Lead Security Analyst

Made Tech

Job Location:

London - UK

Yearly Salary: £ 65000 - 80000

Posted on: 4 days ago

Vacancies: 1 Vacancy

Job Summary

Made Tech helps UK public sector organisations build and run better digital services. Our Cyber practice sits at the heart of that mission working alongside government departments agencies and critical national infrastructure owners to improve how they detect respond to and learn from cyber threats. As a Lead Security Analyst youll be the most senior analyst on your engagement setting the technical direction for the SOC and owning the quality of what the team produces from detection engineering to threat-hunting to incident response.

This isnt a role where you disappear into a ticket queue. Youll shape the threat-landscape narrative for your engagement drive the detection backlog and build the capability of the analysts around you. That means pairing on complex investigations setting tradecraft standards and making sure the teams detection content is version-controlled peer-reviewed and continuously improved not left to age in a SIEM. Youll also be the trusted technical interface for client security stakeholders translating what the SOC is seeing into the language that informs decisions.

The UK public sector context matters here. Youll align your work to NCSC guidance the Cyber Assessment Framework and OFFICIAL handling requirements not because compliance is the goal but because those frameworks reflect the real risk environment your clients operate in. Youll engage with cross-government security communities feed detection content and runbooks back into the Cyber practice and help grow a bench of analysts who can operate at the same standard.

Key Responsibilities

Set the detection engineering standard author tune and peer-review detections in KQL SPL EQL or Sigma; manage the false-positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves.
Own the threat-landscape narrative for your engagement turn intelligence from NCSC advisories sector feeds and threat actor reporting into hunt themes coverage gap analysis and detection priorities that the SOC and client stakeholders can act on.
Run the intelligence cycle as a managed discipline maintain a collection plan produce timely and rigorous intelligence products and build feedback loops that keep the cycle honest and improving.
Establish and lead security incident response practice build playbooks define the severity model run exercises and lead the teams response to significant incidents; run blameless post-mortems that the team actually learns from.
Design the log and telemetry pipeline that detections run on including bespoke application telemetry in cloud environments not just commodity endpoint feeds; ensure the right signals are collected parsed and retained for both detection and investigation.
Be the trusted technical interface for client security stakeholders communicate what the SOC is detecting investigating and covering without losing fidelity; surface risks early and honestly and align the teams priorities to the clients risk picture.
Grow the analysts around you pair on detection authorship and incident response as a default set pairing as the team norm and actively build the capability of L1 and L2 analysts through structured mentoring and coaching so knowledge isnt concentrated in one person.
Contribute to the Cyber practice beyond your engagement feed detection content runbooks and lessons learned back into shared practice resources; contribute to analyst assessment and hiring; and engage with public-sector security communities including NCSC CISP and relevant ISACs.

Skills Knowledge & Expertise

Were looking for someone who holds one of the following or an equivalent senior cyber operations leadership credential:

Certified Information Systems Security Professional (CISSP)
Certified Information Security Manager (CISM)
CompTIA Advanced Security Practitioner (CASP)
Experience leading detection engineering in a SOC or similar environment including writing and tuning detections in KQL SPL EQL or Sigma and managing coverage against MITRE ATT&CK
Experience designing or improving a log and telemetry pipeline including application-level telemetry from cloud-hosted services (AWS is a strong preference at this grade) with an understanding of how to design monitoring for failure modes and degraded states
Evidence of running the intelligence cycle as a managed discipline collection planning production and feedback rather than consuming finished intelligence
Working knowledge of UK government security standards and frameworks including NCSC CAF Objective C GovAssure and OFFICIAL handling requirements
Experience establishing incident response practice playbooks severity models and exercises not just responding to individual incidents
Evidence of growing the technical capability of less experienced analysts through pairing structured mentoring or coaching including setting clear goals and tracking progress over time
Experience anchoring delivery on client outcomes rather than task completion challenging the brief where it serves the client and making value visible rather than reporting effort
Evidence of contributing reusable assets detection playbooks runbooks templates or accelerators back into a practice or community rather than leaving knowledge within a single team

Tools and practices

Familiarity with SOAR tooling and automation of triage and enrichment workflows
Experience working in Kanban-led operating models including managing triage queues WIP limits and class-of-service for incidents
Experience running or contributing to skills-based technical assessments that evaluate demonstrated capability rather than credentials or years of experience

Made Tech sponsors attainment of recognised cyber certifications for staff in scope. If you dont yet hold the essential credentials listed above but are working toward them or can demonstrate equivalent capability through your experience wed still like to hear from you.

Job Benefits

We are always listening to our growing teams and evolving the benefits available to our people. As we scale as do our benefits and we are scaling quickly. Weve recently introduced a flexible benefit platform which includes a Smart Tech scheme Cycle to work scheme and an individual benefits allowance which you can invest in a Health care cash plan or Pension plan. Were also big on connection and have an optional social and wellbeing calendar of events for all employees to join should they choose to.

