Cyber Security Jobs

• Germany
• Remote
• Entry level
• Internship

Internship on CrowdStrike's Technical Analysis Cell, researching nation-state and criminal intrusions through reverse engineering of malware and tooling. The role involves building automation for malware analysis, creating host- and network-based detection signatures, and producing finished threat intelligence reporting for customers.

CrowdStrike · Disassemblers · Decompilers +1

• Germany
• Remote
• Senior

Builds and operates large-scale data processing pipelines, storage systems and presentation layers for the Intelligence team, owning systems from design and prototyping through production deployment and long-term maintenance. Works fully remotely across time zones, gathering requirements from analysts and choosing the technology stack, with existing Go and Python codebases to maintain.

AWS · GCP · EC2 +4

• United Kingdom
• Remote
• Senior

Owns the strategy, roadmap and execution for the Endpoint Windows Platform, translating OS and security requirements into product priorities. Partners closely with Engineering, Microsoft and cross-portfolio teams on agent architecture, performance and platform change management, and supports go-to-market enablement.

Microsoft · Windows · Sophos Endpoint +6

• London
• Hybrid · 3 days in office
• £100,000 – £120,000 pa
• Lead · manages people
• Permanent

Hands-on leadership of an MDR security operations function, owning SLA and KPI delivery across a varied mid-market client base while line-managing SOC Analysts and Senior Analysts. Sets investigation quality standards, handles major incidents and escalations, and matures detection, runbooks and automation, including AI-assisted SOC tooling. Combines client-facing service governance with people development and pre-sales support.

Microsoft Sentinel · Microsoft Defender

• Farnborough
• Hybrid · 2 days in office
• £70,000 – £80,000 pa
• Senior
• Permanent

Hands-on detection engineering role designing, testing and deploying detection content across Microsoft Sentinel and Splunk, writing KQL and SPL logic, tuning alerts to cut false positives and onboarding log sources from cloud, identity and network telemetry. Works closely with SOC, Threat Intelligence and Security Architecture teams in a live SOC environment.

Microsoft Sentinel · Splunk · Logic Apps +2

• Milton Keynes
• Remote
• £12,000 – £150,000 pa
• Director · manages people

Lead a globally distributed engineering organisation spanning cyber security, backend development, sensor infrastructure and AI-driven vulnerability research. Set technical strategy and standards while providing hands-on direction across architecture, system design and code review, and drive adoption of AI, LLMs and autonomous workflows to accelerate vulnerability discovery and exploit analysis.

LLM

• Virtual Location - Uk
• Permanent

Adversarial security testing role on AWS's Continuous Security Testing team, turning threat intelligence and scanner signals into testable hypotheses against live production services. Combines hands-on penetration testing with AI-augmented source code review, tracing chained attack paths and building lasting detections, canaries and fuzzers. Also involves testing agentic AI systems and mentoring engineers.

AWS

• London
• Mid-level
• Permanent

Respond to security incidents across AWS cloud services, triaging issues and driving internal teams to timely remediation while balancing technical and business risk. Build internal automation tools and utilities, mentor junior staff, and share on-call responsibilities. Works within AWS Cloud Response, coordinating multi-team responses and publishing guidance for customer-impacting issues.

AWS

• Birmingham
• Hybrid · 3 days in office
• £300 – £400 pd
• Senior
• Contract

Lead a six-month AI and digital platform security initiative, defining controls and guardrails for GenAI and machine learning across global operations. Architect defences spanning AWS, Azure, hybrid and on-prem environments, aligning with NIST and ISO 27001 while mentoring a senior team of security architects and advising C-suite stakeholders.

AWS · Azure · GenAI

• London
• Hybrid · 3 days in office
• £100,000 – £110,000 pa
• Mid-level · manages people

Leads a security operations function within a professional services firm, providing technical leadership across incident response, detection engineering and vulnerability management. Works with infrastructure, risk and third-party SOC providers, managing outsourced security suppliers and embedding security into technology projects. Hybrid role, three days a week in the City of London office.

Microsoft Azure · Entra ID · SIEM +1

• London
• US$104,435 pa
• Director

Leads and matures an enterprise-wide information governance and records management programme, owning policies, retention schedules, legal hold and defensible disposition across paper and electronic records. Also supports data classification, data governance, privacy by design and AI governance, advising Legal, Compliance, Technology and business stakeholders through cross-functional forums.

• United Kingdom
• Remote
• Mid-level

Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.

OSQuery · SQL · KQL +2

• Fleet
• Hybrid
• Mid-level

Owns day-to-day security alerting, investigations and incident response across a cloud-native microservice platform and internal IT estate, directing a Platform Ops team on remediation. Manages SIEM, endpoint and Microsoft 365 security tooling, vulnerability management, IAM and penetration testing engagements, while maintaining ISO 27001 documentation and UK GDPR compliance.

AWS · Kubernetes · EKS +5

• London
• Hybrid · 2–3 days in office
• £90,000 – £100,000 pa
• Senior

Owns and matures security operations across cloud, endpoint and SaaS environments, covering detection engineering, incident response, vulnerability management and AWS/GCP security posture. Over time shifts toward security engineering and architecture, designing scalable telemetry and detection platforms and embedding secure-by-design principles with engineering teams.

AWS · GCP · SIEM +7

• Farnborough
• Hybrid
• Senior
• Permanent

Lead protective and information security engineering on a critical MOD programme, shaping secure designs, assuring controls, and managing vulnerabilities across infrastructure, endpoints, identity and AWS cloud. Combines hands-on hardening, incident response leadership and ST&V with governance, reporting and mentoring, working largely autonomously on-site in Farnborough with some remote work.

AWS