SOC Lead

NCC Group is hiring an SOC Lead. Level rates it ; you can apply on NCC Group.

Level's read on this job

On Level's scale, this role is Little AI ●○○○: aI is not part of the work.
Tools and skills the posting cites include Splunk, Splunk Enterprise Security and incident response.
Level classifies it as a lead role.
Level lists 89 other open roles at NCC Group.

AI in this role

Lead SOC operations, threat hunting, and incident response using Splunk Enterprise Security.

SplunkSplunk Enterprise Security

incident-responsesocthreat-huntingcybersecuritysiem

We are seeking an experienced Lead SOC Analyst to oversee Security Operations Centre (SOC) activities, lead incident response efforts, and mentor a team of analysts. The successful candidate will have strong expertise in cyber threat detection, incident investigation, and the Splunk Enterprise Security (ES) platform.

Key Responsibilities

Lead day-to-day SOC operations and provide technical guidance to SOC Analysts.
Monitor, investigate, and respond to security incidents and alerts.
Develop, optimise, and maintain Splunk Enterprise Security use cases, correlation searches, dashboards, and reports.
Conduct threat hunting and advanced forensic investigations.
Coordinate incident response activities and provide detailed post-incident analysis.
Collaborate with IT, security, and business stakeholders to improve security posture.
Support SOC processes, playbooks, and continuous improvement initiatives.

Skills, Knowledge and Expertise

Extensive experience working in a SOC, Cyber Security, or Incident Response role.
Strong hands-on experience with Splunk Enterprise Security.
Experience leading security investigations and major incident response activities.
Knowledge of MITRE ATT&CK, SIEM technologies, threat intelligence, and security best practices.
Relevant certifications such as Splunk Certified Cybersecurity Defence Analyst, CISSP, GCIA, GCIH, or equivalent are desirable.

How we rate this

SOC Lead at NCC Group rates 0 out of 100 for how much of the daily work is AI. That makes it Little AI (AI Level 1 of 4). The level is about AI in the job, not seniority.

Classification

Little AI. AI is not part of the work.

●●●● Builds AI80 to 100
●●●○ Works on AI60 to 79
●●○○ Uses AI40 to 59
●○○○ Little AI0 to 39

Levels come from how often the tools, models and workflows of the role are named in the posting itself. Read the description and count the AI tools, models and workflows it names.

Key facts

SOC Lead is an open job at NCC Group.
Level rates this role AI Level 1 of 4: Little AI.
The role is based in Remote, Greater London.
The job was posted on October 1, 2026.
Seniority: lead.
Applications are handled by NCC Group. Apply on NCC Group

Prepare for this job

Built from this posting and from similar jobs on Level.

Skills and AI tools this role asks for

Incident ResponseSocThreat HuntingCybersecuritySIEMSplunkSplunk Enterprise Security

Questions you could be asked

Tell me about a project where incident response was part of your work. What did you do?
Tell me about a project where soc was part of your work. What did you do?
Tell me about a project where threat hunting was part of your work. What did you do?
Tell me about a project where cybersecurity was part of your work. What did you do?
Tell me about a project where siem was part of your work. What did you do?

Adapt your resume

List these exact terms on your resume: Incident Response, Soc, Threat Hunting, Cybersecurity, and SIEM. An applicant tracking system matches the wording, not the idea.
Attach one line of real, concrete experience to at least one of them. A tool named with nothing behind it rarely survives a human read.

Get your CV reviewed before you apply

Send your CV and the role you want next. Your review arrives by email within 3 days.

Get a free CV review Check your resume with the ATS resume checker