Here are some of our most popular benefits listed below:

30 days Holiday - we offer 30 days of paid annual leave

Flexible Working Hours - we are flexible with what hours you work

Flexible Parental Leave - we offer flexible parental leave options

Remote Working - we offer part time remote working for all our staff

Paid counselling - we offer paid counselling as well as financial and legal advice

At this point we hope youre feeling excited about Made Tech and the job opportunity. Get in touch with our talent team if youd like an informal chat about the role and your suitability before applying. We are hiring for this role directly so will not respond to any CVs sent via external recruitment agencies.

SC Eligibility

An increasing number of our customers are specifying a minimum of SC (security check) clearance in order to work on their projects. As a result were looking for all successful candidates for this role to have eligibility.

Eligibility for SC requires 5 years UK residency and 5 year employment history (or back to full-time education). Please note that if at any point during the interview process it is apparent that you may not be eligible for SC we wont be able to progress your application and we will contact you to let you know why.

Support in applying

If you need this job description in another format or other support in applying please email .

We believe we can use tech to make public services better. We also believe this can happen best when our own team represents the society that actually uses the services we work on. Were collectively continuing to grow a culture that is happy healthy safe and inspiring for people of all backgrounds and experiences so we encourage people from underrepresented groups to apply for roles with us.

When you apply well put you in touch with a member of our talent team who can help with any needs or adjustments we may need to make to help with your application. Weve put together this blog as a resource to share more about reasonable adjustments and some examples of what this could include. We also welcome any feedback on how we can improve the experience for future candidates.

Required Experience:

Key Responsibilities

Set the detection engineering standard author tune and peer-review detections in KQL SPL EQL or Sigma; manage the false-positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves.
Own the threat-landscape narrative for your engagement turn intelligence from NCSC advisories sector feeds and threat actor reporting into hunt themes coverage gap analysis and detection priorities that the SOC and client stakeholders can act on.
Run the intelligence cycle as a managed discipline maintain a collection plan produce timely and rigorous intelligence products and build feedback loops that keep the cycle honest and improving.
Establish and lead security incident response practice build playbooks define the severity model run exercises and lead the teams response to significant incidents; run blameless post-mortems that the team actually learns from.
Design the log and telemetry pipeline that detections run on including bespoke application telemetry in cloud environments not just commodity endpoint feeds; ensure the right signals are collected parsed and retained for both detection and investigation.
Be the trusted technical interface for client security stakeholders communicate what the SOC is detecting investigating and covering without losing fidelity; surface risks early and honestly and align the teams priorities to the clients risk picture.
Grow the analysts around you pair on detection authorship and incident response as a default set pairing as the team norm and actively build the capability of L1 and L2 analysts through structured mentoring and coaching so knowledge isnt concentrated in one person.
Contribute to the Cyber practice beyond your engagement feed detection content runbooks and lessons learned back into shared practice resources; contribute to analyst assessment and hiring; and engage with public-sector security communities including NCSC CISP and relevant ISACs.

Skills Knowledge & Expertise

Were looking for someone who holds one of the following or an equivalent senior cyber operations leadership credential:

Certified Information Systems Security Professional (CISSP)
Certified Information Security Manager (CISM)
CompTIA Advanced Security Practitioner (CASP)
Experience leading detection engineering in a SOC or similar environment including writing and tuning detections in KQL SPL EQL or Sigma and managing coverage against MITRE ATT&CK
Experience designing or improving a log and telemetry pipeline including application-level telemetry from cloud-hosted services (AWS is a strong preference at this grade) with an understanding of how to design monitoring for failure modes and degraded states
Evidence of running the intelligence cycle as a managed discipline collection planning production and feedback rather than consuming finished intelligence
Working knowledge of UK government security standards and frameworks including NCSC CAF Objective C GovAssure and OFFICIAL handling requirements
Experience establishing incident response practice playbooks severity models and exercises not just responding to individual incidents
Evidence of growing the technical capability of less experienced analysts through pairing structured mentoring or coaching including setting clear goals and tracking progress over time
Experience anchoring delivery on client outcomes rather than task completion challenging the brief where it serves the client and making value visible rather than reporting effort
Evidence of contributing reusable assets detection playbooks runbooks templates or accelerators back into a practice or community rather than leaving knowledge within a single team

Tools and practices

Familiarity with SOAR tooling and automation of triage and enrichment workflows
Experience working in Kanban-led operating models including managing triage queues WIP limits and class-of-service for incidents
Experience running or contributing to skills-based technical assessments that evaluate demonstrated capability rather than credentials or years of experience