SOC Analyst

About Ekco🚀 Founded in 2016, Ekco has quickly become one of Europe’s fastest-growing cloud solution providers and your trusted security-first Managed Service Provider. IT leaders choose Ekco to drive operational efficiency, scale smarter and stay ahead of risk – powered by local expertise, delivered at European scale.We specialise in helping organisations advance their cloud maturity guiding transformation, strengthening security, and maximising the value of their technology investments.☁️ In simple terms: we help organisations modernise with confidence securing their systems, optimising their cloud, and keeping them resilient in a rapidly changing world.🌍 Today, we’re a thriving team of 1,000+ talented and supportive colleagues across the UK, Ireland, Benelux, South Africa, and Malaysia—and we’re continuing to grow.At Ekco, how we work matters as much as what we deliver. Our people live by four core values that shape everything we do:On It: We take ownership, follow through, and get things done.All In: We collaborate, support each other, and commit fully to shared goals.Connected: We build trusted relationships with colleagues, clients, and partners.Hungry to Grow: We stay curious, keep learning, and push ourselves to the next level.🏠If these values resonate with you, you’ll feel right at home here.The RoleReporting to the Security Operations Lead, you will investigate and respond to security incidents across our clients’ endpoint, identity, email and cloud environments.You will use Microsoft Defender XDR, Microsoft Sentinel and other security platforms to establish what happened, assess the scope and impact, and take or recommend proportionate action.We are looking for an analyst who can follow the evidence beyond the initial alert, explain their reasoning and produce investigations that colleagues and clients can trust. You will own routine investigations through to a justified outcome, recognising when to involve senior analysts or Incident Response.This role supports our 24/7 SOC and requires flexibility to work rotating 12-hour shiftsDay-to-day your role will involve:Triage and investigate SIEM, EDR and XDR alerts, prioritising by severity, business impact, spread and urgency, and working within agreed SLAs.Correlate endpoint activity, identity events, email evidence and other available logs. Build a timeline and determine which users, devices and services may be affected.Distinguish benign activity, unsuccessful or blocked attacks, and successful compromise. Check for earlier execution, persistence and related activity before concluding that a threat has been contained.Take or coordinate response actions within agreed client authority and SOC procedures, including device isolation, account containment and email remediation. Verify and record the outcome.Escalate urgent or complex incidents promptly with the evidence, actions taken, outstanding risks and support required. Maintain clear ownership and shift handovers.Communicate clearly with clients by ticket, email and phone, explaining what is known, what remains uncertain, what has been done and what is needed next.Reporting common and repeat problems (trend analysis) to management and propose process and technical improvements. Providing cover in line with rotating shift patterns. You should be flexible to rotating 12-hour shifts. We provide 24/7 cover to clients and shifts are allocated accordingly. Essential practical skillsYou have practical experience investigating security alerts and can demonstrate the following capabilities.Endpoint investigationNavigate a process tree in Microsoft Defender for Endpoint. Explain parent and child relationships, follow the execution chain, and assess command lines, file paths, timestamps and the user context.Recognise expected Windows processes and directory locations, and investigate unusual behaviour such as Office launching PowerShell, renamed executables, execution from temporary folders, persistence or misuse of remote access tools.Confidence using OSINT to correlate attacks with execution chains or attack patterns seen within investigations.Pivot from an alert into the device timeline, files, hashes, users and network connections to establish what ran, what it did and whether related activity exists elsewhere.Identity and Active DirectoryHave hands-on experience investigating Microsoft Defender for Identity alerts. Review the affected accounts, source and destination systems, activity timelines and supporting authentication evidence.Understand Active Directory users, groups, privileges, domain controllers and the basics of Kerberos and NTLM. Recognise the intent and evidence behind password spraying, reconnaissance, Kerberoasting, credential theft and lateral movement.Have completed Microsoft Defender for Identity Ninja training or equivalent practical Active Directory security training and be able to apply that learning to an investigation.Good understanding of Microsoft Entra ID interactive and non-interactive sign-in and audit logs, including IP addresses, devices, applications, authentication outcomes and MFA changes. Assess suspicious access in context rather than relying on location alone.Awareness of Microsoft Graph Activity logs and when they may be useful.Email and business email compromiseConfidently investigate phishing and suspected business email compromise using Defender for Office 365 and Microsoft 365 evidence. Review email headers, sender and reply-to addresses, URLs, attachments, message trace and user interaction.Know where to look for malicious inbox rules, external forwarding, deleted or hidden messages, unusual mailbox access, sent emails, delegate changes and suspicious application consent. Correlate mailbox activity with sign-in and audit logs to assess scope and recommend containment.Queries and analytical judgementWrite and adapt KQL queries in Microsoft Sentinel and Defender Advanced Hunting to filter by time and entity, correlate events and test an investigation hypothesis. Explain what the query and results show.Understand Microsoft Defender for Endpoint tables and the types of data they contain. Recognise when missing telemetry limits a conclusion.Validate automated investigation results and AI-generated summaries against source evidence. Remain accountable for the verdict and response and use approved tools appropriately.About You You take ownership, challenge assumptions and ask for help when needed.You keep your knowledge current through practical training and lessons learned from investigations.Excellent written and verbal communication skills. You should be able to communicate technical details clearly.A proactive approach to addressing issues and requests and the ability to multitask.A desire to learn new technologies and concepts quickly.Great organisational skills and attention to detail.Adaptability to do a range of work including the occasional task that may fall out of line with the core day-to-day.Desirable: Prior experience in an MSSP environment or a multi-tenant environment.Prior experience working with SIEM and EDR – E.g. SentinelOne, Microsoft security stack (Defender, Sentinel), Carbon Black, Rapid7 IDR, CrowdStrike, QRadar Industry recognised certifications – E.g. CompTIA Security+, CySA+, Microsoft SC-200, BTL1/2.Alert tuning or detection engineering experience within a test/production environment.Benefits / Perks• 📞 Employee Assistance Programme (EAP) for wellbeing support • 🏃‍♀️ EkcOlympics: Global team activity challenges • 📚 Unlimited access to Pluralsight for continuous development • 🌱 Real opportunities to grow, including international progressionWhy Ekco• ⭐️ Microsoft’s 2023 Rising Star Security Partner of the Year • 🚀 First Irish Microsoft MSP to achieve all four Microsoft Security Specializations • 🏅 Ranked 4th fastest-growing technology company in the Deloitte Fast50 Awards • 🌈 A culture rooted in diversity, equality, inclusion & belonging • 🎉 A commitment to internal mobility and career progression • ✨ Flexible, family-friendly working at the heart of our culture • 🔐 Proud to be your trusted security-first Managed Service Provider chosen by IT leaders to drive operational efficiency, scale smarter and stay ahead of risk.