The eyes and ears of an organisation's cyber defences. SOC Analysts monitor, detect, and respond to security incidents in real-time.
SOC Analysts are the front-line defenders in the world of cyber security. Working in Security Operations Centres (SOCs), they monitor and analyse security events to identify and respond to potential threats. These roles are critical for organisations of all sizes, from scaleups to large enterprises, ensuring that security incidents are detected and mitigated quickly. SOC Analysts often work in shifts, providing 24/7 coverage to maintain a constant watch over the organisation's digital assets.
A typical week for a SOC Analyst is a mix of monitoring, incident response, and reporting. They spend a significant amount of time analysing security alerts and collaborating with other teams.
Based on advertised midpoints across the 77 UK listings priced in pounds in the last 12 months. Base salary only.
% of 61 listings posted in the last 12 months that mention each skill, extracted from job descriptions.
A typical UK progression for soc analysts. Years are guidance — strong people move faster, and many senior folks sidestep into research, product or management.
Assists in monitoring security events and performs basic triage under supervision.
Takes primary responsibility for incident detection and response, and contributes to the development of security policies.
Leads incident response efforts, mentors junior analysts, and advises on security strategy.
Oversees the SOC's operations, drives strategic initiatives, and ensures compliance with regulatory requirements.
There's no single route, but most people follow some version of these steps.
Start with foundational roles, learning the basics of security monitoring and incident response.
Develop expertise in specific areas such as threat hunting, malware analysis, or forensic investigation.
Take on more complex incidents and lead response efforts, often working closely with other security teams.
Move into a leadership position, managing a team of analysts and driving the SOC's strategic direction.
Advise senior management on security policies and contribute to the organisation's overall security posture.
Experis Eastleigh £50,000 pa
Technical Consultant - Threat Detection, Response & IntelligenceLocation: Hursley - On-siteSecurity clearance: UK national with a minimum of 5 years' UK residency requiredCertification: Microsoft Certified: Security Operations Analyst AssociateWe are seeking a technically strong and proactive Technical Consultant - Threat...
Experis Winchester £41,000 – £50,000 pa
Monitor, triage and investigate security alerts across SIEM and wider security tooling, identifying indicators of compromise and conducting initial incident investigations. Support the full incident response lifecycle including containment, remediation and post-incident learning, while tuning detection rules to reduce false positives. Work with security and infrastructure teams on threat intelligence, trend reporting and continual service improvement.
Reed Technology Newcastle upon Tyne £35,000 – £45,000 pa
Investigating and responding to security incidents at 2nd Line level, monitoring customer environments and SIEM alerts, and threat hunting across a Microsoft security stack including Sentinel, Defender and Entra. Uses KQL and PowerShell for investigations and automation, acts as an escalation point for junior analysts, and supports vulnerability assessment and remediation. Initially on a 4-on, 4-off night shift pattern before moving to an 8-hour shift model.
Tank Recruitment London
Hands-on incident response role covering detection, triage, investigation, containment and recovery of cyber incidents in a complex enterprise environment. Day to day involves monitoring SIEM and EDR/XDR alerts, analysing logs, packet captures and forensic images, threat hunting, and mapping activity to MITRE ATT&CK. Also maintains playbooks, evidence records and post-incident reports, and briefs senior stakeholders.
NCC Group Remote
Monitor, detect, investigate and respond to cyber security threats using the Splunk Enterprise Security toolset. The role supports security operations by analysing alerts, investigating incidents and helping strengthen cyber defence capabilities.
Circle Recruitment London £30,000 – £45,000 pa
Hands-on SOC role monitoring and triaging SIEM, EDR and cloud alerts, investigating incidents and supporting containment and response. Also provides second-line support across Azure, AWS, identity, network and endpoint environments, with occasional on-call and shift handovers. Requires SC clearance eligibility and is majority onsite in Manchester or London.
Fynity Farnborough £48,000 – £58,000 pa
Senior SOC Analysts – Multiple OpportunitiesFarnborough | Fully On-Site | 24/7 Shift PatternSalary + Shift Allowance | DV Clearance Eligibility RequiredEnjoy the investigation side of SOC work? There’s plenty to get into here.I’m recruiting for several Senior SOC Analysts to...
ITOL Recruit Brighton £28,000 – £40,000 pa
A self-funded training programme leading to a SOC analyst role, combining online CompTIA A+, Network+ and Security+ certification with live labs, hands-on cyber security scenarios and 1-1 tutor support. Recruitment support continues until placement, with flexible payment options spread over 12 months.
The locations with the most live listings for this role today.
A degree in a relevant field such as computer science or information security is beneficial. Certifications like CompTIA Security+, CEH, or CISSP can also enhance your credentials.
SOC Analysts often work in shifts to provide 24/7 coverage, which can include evenings, weekends, and holidays.
Gaining experience, specialising in areas like threat hunting or incident response, and obtaining relevant certifications can help you advance to senior and leadership roles.
Salaries can vary based on experience, location, and the size of the organisation. For more detailed salary information, refer to the salary section on this page.
Post your role in 90 seconds and reach the specialist audience that already reads this page.
