01Overview
The Lead SOC Analyst is a senior member of the Incident Response & Investigations team within the Operational Security function of KPMG Group Digital.
This role provides advanced technical expertise in detection, investigation, and response to cybersecurity incidents. Operating at Grade D, the Lead SOC Analyst acts as a senior escalation point within the SOC, handling complex and highseverity incidents, supporting junior analysts during investigations, and contributing to the effective daytoday operation of SOC processes and tooling.
The role is handson and technically focused, with responsibility for the quality and accuracy of investigations performed, rather than formal people or operational management.
Incident Response & Investigation:
Perform triage, investigation, containment, and remediation activities for complex and highseverity cybersecurity incidents.
Act as a senior technical escalation point during incident handling, providing guidance and direction to analysts as required.
Participate in incident bridges, contributing transparent technical updates and investigative findings.
Conduct forensic data collection and analysis across endpoints, network, cloud, and identity sources.
Produce accurate and wellstructured incident timelines, investigation notes, and postincident summaries.
Support postincident reviews by contributing technical insights and lessons learned.
Detection & Threat Monitoring:
Review and investigate alerts generated from SIEM, EDR, cloud security, and identity platforms.
Support the tuning and refinement of detection rules to improve alert quality and reduce false positives.
Conduct threathunting activities under defined hypotheses, using available telemetry and analytical techniques.
Identify gaps in visibility or logging and raise these with senior analysts or engineering teams.
SOC Tooling & Automation Support:
Use SOC tooling effectively to support investigations and response activities.
C .
