathering.\nEndpoint and host-based investigation.\nLog and event analysis.\nTimeline development and analysis.\nMalware or suspicious file investigation.\nIdentity and account compromise investigations.\nEmail and phishing investigations.\nAnalysis of indicators of compromise.\nBasic forensic acquisition and preservation principles.\nUsing EDR, SIEM and cloud telemetry to reconstruct security incidents.\nWe are not necessarily looking for a dedicated forensic specialist, but you should be comfortable supporting investigations beyond initial alert triage.\nTechnology Exposure\nExperience across some of the following would be beneficial:\nMicrosoft Sentinel or comparable SIEM platforms.\nMicrosoft Defender XDR.\nMicrosoft Defender for Endpoint.\nMicrosoft Defender for Cloud.\nMicrosoft Entra ID.\nMicrosoft 365 security tooling.\nAWS security and logging services.\nEndpoint Detection and Response tooling.\nVulnerability management platforms.\nThreat intelligence platforms and feeds.\nSOAR and security automation tooling.\nPowerShell, Python or other scripting languages for investigation and automation.\nDesirable Qualifications\nRelevant certifications are beneficial but not essential, including:\nMicrosoft Security Operations Analyst Associate (SC-200).\nMicrosoft security or Azure certifications.\nAWS security or cloud certifications.\nCompTIA Security+, CySA+ or equivalent.\nGIAC, SANS or other incident response/forensics training.\nCREST or equivalent cyber security qualifications.\nThe Opportunity\nThis role would suit a security analyst who enjoys understanding how incidents happened, not simply closing alerts.\nYou'll gain exposure to a broad range of customer environments and security technologies, with opportunities to develop deeper skills across security operations, threat detection, incident response and DFIR while working alongside experienced cyber, cloud and infrastructure specialists.\nBenefits\nWhy people choose to grow their careers at UBDS Group\nProfessionals choose to grow their careers at UBDS Group for its reputation as a dynamic and forward-thinking organisation that is deeply committed to both innovation and employee development. At UBDS Group, employees are given unique opportunities to work on cutting-edge projects across a diverse range of industries, exposing them to new challenges and learning opportunities that are pivotal for professional growth. The Group’s culture emphasises continuous improvement, offering ample training programs, mentorship, and the chance to gain certifications that enhance their skills and marketability.\nUBDS Group fosters a collaborative environment where creativity and innovation are encouraged, allowing employees to contribute ideas and solutions that have a tangible impact on the company and its clients. This combination of professional development, a culture of innovation, and the opportunity to make meaningful contributions makes UBDS Group an attractive place for those looking to advance their careers and be at the forefront of technological and operational excellence.\nEmployee Benefits\n Training - All team members are offered a number of options in terms of personal development, whether it is technical led, business acumen or methodologies. We want you to grow with us and to help us achieve more\n Private medical cover for you and your spouse/partner, offered via Vitality\n Discretionary bonus based on a blend of personal and company performance\n Holiday - You will receive 25 Days holiday, plus 1 day for Birthday and 1 day for your work anniversary in addition to UK bank holidays\n Electric Vehicle leasing with salary sacrifice\n Contributed Pension Scheme\n Death in service cover\n About UBDS Group\nAt UBDS Group our mission is to support entrepreneurs who are setting new standards with technology solutions across cloud services, cybersecurity, data and AI, ensuring that every investment advances our commitment to innovation, making a difference, and creating impactful solutions for organisations and society.\nEqual Opportunities\nWe are an equal opportunities employer and do not discriminate on the grounds of gender, sexual orientation, marital or civil partner status, pregnancy or maternity, gender reassignment, race, colour, nationality, ethnic or national origin, religion or belief, disability or age.","description_format":"text","description_chars":8712,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","IT Consulting & Digital Transformation","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-10-08T16:16:33Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":31,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-10-12T06:55:09Z"},"pay":null,"html_url":"https://alion.io/job/ubds-digital-sioc-analyst","json_url":"https://alion.io/job/ubds-digital-sioc-analyst.json","meta":{"generated_at":"2026-10-12T17:57:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28831,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8401},"rest":"https://alion.io/mcp/rest/get_company?id=8401"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fubds-digital-sioc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fubds-digital-sioc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fubds-digital-sioc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ubds-digital-sioc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fubds-digital-sioc-analyst"}]}