Cyber Security Jobs

• Reading
• Remote
• US$140,000 – US$215,000 pa
• Lead · manages people

Lead a growing engineering team building self-service infrastructure-as-code primitives, architecting large-scale core services and driving cloud cost optimisation across multi-cloud environments. The role combines people management with hands-on technical direction, including design reviews, on-call management and SRE practices.

Chef · Puppet · Salt +7

• London
• Remote
• US$140,000 – US$215,000 pa
• Lead · manages people

Lead a growing engineering team building self-service infrastructure-as-code primitives, architecting large-scale core services, and driving cloud cost optimization across a multi-cloud environment. The role combines people management with hands-on technical direction, setting deployment standards and SRE practices for a platform processing trillions of events daily.

Chef · Puppet · Salt +7

• London
• Hybrid
• £50,000 – £55,000 pa

Solutions Engineer – Infrastructure & 3rd Line - HybridLondon | Hybrid Working | Managed IT ServicesOur client is a fast-growing Managed IT Services Provider specialising in the creative industry, supporting more than 5,000 users across 100+ businesses from its London…

• Leeds
• Hybrid · 3 days in office
• £65,000 – £70,000 pa
• Lead · manages people
• Permanent

Lead a cyber security team day to day, covering resource planning, rotas and performance management, while overseeing incident response, vulnerability management and cloud security migration. Act as escalation point for security incidents and lead war-gaming exercises within an ITIL and ISO 27001 framework, requiring hands-on Azure security expertise.

Azure · Windows Server · VMware +7

• London
• Mid-level

Hands-on incident response role covering detection, triage, investigation, containment and recovery of cyber incidents in a complex enterprise environment. Day to day involves monitoring SIEM and EDR/XDR alerts, analysing logs, packet captures and forensic images, threat hunting, and mapping activity to MITRE ATT&CK. Also maintains playbooks, evidence records and post-incident reports, and briefs senior stakeholders.

Microsoft Sentinel · Defender XDR · Defender for Identity +7

• Cardiff
• Remote
• £62,000 – £72,000 pa
• Mid-level

Hands-on security engineering role focused on building and improving controls across a Microsoft-centric estate, including Defender, Sentinel, Azure and Entra ID. Involves vulnerability management, data protection with Purview, incident response support and embedding security into projects, with influence over strategy rather than pure SOC operations.

Microsoft Defender · Microsoft Sentinel · Azure +2

• Cardiff
• Hybrid
• £40,000 – £45,000 pa
• Mid-level

Client-facing technical role in a Microsoft-focused security partner's Cyber Security Delivery Team, acting as a trusted point of contact for customers. Day to day involves tuning Defender and Entra controls, building KQL detections in Microsoft Sentinel, running phishing simulations and vulnerability scans, and supporting incident response and reporting.

Microsoft Defender XDR · Microsoft Entra · Defender for Cloud Apps +7

• Sheffield
• Hybrid · 2–3 days in office
• £500 – £600 pd
• Senior
• Contract

Lead the response to high-severity IT incidents across network, infrastructure, cloud and security environments, coordinating technical teams, suppliers and stakeholders to restore services within agreed targets. The role involves chairing incident and crisis calls, post-incident reviews, root cause analysis, ITIL processes, disaster recovery and business continuity planning, plus executive reporting and on-call duties.

Cisco · VMware · ServiceNow +3

• Royal Leamington Spa
• Hybrid · 3 days in office
• £550 – £650 pd
• Senior
• Contract

Hands-on contract role owning the end-to-end detection engineering lifecycle, translating threat intelligence, hunting findings and adversary techniques into effective detection rules. Builds behavioural analytics and detection content across endpoint, identity, cloud, network and email telemetry using KQL, SPL, Sigma, Python and PowerShell, with tuning, purple teaming and Detection-as-Code work alongside SOC, IR and Red Team specialists.

Microsoft Sentinel · Splunk · Elastic +6

• Gloucestershire
• Hybrid
• £60,000 – £80,000 pa
• Mid-level
• Permanent

Investigate and respond to security incidents across endpoint, identity, network and cloud environments for a growing cyber security consultancy and MSSP. The role involves digital forensics, evidence collection, containment and recovery, plus developing IR playbooks and tabletop exercises, working alongside SOC, Threat Intelligence and Detection Engineering teams. It includes an on-call rota and occasional customer travel.

Velociraptor · KAPE · Timesketch +8

• Cambridge

Acts as the go-to authority in a chosen reliability specialism—observability, performance engineering, data infrastructure, security-focused SRE or network reliability—defining standards and best practices across SRE, Platform Engineering and DevSecOps. Builds tooling and automation, leads deep-dive investigations into systemic issues, and contributes to incident response and on-call rotations in a cloud-native, Kubernetes-based environment.

AWS · GCP · Azure +1

• Manchester
• Entry level
• Permanent

Monitors networks and systems for threats, triages security alerts and documents suspicious activity, working with partner teams on daily threat detection and incident response across AWS technologies at scale. Involves security automation, tracking detective controls like GuardDuty, CrowdStrike Falcon and Wiz Defend, and periodic on-call including weekends.

AWS · Amazon GuardDuty · CrowdStrike Falcon +1

• Basingstoke
• Hybrid · 3 days in office
• £55,000 pa
• Mid-level

Deliver and support Cyber Essentials and Cyber Essentials Plus assessments, working directly with clients to review evidence, discuss security controls and explain findings. Assess technical controls across networks, endpoints and cloud environments, then produce clear audit reports and practical recommendations, with scope to grow into wider ISO 27001 and IASME assurance work.

Cyber Essentials · Cyber Essentials Plus · ISO 27001 +2

• London
• On-site
• £30,000 – £45,000 pa
• Mid-level

Hands-on SOC role monitoring and triaging SIEM, EDR and cloud alerts, investigating incidents and supporting containment and response. Also provides second-line support across Azure, AWS, identity, network and endpoint environments, with occasional on-call and shift handovers. Requires SC clearance eligibility and is majority onsite in Manchester or London.

Microsoft Sentinel · ELK Stack · Azure +7

• Grange, Greater London
• Hybrid
• £55,000 – £60,000 pa
• Mid-level
• Permanent

Conducts penetration tests across web applications, infrastructure, cloud environments and APIs, with exposure to Active Directory, AWS/Azure/GCP and tools like Burp Suite, Kali Linux, Nmap and Metasploit. Owns testing engagements end to end, writes clear reports and advises clients on remediation, with scope to move into red teaming, assumed breach and AI security.

Burp Suite · Kali Linux · Nmap +4