Scope of ImpactActively participates with other seniors in SOC activities by providing knowledge and insight on more complex client cases.
Provides ideas and concrete input for process and efficiency improvements.
ExpertiseIn-depth knowledge of the operational use of security monitoring tools (SIEM, EDR).
Ability to assess complex logs, recognise patterns, and derive actionable insights.
A credible voice and source of knowledge in the department.
Autonomy and Contribution StyleFull autonomy during complex SOC escalations.
Skills and confidence to coordinate the team’s response.
Once fully onboarded, demonstrates the ability to handle Tier 3 shifts.
ComplexityHigh complexity: oversees entire projects and influences cross-functional teams; decisions impact the department and adjacent areas.
Creates clear, structured, reproducible documentation that informs stakeholders of risks, findings, and recommended actions.
Recognises higher-level security issues and resolves them independently; supports junior members in resolving theirs.
ResponsibilitiesMonitor security alerts and perform initial triage; classify (false positive, true positive, uncertain) and close out confirmed false positives correctlyTake full ownership of escalated and the most complex alerts: root-cause analysis, log correlation, validating assessments, determining next stepsOwn client communication for assigned alerts, including difficult or high-risk escalations from more junior analysts, to a consistent quality standardIndependently execute containment actions across impact levels; approve escalations from more junior analystsOwn the team’s o.