Cyber Security Jobs

Appvia · London · £75,000 – £90,000 pa

Design, build and operate secure AWS platforms using Terraform, Kubernetes/EKS and CI/CD for public and private sector clients. You will own technical delivery in your area, create reusable modules and deployment patterns, and mentor less experienced engineers within multi-disciplinary consulting teams.

RiverSafe · London

Client-facing consulting role leading end-to-end security engagements across security architecture, cloud security, DevSecOps, application security and security operations. You'll run workshops, design controls in AWS/Azure/GCP, produce risk-based deliverables and help identify follow-on work, contributing to proposals and account growth.

CrowdStrike · United Kingdom

Monitor and analyse security alerts on the CrowdStrike platform, handling incidents across Windows, Mac and Linux, performing malware analysis and remote remediation. The role sits in a virtual security operations centre, producing written findings for customer management and improving detection and triage processes.

Experis · Winchester · £41,000 – £50,000 pa

Monitor, triage and investigate security alerts across SIEM and wider security tooling, identifying indicators of compromise and conducting initial incident investigations. Support the full incident response lifecycle including containment, remediation and post-incident learning, while tuning detection rules to reduce false positives. Work with security and infrastructure teams on threat intelligence, trend reporting and continual service improvement.

CrowdStrike · Ireland

Analyzes large-scale security telemetry, threat intelligence feeds and detection data to surface trends, anomalies and emerging threats, and builds dashboards and reporting workflows in SQL, Python and Logscale. Works cross-functionally with product and data engineering teams to turn raw security data into actionable insights and KPIs for the Office of Adversary Strategy.

Fynity · Leeds · £38,000 pa

Hands-on SOC Analyst role sitting between L1 and L2, triaging and investigating security incidents using Microsoft Sentinel, Defender XDR and SentinelOne. Also acts as escalation point for a shift of around three analysts, monitoring SLAs, QA-ing tickets, leading handovers and coaching the team. Works a 4 on / 4 off, 7am-7pm shift with partial office attendance in Leeds.

Reed Technology · Newcastle upon Tyne · £35,000 – £45,000 pa

Investigating and responding to security incidents at 2nd Line level, monitoring customer environments and SIEM alerts, and threat hunting across a Microsoft security stack including Sentinel, Defender and Entra. Uses KQL and PowerShell for investigations and automation, acts as an escalation point for junior analysts, and supports vulnerability assessment and remediation. Initially on a 4-on, 4-off night shift pattern before moving to an 8-hour shift model.

Tank Recruitment · London

Hands-on incident response role covering detection, triage, investigation, containment and recovery of cyber incidents in a complex enterprise environment. Day to day involves monitoring SIEM and EDR/XDR alerts, analysing logs, packet captures and forensic images, threat hunting, and mapping activity to MITRE ATT&CK. Also maintains playbooks, evidence records and post-incident reports, and briefs senior stakeholders.

Fynity · Leeds · £38,000 pa

Hands-on SOC role sitting between L1 and L2, triaging and investigating security incidents while leading a small shift of around three analysts. Acts as escalation point, monitors SLAs, QA tickets, runs shift handovers and coaches the team, using Microsoft Sentinel, Defender XDR and SentinelOne. Distinct as a stepping stone into shift leadership without full Team Lead responsibility.

Entrust · Paris, France

You will analyse EU digital identity and financial regulation, including eIDAS 2.0, ETSI standards and AML rules, assessing their impact on products and customers across EMEA. The role sits inside the Product organisation, so your assessments, comparison tables and recommendations feed directly into roadmaps, alongside certification work and external engagement with regulators.

Entrust · London

Analyses digital identity and financial regulation such as eIDAS 2.0, ETSI standards and EU AML rules, assessing their impact on products and customers across EMEA. Supports certification work including ETSI TS 119 461 and UK DVS, drafts consultation responses and position papers, and engages with regulators and industry working groups. Sits within the Product organisation, feeding regulatory insight directly into roadmaps and horizon-scanning.

Global Technology Solutions Ltd · Reading · £50,000 – £60,000 pa

Senior technical authority in Security Operations, leading serious incidents, forensic investigations and root cause analysis while improving detection and response. Engineers Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune and Darktrace, develops automation and conducts proactive threat hunting, and mentors colleagues.

Hays Technology · Leeds · £45,000 – £50,000 pa

Support the development and operation of security controls, analyse threat intelligence, manage vulnerabilities and help with incident response across a global technology estate. Work with Azure and Microsoft security tooling such as Sentinel, Defender and Intune, alongside SIEM, EDR and firewalls, in a hybrid Leeds team.

Forward Role · Leeds · £54,000 – £65,000 pa

Owns day-to-day SIEM operations, defining and tuning detection rules and investigating alerts through to resolution. Runs incident response, threat intelligence and hunting, and EDR management while collaborating with Infrastructure, Networks, DevOps and an outsourced SOC. Also helps design and document security policies, standards and control test methods.

Planet Recruitment · Abingdon · £37,000 – £45,000 pa

Hands-on security operations role within an MSP, monitoring and investigating alerts across Microsoft 365, Sophos and other platforms for both internal and client environments. Acts as a technical escalation point for the Service Desk and Infrastructure teams, covering incident response, vulnerability and patch management, tenant hardening and remediation tracking.

Avanti Recruitment · London · £50,000 – £75,000 pa

Client-facing security role within a UK consultancy's growing Security Architecture practice, supporting government, defence and critical infrastructure programmes. Day to day involves threat modelling, risk assessment, reviewing solution and infrastructure designs, defining security requirements and controls, and running client workshops. Suits security engineers or consultants wanting to move into architecture, with occasional client site visits rather than frequent travel.

CBSbutler Holdings Limited trading as CBSbutler · Preston · £450 – £500 pd

Governance and coordination role tracking security incidents across a complex multi-supplier SIAM environment, from identification through to closure. You coordinate updates between suppliers and security stakeholders, monitor SLAs and escalation trends, and produce incident reports, dashboards and audit-ready records. Distinct from a hands-on SOC position, with no threat hunting or technical remediation involved.