Security Operations day rates in the UK
A Security Operations day rate is the headline price of a fixed-term contract, not a salary and not your take-home. For the SOC and the detection engineering that makes an alert worth waking someone for, clients in the UK currently advertise mostly between £500 and £900 a day.
Updated 1 November 20264 min read
What a Security Operations day rate includes
The number in the advert is what the client or the agency is offering per day. It is not your pay. Outside IR35, you still have corporation tax, salary, dividends and expenses to decide. Inside IR35, umbrella or PAYE deductions come off before anything reaches you. The same £700 day reads very differently on the two sides.
Security Operations sits in cyber security. Regulated firms, government, and any board that has just had a finding it cannot leave until next year set the market, and they do not all pay the top of the band. A rate at the top usually means a scarce combination, a cleared site, or a client who has already lost a month looking.
A working band, not a promise
Advertised Security Operations day rates commonly sit between £500 and £900. That is the headline number, before tax, umbrella margin or the costs of a limited company. Geography still moves it. London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh are where these contracts cluster, and London sits at the top of most bands. The rate on a specific advert is on the board when the recruiter published one. Where they wrote "competitive" instead, the role is harder to compare and usually not in a hurry to tell you.
If a Security Operations advert has no rate, treat that as information. Roles with a published day rate are easier to compare and, on this board, sort to the top of the day. Live Security Operations contracts show the current numbers beside the IR35 status.
Inside IR35 against outside
An inside Security Operations contract needs a higher headline to match the take-home of an outside one. As a rule of thumb the gap is about 20 to 25 percent, and it moves with the exact rate, your salary mix and the tax year. Do not do it in your head. Use the IR35 calculator on the rate you have actually been offered.
Security Operations contracts are genuinely mixed. Product companies and smaller clients more often advertise outside IR35. Large programmes, and anything with a body-shop agency in the chain, more often advertise inside. Treat "outside" as a claim to check, not as a promise, and price an inside offer against take-home rather than against the headline.
How to read an offer
Compare the offer with the band, then with the live rows, then with take-home. A £500 outside rate can beat a number that looks larger on an inside contract. Expenses, the length of the booking and whether you can overlap a notice period all belong in the same conversation.
Security Operations contract jobs covers who is hiring. Security Operations outside IR35 jobs covers the status. Wider benchmarks are on day rates by skill.
Live roles on the board
These Security Operations contracts are on the board now. The day rate and IR35 status are public. The link to the original advert is for members.
- Java Developer - eDV Clearance — Cheltenham, Gloucestershire, £600-£650/day
- Platform Engineer — London, £526-£629/day Inside
- SOC Analysts (DV Security Clearance) — London
- Security Operations Analyst (SOC analyst) — London
See live Security Operations rates · Membership unlocks apply links and the first 48 hours