SOC Analyst contract jobs: rates and IR35
A SOC Analyst contractor is hired for a fixed term, almost always against a day rate rather than a salary. The work is triage of security alerts, and the shift pattern that comes with a live operation. This page is the market around that skill: who hires, what the day rate looks like, how IR35 tends to fall, and the live contracts on IR35 Jobs.
Updated 1 November 20264 min read
What a SOC Analyst contract is
A SOC Analyst contractor is hired for a fixed term, almost always against a day rate rather than a salary. Clients hire for triage of security alerts, and the shift pattern that comes with a live operation. The contract is usually three to six months with an extension if the work continues, and the advert should say whether it is outside IR35, inside IR35, or silent. Silent is common, and it is not the same thing as outside.
You are not an employee of the client. Even on an inside IR35 contract the legal shape is still a contract, paid by an umbrella or by agency PAYE. On an outside contract you invoice through your own company. The IR35 calculator shows the take-home difference on any day rate you are offered.
Who is hiring
Regulated firms, government, and any board that has just had a finding it cannot leave until next year are the clients behind most SOC Analyst adverts. Agencies still post the majority of contract roles in the UK, so the name on the row is often the recruiter, not the end client. The skill and the IR35 line tell you more than the agency brand.
Demand moves with programmes, not with the calendar. A quiet week on SOC Analyst is not a dead market. New contracts are added every hour, and the ones from the last 48 hours are visible to members first because that is when they get filled.
SOC Analyst day rates
Advertised SOC Analyst day rates commonly sit between £500 and £900. That is the headline number, before tax, umbrella margin or the costs of a limited company. Work clusters in London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. The rate on a specific advert is on the board when the recruiter published one. Where they wrote "competitive" instead, the role is harder to compare and usually not in a hurry to tell you.
A higher inside IR35 rate can be worth less than a lower outside one. Run both numbers before you negotiate, and read the SOC Analyst day rate guide for how to compare them. Benchmarks across skills are on UK contractor day rates.
IR35 on these contracts
SOC Analyst contracts are genuinely mixed. Product companies and smaller clients more often advertise outside IR35. Large programmes, and anything with a body-shop agency in the chain, more often advertise inside. Treat "outside" as a claim to check, not as a promise, and price an inside offer against take-home rather than against the headline.
SOC Analyst outside IR35 jobs collects the point in one place. The live filter is outside IR35 jobs across every skill, and inside IR35 jobs for the other column. We report the status the advert states. We do not decide it, and neither does a keyword.
Where the work is
SOC Analyst contracts turn up most often in London, Manchester, Cheltenham-adjacent remote roles, Bristol and Edinburgh. A city on the advert is not always a daily commute. Hybrid is the default pitch, and a role marked remote should say so rather than implying it.
Use the board's location and radius filters once you are a member. Free browsing shows the delayed board. The link through to the original advert, on every SOC Analyst job, is part of membership and the 14-day pass.
Live roles on the board
These SOC Analyst contracts are on the board now. The day rate and IR35 status are public. The link to the original advert is for members.
- SOC Analyst Level 2 — Manchester
- Cyber Security Analyst (SOC Analyst).*6 Week... — Edinburgh, Midlothian, United Kingdom
- Information Security Analyst (Remote in the UK) — Cheltenham
- Snr. Information Security Analyst(Remote) — Cheltenham
- SOC Analyst — Glasgow
- Cyber Security Analyst — The City, City of London (EC3), EC3N 1AH, £400-£450/day
- Senior Cyber Security Analyst — Glasgow
- Cyber Security Analyst — London, £400-£450/day
See live SOC Analyst contracts · Membership unlocks apply links and the first 48 hours