SOC Analyst

The Security Operations Centre (SOC) is part of the Admiral Group’s Security Operations function. The SOC is looking for an experienced SOC analyst to join Admiral’s SOC team in the UK. As a SOC Analyst, you will be responsible for responding to and investigating security events within Admiral’s environment.

The security analyst team is a key part of the SOC (along with Threat Hunting function, which is also part of the SOC) and works closely with other security operations functions such as Digital Forensics & Incident Response, Threat Intelligence, as well as with various technology and business units. This role might require working on a scheduled shift rota.

Responsibilities

• Triage cases/alerts on SOAR, SIEM, EDR platforms.
• Triage cases generated by Admiral’s Data Loss Prevention (DLP) rules.
• Perform initial investigation on alerts using all available security technology solutions.
• Conduct threat hunting using Admiral’s security systems as and when needed.
• Assist the DFIR (Digital Forensics and Incident Response) team during an incident response investigation as and when needed.
• Raise issues with the relevant teams to help improve detection and alerting capabilities.

Key Interactions

• Engage with the overall SOC team on case investigations.
• Engage with the Cyber Threat Intelligence (CTI) team.
• Engage with the DFIR team when needed.
• Engage with various stakeholders within Security Operations as and when needed.

Knowledge and Experience Required

• 3+ years’ experience in any of the following: SOC; incident response; digital forensics.
• Experience in alert triage on a SIEM (Security Information and Event Management) solution such as Microsoft Sentinel, LogRhythm, Chronicle, Splunk.
• Analysing security logs / alerts from security solutions such as firewalls, EDR.
• Good understanding of general cyber-security principles.
• Familiarity with public cloud platforms such as Azure, GCP or AWS and security practices on those platforms.
• Working understanding of frameworks such as Cyber Kill Chain, MITRE ATT&CK.

Desirable Skills

• Previous working experience on a SOAR (Security Orchestration, Automation & Response) platform would be highly advantageous but not mandatory.
• Certifications such as the following would be desirable but not mandatory: GCIH, GCFE, GCIA, GDAT, GCDA, GISP.

Admiral: Where You Can

We take pride in being a diverse and inclusive business. It's a place where you can Be You, and show up as you are. We’re committed to fostering a people-first culture where everyone is accepted, supported, and empowered to be brilliant. You can, Grow And Progress at a pace and direction that suits you, Make A Difference for our customers and each other, and Share in Our Future with all colleagues eligible for up to £3,600 of free shares each year after one year of service.

Everyone receives 33 days holiday (including bank holidays) when they join us, increasing the longer you stay with us, up to a maximum of 38 days (including bank holidays). You also have the option to buy or sell up to an additional five days of annual leave.

We’re proud of our people-first culture. In fact, we've been recognised as a Great Place to Work for Women, a Great Place to Work for Wellbeing, and an overall Great Place to Work for over 25 years! We’re fully committed to making sure your progression is not slowed or halted by barriers related to race, gender, age, sexuality or any of the protected characteristics.

Our fantastic benefits make sure our colleagues have a great work-life balance; You can view some of our other key benefits here.

#LI-CS1