Cyber Security Jobs

• Harrow
• Remote
• Senior
• Permanent

Hands-on architect role at an Elastic partner, designing SOC and SIEM architectures on Elastic/ELK for UK Defence and NATO clients. You own the architecture with the client and stay close to delivery, supporting greenfield builds and recovering existing environments alongside a team of 30+ SMEs, mostly working remotely with occasional client-site visits.

Elastic · ELK · Elasticsearch +4

• London
• Hybrid · 1 day in office
• £90,000 – £120,000 pa
• Lead · manages people
• Permanent

Lead platform engineering engagements for a cloud consultancy's enterprise clients, from early solution design through delivery. Set technical direction, mentor platform engineers and consultants, and define reusable standards and patterns across AWS, Kubernetes, Terraform and CI/CD. Combines hands-on engineering, architecture and pre-sales consultancy.

AWS · Azure · GCP +7

• London
• Hybrid
• Mid-level
• Permanent

Delivers cyber security consulting projects for UK clients, focusing on NCSC Cyber Assessment Framework assessments, ISMS development and ISO 27001 certification. Works within a consulting team alongside Senior and Principal Consultants, writing detailed reports and supporting business development through blogs, marketing material and tenders.

• London
• Hybrid
• Senior
• Permanent

Deliver PCI DSS consultancy engagements across merchant and service provider environments, covering gap assessments, readiness reviews and compliance assessments, plus RoC and AoC documentation. Also supports wider consulting work in ISO 27001, NIST, NCSC CAF, risk management and security maturity, reviewing complex infrastructure, cloud and third-party environments.

PCI DSS v4.x · RoC · AoC +2

• Pendlebury
• Hybrid · 3 days in office
• £55,000 pa
• Senior

Day-to-day operation of a SIEM platform, including monitoring, administration and optimisation, plus developing detection rules and investigating alerts through to resolution. Works with Infrastructure, Networking, DevOps and external partners on incident response, EDR management and control testing, with Google SecOps (Chronicle) experience advantageous.

Google SecOps · Chronicle · Windows Security Event Logs +6

• Reading
• Hybrid
• Entry level
• Internship

Internship on CrowdStrike's Counter Adversary Operations automation team, building AI agents and automated workflows with Charlotte AI and Falcon Fusion SOAR. You'll write and test Python scripts and REST API/JSON integrations, evaluate agent reliability, and shadow Elite analysts to turn their needs into automation. Hybrid working from the Reading or London office.

CrowdStrike Falcon · Charlotte AI · Falcon Fusion SOAR +7

• Reading
• Hybrid
• Entry level
• Internship

Internship on CrowdStrike's Technical Analysis Cell, researching nation-state and criminal intrusions through reverse engineering of malware and tooling. The role involves building automation for malware analysis, creating host- and network-based detection signatures, and producing threat intelligence reporting for varied audiences.

Disassemblers · Decompilers · Debuggers

• London
• Hybrid · 3 days in office
• Senior
• Permanent

Builds and operates production ML systems for document classification and extraction, using LLMs/VLMs and traditional ML to power identity verification at scale. Leads technical design from RFC to deployment, optimises GPU inference, and develops training and evaluation pipelines. Works in a squad-based team alongside Applied Science, Product and Data Science.

AWS · Kubernetes · TensorFlow +4

• Cambridge
• Hybrid · 3 days in office
• Senior
• Permanent

Leads the design and delivery of complex features in a cryptographic security product, working hands-on across embedded software, platform components, client tools and APIs. Sets technical direction, mentors engineers and supports system-level architecture decisions on availability, latency and data models. Hybrid role in Cambridge, three days onsite.

C · Python

• Manchester
• Hybrid · 3 days in office
• £54,000 – £55,000 pa
• Senior

Day-to-day operation of a SIEM platform, including monitoring, administration and optimisation, plus developing detection rules and investigating alerts through to resolution. Works with Infrastructure, Networking, DevOps and external partners on incident response, EDR management and control testing, with Google SecOps (Chronicle) experience advantageous.

Google SecOps · Chronicle · SIEM +4

• Colchester
• Remote
• £51,000 – £55,000 pa
• Mid-level
• Permanent

Hands-on security role managing and enhancing controls across the IT infrastructure, covering incident response, threat detection, vulnerability management and compliance. You will work with Microsoft security tooling including Entra ID, Defender, Purview and Intune, support audits and frameworks such as NIST and ISO 27001, and help shape security strategy in a small collaborative IT team.

Microsoft 365 · Microsoft Entra ID · Microsoft Defender +4

• London
• On-site
• £473 – £800 pd
• Senior
• Contract

Senior role driving first-line cyber risk management and regulatory compliance across EMEA, coordinating responses to DORA and EBA requirements and translating them into actionable controls. Involves enhancing the Cyber GRC framework, managing risk registers and policy exceptions, and producing monthly metrics and KRIs for senior stakeholders. Acts as the Cyber GRC contact across the region, communicating complex regulatory matters in business language.

DORA · EBA · NIST +2

• London
• On-site
• Lead · manages people
• Permanent

Lead product cybersecurity assurance across the HMND 01 humanoid robot platforms, defining security requirements, threat modelling and risk artefacts for safety-critical electromechanical systems. Own TARA, security management plans and remediation actions, drive compliance with IEC 62443, the EU Machinery Regulation and the Cyber Resilience Act, and build a PSIRT process while guiding a cross-functional security team.

CAN bus · Ethernet · KinetIQ +4

• Cheltenham
• Hybrid · 3 days in office
• £100,000 – £110,000 pa
• Senior
• Permanent

Builds backend Java applications and microservices for complex cross-domain security systems, working across the full SDLC from requirements through deployment and support. Uses Spring Boot, AWS, REST APIs, PostgreSQL, MongoDB, DynamoDB and RabbitMQ within containerised, automated environments (Docker, Kubernetes, Terraform, Jenkins, Linux), with TDD, BDD and pair programming.

Spring Boot · AWS · PostgreSQL +7