Senior SOC Analyst

About Ekco 

🚀 Founded in 2016 Ekco is now one of the fastest growing cloud solution providers in Europe!  

We specialise in enabling companies to progress along the path of cloud maturity, managing transformation and driving better outcomes from our clients’ existing technology investments.  

☁️ In a few words, we take businesses to the cloud and back!  

🌍 We have over 1000 highly talented and supportive colleagues (and counting) across a number of regional offices in the UK, Benelux & Ireland.  

About the Role 

Reporting to the regional Head of SOC, the role of the Senior SOC Analyst is to apply the understanding of investigative techniques and analytical skills, to defend against and respond to cybersecurity events and incidents in our client’s IT environments.

You will support clients by ensuring they remain secure, researching new vulnerabilities and assisting with the mitigation of any potential attacks. You will work as part of a team to deliver monitoring and protection in both a reactive and proactive manner. You will also be responsible for rolling out security tools including creating documentation.

SOC Analysts at Ekco are operationally focussed; they configure, secure, and monitor systems, using advanced toolsets, to prevent security breaches and to respond to incidents as they arise.

Day to day your role will involve:

• ​​Performing advanced real-time SIEM analysis and correlation of logs/alerts from a multitude of client devices.  
• ​Determining if events escalated by the SOC analyst team constitute security incidents, and if they do, you will analyse the incident and escalate with the customer when further investigation or a resolution is needed. 
• ​You’ll work with our security engineers to develop and tune SIEM rules. 
• ​You will identify and implement parsing configuration as required to optimise log source configuration, aiding investigation efforts.  
• ​Analysing and assessing security incidents, performing in depth root cause analyses and advancing to client resources or collaborating with internal teams for additional assistance  
• ​Acting as subject matter expert, investigating security events forwarded from clients. 
• ​Act as lead investigator for incident response engagements as required, in the absence of a SOC Principal. 
• ​Act as a key contributor to SOC continuous improvement criteria as required, identifying gaps in existing processes, proposing and documenting working solutions to close gaps. 
• ​Develop, document, and deliver training material for the SOC Analyst team, providing granular instructions for SOC processes and processes. 
• ​Primary responsibility for the creation of custom, ad hoc and monthly reporting solutions for SOC customers as required. 
• ​Perform quality control on all types of SOC Reporting
• ​Providing cover in line with rotating shift patterns. You should be flexible to rotating 8, 10 or 12 hour shifts. We provide 24/7 cover to clients and shifts are allocated accordingly 
• ​Responding to inbound requests via phone and other electronic means for technical assistance.  
• ​Performing other duties as assigned by SOC Leadership

About You

• Have a minimum of 2 years experience working in a SOC environment
• Working knowledge in the following areas:
  • Unix, Linux, Windows, etc. operating systems
  • MITRE ATT&CK Framework
  • Exploits, vulnerabilities, network attacks
  • Networking concepts / understanding of networking protocols.
  • Packet analysis tools (tcpdump, Wireshark, ngrep, etc.)
• Keen problem solving / troubleshooting skills
• Strong analytical skills and a logical approach to resolving issues
• Act as an escalation point to junior members of staff, not limited to tickets
• A can-do attitude
• Excellent written and verbal communication skills. You should be able to communicate technical details clearly at all levels.
• The ability to adjust and adapt to changing priorities in a dynamic environment
• A pro-active approach to addressing issues and requests and the ability to multitask
• The ability to learn new technologies and concepts quickly
• Great organisational skills and attention to detail
• Adaptability to do a range of work, including the complex, non-routine, mundane and multi-environment
• Able to work under direction, use discretion and determine when to escalate issues
• Effective communication, teamwork and task-time management skills

Bonus Points if you have

• Prior experience working with one or more of the following SIEM or EDR tools – E.g. IBM QRadar, Sentinel, Rapid7, Defender for Endpoint, SentinelOne, Carbon Black, Sophos
• Possess one or more of the following Industry recognized certifications – E.g. CompTIA Security+, CySA+, Microsoft SC-200, SBT L1 etc.

Benefits/Perks 

• ☀️ Time off - 25 days leave + public holidays  
• 🎂 x1 day Birthday leave per year  
• 💰 Company Pension Scheme (employer contribution 5%) + flexible salary sacrifice  
• 📞 Employee Assistance Programme (EAP) - access to dedicated mental health, emotional wellbeing and general advice  
• 🏃‍♀️ EkcOlympics - a global activity for fun!  
• 📚 Learning & development - Unlimited access to Udemy learning platform  

• 🌱 A lot of responsibilities & opportunities to grow (also internationally)  

Why Ekco 

• ⭐️ Microsoft’s 2023 Rising Star Security Partner of the year  
• 🚀 VMware & Veeam top partner status  
• 🏅 Ranked as 4th fastest growing technology company in the Deloitte Fast50 Awards  
• 🌈Ekco are committed to cultivating an environment that promotes diversity, equality, inclusion and belonging  
• 🎉 We recognise the value of internal mobility and encourage opportunities for internal development & progression  
• ✨ Flexible working with a family friendly focus are at the core of our company values