As a Security Operations Specialist you will manage the relationship with the organisation’s outsourced SOC provider, ensuring effective monitoring, escalation handling, and incident response.
Operating within a Microsoft Azure environment, the Specialist will oversee the integration and assurance of security tooling such as Microsoft Sentinel, Microsoft Defender suite, Abnormal, Recorded Future, and Tenable.
This role requires strong technical knowledge of Azure-native security, threat intelligence, and vulnerability management, combined with the ability to challenge providers, validate escalations, and coordinate internal remediation
This is a permanent, hybrid role, based in our Swindon office, with the requirement to be in the office 3 days a week.
The benefits:
- Salary - £54,000
- Bonus scheme - on target bonus 7.5%
- Pension scheme - contribute up to 5% of your salary and Openwork will match you and put in an extra 5%
- Critical illness cover
- Income protection - 1x salary
- Death in service - 4x salary
- 27 days holiday + bank holidays, with the opportunity to buy up to an additional 10 days
- A range of other flexible benefits to include private medical insurance, dental insurance and much more.
Key Accountabilities:
- Act as the primary liaison between the business and the outsourced SOC provider, managing the relationship, SLAs, KPIs, and service reviews.
- Validate and triage SOC escalations, ensuring incidents are accurately assessed, contained, and remediated.
- Provide assurance that the SOC is effectively leveraging Microsoft Sentinel, Defender suite, and other integrated tools for monitoring and detection.
- Oversee integration and use of Abnormal (email threat protection), Recorded Future (threat intelligence enrichment), and Tenable (vulnerability management) into security operations workflows.
- Collaborate with IT and engineering teams to ensure log sources, telemetry, and alerting are comprehensive across Azure and on-premise systems.
- Ensure detections are mapped to frameworks such as MITRE ATT&CK, continually tuning use cases to improve coverage and reduce false positives.
- Coordinate vulnerability management processes, ensuring Tenable scans are accurate, issues are prioritized, and patching is validated.
- Track remediation activities from incidents, vulnerabilities, and penetration tests, ensuring accountability and closure.
- Drive threat intelligence integration from Recorded Future into SOC playbooks and response processes.
- Produce reporting and metrics on SOC performance, incidents, vulnerabilities, and operational risk for senior management.
- Partner with GRC teams to provide evidence for audits, certifications, and regulatory obligations.
- Mentor colleagues on incident response and SecOps best practices, acting as escalation point for critical issues.