SOC Level 2 Security Analyst, NTT DATA
Digital transformation consulting and services
Be an early applicant
Digital transformation consulting and services
1001+ employees
Be an early applicant
1001+ employees
Company mission
To leverage information technology to create new paradigms and values, which help contribute to a more affluent and harmonious society.
Role
Who you are
- You will have hands‑on experience working with SIEM platforms such as Splunk, Microsoft Sentinel, or QRadar, and a strong understanding of incident response workflows and escalation management
- You will be comfortable analysing security telemetry, understanding attacker behaviour, and applying log‑ and artefact‑based investigation techniques
- You will demonstrate strong analytical thinking, sound decision‑making, and the ability to remain effective during high‑pressure incidents
- Clear, professional communication—both written and verbal—is essential, as is the ability to work independently while following and improving structured operational processes
- 2–4 years’ experience in the IT security industry, ideally within a SOC or NOC environment, including experience operating at SOC L1 level
- Relevant cybersecurity certifications desirable (eg GIAC, CySA+, SC‑200)
- Experience working with cloud platforms such as Microsoft Azure and/or AWS
- Proficiency with Microsoft Office tools, particularly Excel and Word
- Eligibility for, or holding, UK SC Clearance
- Willingness to work within a 24/7 shift‑based SOC environment, including on‑call duties
What the job involves
- The SOC Analyst (L2) plays a critical role in the detection, investigation, and management of security alerts and incidents escalated from SOC Analyst (L1) teams
- The position focuses on in‑depth analysis, incident validation, tactical response coordination, and continuous improvement of security monitoring and response capabilities
- Operating within a 24/7 Security Operations Centre, the L2 Analyst serves as a technical escalation point for junior analysts, working closely with internal IT and security teams as well as customers to contain and remediate security incidents
- The role contributes directly to improving detection quality, response efficiency, and the overall effectiveness of SOC operations
- You will investigate security alerts and events escalated from Level 1 analysts, validating and classifying activity to determine whether it represents a confirmed security incident
- This includes performing detailed analysis to understand root cause, scope, impact, and attacker behaviour using SIEM platforms and supporting telemetry
- You will coordinate and support incident response activities in line with defined SOC and customer processes, assisting with containment, eradication, and recovery actions
- During high‑severity or customer‑impacting incidents, you will follow major incident procedures and ensure timely, accurate escalation to stakeholders
- You will provide technical guidance to L1 analysts during live incidents and help maintain investigation quality under pressure
- You will execute defined SOAR playbooks as part of incident response and provide structured feedback to improve automation, response consistency, and efficiency
- You will maintain awareness of SOC performance metrics and service levels, such as MTTD and MTTR, and actively contribute to improving investigation quality and response outcomes
- You will apply threat intelligence to investigations and alert triage, maintaining awareness of emerging threats, vulnerabilities, and attacker techniques
- Incident learnings and threat insights will be fed back into detection logic to continuously enhance SOC monitoring capabilities
- You will also contribute to the development and tuning of SOC detection use cases, ensuring alerting remains relevant, effective, and aligned to current threat activity
- This includes supporting onboarding of new services, identifying detection gaps, and recommending improvements to tooling, processes, and coverage
- Clear and accurate documentation is a key part of the role
- You will maintain investigation records, runbooks, and playbooks, produce post‑incident reports for customers and internal stakeholders, and contribute to operational and service reporting
- You will help document and implement improvements to event and incident management processes
- Collaboration is essential
- You will work closely with IT, security, and technical teams to resolve incidents and reduce risk, act as a mentor and escalation point for L1 analysts, and support continual service improvement by identifying recurring issues and proposing corrective actions
Our take
Nowadays, large organisations still struggle to keep up digitisation. Attracting future investment and ensuring growth is more than a matter of purchasing new tools. It involves a fundamental change in ways of working and company culture that few organisations have the expertise to achieve on their own.
The UK and Ireland arm of NTT Data, a global digital transformation consultancy and services firm, exists to support businesses and government organisations through this seismic change. It faces major competition from the likes of Deloitte, Accenture and IBM's consulting arm. That said, the company brings significant expertise in UK telecommunications, financial services and the British public sector - giving it an edge in this market.
NTT Data UK&I cited ambitious plans for the digital transformation market in the UK. To achieve them, it has formed strategic partnerships with infrastructure providers such as Google Cloud. In 2025, NTT Data was taken private by its parent company in order to expand its Global Data Centers division, which will enable yet more expansion in high-demand markets.
Steph
Company Specialist at Welcome to the Jungle
Insights
6% employee growth in 12 months
Company
Company benefits
- A people focused business
- Excellent opportunities to grow your career, including an online training platform with 3000+ courses, accessible from everywhere, to sharpen your skills
- A varied client base
Company HQ
London, UK
Leadership
Niccolo Spataro
(CEO (NTT DATA UK&I))Joined NTT DATA in 2016 and has been CEO of its UK&I operations since 2024. Has a range of experience from General Manager, Multi-channel Sales Management, Marketing and Services Sales and Delivery
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 40 more jobs at NTT DATA