Cyber Security Jobs in Woking

• United Kingdom
• Remote
• Lead · manages people

Oversees forensic investigations delivered by CrowdStrike's trusted partners, coordinating with incident response leadership, partners and customers during high-stakes engagements. Reviews reports and findings, trains partners on host and network forensics across Windows, Mac and Linux, and drives process improvement initiatives.

Windows · Mac · Linux

• Germany
• Remote
• Senior

Builds AI agents and automated workflows that help threat analysts investigate, enrich and act on intelligence across the Falcon platform and third-party tools. Combines Python development and REST API integration with LLM and SOAR tooling, testing agents for accuracy and safety before they reach customer environments.

CrowdStrike Falcon · Charlotte AI · Falcon Fusion SOAR +7

• United Kingdom - Field
• Senior

Designs, builds, tests and operates significant capabilities of the Agentic Trust solution within R&D, delivering complex features across the full software development lifecycle. Develops secure APIs, services, integrations and SDKs, mentors less experienced developers, and troubleshoots production issues. Works with Product, Architecture and Security peers to keep the platform secure, scalable and reliable.

Kubernetes · MCP · LLM

• Winchester
• On-site
• £41,000 – £50,000 pa
• Mid-level

Monitor, triage and investigate security alerts across SIEM and wider security tooling, identifying indicators of compromise and conducting initial incident investigations. Support the full incident response lifecycle including containment, remediation and post-incident learning, while tuning detection rules to reduce false positives. Work with security and infrastructure teams on threat intelligence, trend reporting and continual service improvement.

Microsoft Sentinel · Microsoft Defender · QRadar +2

• United Kingdom
• Remote
• £70,000 – £90,000 pa
• Senior
• Permanent

Lead OT cyber risk assessments on client sites, which makes up around 80% of the role, and carry out site surveys across ICS, SCADA, DCS and wider OT environments. Build improvement roadmaps and security programmes, applying standards such as IEC 62443, NCSC CAF, NIST SP 800-82 and HSE OG86, while supporting the sales team on follow-on opportunities and proposals.

IEC 62443 · NCSC CAF · NIST SP 800-82 +1

• Derby
• £26,100 pa
• Junior

Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and helping keep critical financial data secure. Day to day involves monitoring alerts, reviewing logs, escalating potential threats, investigating incidents and maintaining documentation, with hands-on exposure to security monitoring tools and incident management processes.

• London
• Hybrid
• Lead
• Contract

Lead enterprise cloud architecture across GCP and/or AWS, designing secure landing zones, IAM hierarchies and microservices, plus deterministic AI safety controls and perimeter defence. The role also covers systems integration, API layers and architectural governance, including Technical Design Authority approvals and NCSC-aligned assurance within UK central government.

GCP · AWS · VPC Service Controls +4

• Basingstoke
• Hybrid
• £41,000 – £45,000 pa
• Entry level
• Contract

A KTP Associate role transforming in-house cybersecurity software using Large Language Models and NLP, building real-time threat detection and clear user-facing responses. Involves developing UI and API integrations, working with large datasets and PyTorch, and acting as project lead while embedding technology and upskilling company staff.

PyTorch

• United Kingdom
• Remote
• £500 – £650 pd
• Senior
• Contract

Shape and launch a new Azure Security practice, designing consulting propositions, repeatable assessments and implementation methodologies. Provide technical leadership across Azure security architecture, governance, identity and infrastructure using Defender for Cloud, Entra ID, Azure Policy and Sentinel, while supporting pre-sales and coaching internal consultants.

Azure · Microsoft Defender for Cloud · Entra ID +6

• London
• Remote

Presales domain consultant providing technical expertise for network security and zero trust transformation. Partners with sales to architect on-prem, cloud and SASE/SD-WAN solutions, lead customer demos and technical validation, and respond to RFIs/RFPs. Acts as the main technical point of contact, presenting to audiences from practitioners to senior leadership.

SD-WAN · CASB · DLP +5

• Bath
• Hybrid · 2 days in office
• £30,000 pa
• Entry level

Join a technical operations team conducting cybercrime incident response, classifying malicious websites, apps, emails and phone numbers, and communicating findings to customers and affected parties. The role involves shift work covering weekends, with hybrid flexibility from a Bath office, and full training is provided for candidates without prior cybersecurity experience.

Udemy · Coursera

• London
• Mid-level

Own the full software development lifecycle for distributed systems supporting threat disruption and legal response, building data pipelines that collect and expose threat intelligence for analysts and customers. Work primarily in Golang and TypeScript with Rust, Kafka, Redis, Kubernetes, Terraform and Postgres, collaborating with Threat Intelligence, Trust & Safety, Legal and Product teams, plus on-call rotations and mentoring.

Golang · TypeScript · Rust +7

• Northallerton
• Remote
• £37,000 – £50,000 pa
• Mid-level

Deliver infrastructure penetration tests, vulnerability assessments and security audits across varied client environments, combining automation and tooling with hands-on investigation. Produce clear reports and debriefs for technical and non-technical audiences, manage multiple engagements, and help improve team methodologies and tooling alongside the web application team.

OSCP · CRT · CSTM +3

• London
• On-site
• Senior

Design and build software to solve Workload Identity challenges, from prototyping to production, covering both client and server. Work across networking, security, cloud, Kubernetes, encryption, PKI, JWT and SPIFFE, with Golang development, while mentoring a close-knit team and engaging internal and external stakeholders on technical trade-offs.

Kubernetes · Windows API · SPIFFE +2

• Stoke-on-Trent
• On-site
• £42,000 – £45,000 pa
• Senior
• Permanent

Hands-on role combining cyber-security and infrastructure engineering, monitoring threats, managing vulnerabilities and strengthening controls across identity, endpoint, network, patching and backups. Also provides senior technical expertise in Microsoft 365, Azure, Windows Server, Active Directory, VMware, firewalls and storage, guiding the wider IT team. Based on site five days a week in the Stoke-on-Trent area.

Microsoft 365 · Azure · Windows Server +2