SOC Analyst

Job Description:

At DXC Technology, delivering excellence for our customers and colleagues is more than just a motto, it’s something we strive towards constantly through our work. Every day we deliver mission critical services in a secure environment whilst promoting our people first agenda, a real sense of community and a healthy work-life balance. Our consistently positive customer feedback and continuous growth helps us cement our place as one of the world’s leading IT solutions enterprises, helping us deliver services and solutions in both challenging and exciting situations.

At DXC, we have opportunities for SOC Analysts at all varying skill levels to join the DXC Cyber Threat Analysis Centre (CTAC), in this role you will be responsible for advancing the initial work conducted by Tier 1 Analysts and providing more in-depth analysis of potential threats to the organization. This role is crucial in the escalated investigation, triage, and response to cyber incidents. The Tier 2 Analyst works closely with senior and junior analysts to ensure a seamless SOC operation and acts as a bridge between foundational and advanced threat detection and response functions.

Due to the customer requirements successful applicants must be eligible for high level UK Security clearance, SC and be able to work onsite in Aldershot

Responsibilities:

• Conduct escalated triage and analysis on security events identified by Tier 1 Analysts, determining threat severity and advising on initial response actions.
• Apply expertise in SIEM solutions utilizing Kusto Query Language (KQL), to perform log analysis, event correlation, and thorough documentation of security incidents.
• Identify and escalate critical threats to Tier 3 Analysts with detailed analysis for further action, ensuring rapid response and adherence to service Tier objectives (SLOs).
• Investigate potential security incidents by conducting deeper analysis on correlated events and identifying patterns or anomalies that may indicate suspicious or malicious activity.
• Use OSINT (Open-Source Intelligence) to enrich contextual data and enhance detection capabilities, contributing to a proactive stance on emerging threats.
• Monitor the threat landscape and document findings on evolving threat vectors, sharing relevant insights with CTAC teams to enhance overall situational awareness.
• Follow established incident response playbooks, providing feedback for enhancements and suggesting updates to streamline CTAC processes and improve threat response times.
• Coordinate with Tier 3 Analysts and management to refine detection and response workflows, contributing to continuous SOC maturity.
• Collaborate with Tier 3 Analysts on tuning SIEM and detection tools to reduce false positives and improve alert fidelity, submitting tuning requests and testing configurations when necessary.
• Identify gaps in current detection content and work with Senior Analysts to develop and validate new detection rules and use cases tailored to the organization’s threat profile.
• Act as a mentor to Tier 1 Analysts, offering guidance on triage and analysis techniques and facilitating on-the-job training to elevate their technical skills and operational efficiency.
• Assist in training sessions and knowledge-sharing activities, providing feedback on areas for growth and contributing to a supportive learning environment within the SOC.

Knowledge and Skills

• Understands advanced networking concepts, including IP addressing, basic network protocols, and how traffic flows within a network.
• Advanced knowledge of Windows and Linux operating environments, including standard commands, file systems, and user authentication mechanisms.
• Competence in using SIEM solutions (e.g., ArcSight, Azure Sentinel) for monitoring and log analysis; some exposure to additional analysis tools such as basic XDR platforms.
• Able to demonstrate proficient knowledge using Kusto Query Language (KQL) to search and filter logs effectively.
• Familiar with open-source intelligence (OSINT) techniques to aid in identifying potential threats and gathering information.
• Able to communicate clearly and efficiently with team members and stakeholders, both internally and externally, under direction from senior analysts.
• Can communicate simple technical issues to non-technical individuals in a clear and understandable way.
• Able to create concise, structured reports that outline findings from preliminary investigations and daily monitoring activities.
• Able to manage personal workload effectively to ensure timely completion of assigned tasks within the SOC.
• Willing to collaborate with team members, accepting guidance and learning from more experienced analysts.
• Shows initiative in learning new technologies and techniques, leveraging internal resources and training to grow professionally.
• Able to function efficiently during high-pressure situations, following procedures to ensure consistent performance in incident management.

What we will do for you:

• Competitive compensation
• Pension scheme
• DXC Select – Our comprehensive benefits package (includes private health/medical insurance, gym membership and more)
• Perks at Work (discounts on technology, groceries, travel and more)
• DXC incentives (recognition tools, employee lunches, regular social events etc)

Recruitment fraud is a scheme in which fictitious job opportunities are offered to job seekers typically through online services, such as false websites, or through unsolicited emails claiming to be from the company. These emails may request recipients to provide personal information or to make payments as part of their illegitimate recruiting process. DXC does not make offers of employment via social media networks and DXC never asks for any money or payments from applicants at any point in the recruitment process, nor ask a job seeker to purchase IT or other equipment on our behalf. More information on employment scams is available here.