80 jobs for “SIEM”
TRIA Gloucestershire £60,000 – £80,000 pa
Investigate and respond to security incidents across endpoint, identity, network and cloud environments for a growing cyber security consultancy and MSSP. The role involves digital forensics, evidence collection, containment and recovery, plus developing IR playbooks and tabletop exercises, working alongside SOC, Threat Intelligence and Detection Engineering teams. It includes an on-call rota and occasional customer travel.
Sophos United Kingdom
Owns the strategy, roadmap and execution for the Endpoint Windows Platform, translating OS and security requirements into product priorities. Partners closely with Engineering, Microsoft and cross-portfolio teams on agent architecture, performance and platform change management, and supports go-to-market enablement.
Sopra Steria Farnborough £70,000 – £80,000 pa
Hands-on detection engineering role designing, testing and deploying detection content across Microsoft Sentinel and Splunk, writing KQL and SPL logic, tuning alerts to cut false positives and onboarding log sources from cloud, identity and network telemetry. Works closely with SOC, Threat Intelligence and Security Architecture teams in a live SOC environment.
QinetiQ Farnborough £36,000 – £40,000 pa
Supports the design, development and application of configuration security tools and infrastructure monitoring. Day to day involves SIEM health checks, triaging alarms, correlating alerts, investigating potential incidents, producing weekly and monthly security reports, and managing analyst rota scheduling for continuous PROMON coverage.
Sophos United Kingdom
Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.
VIQU IT Glasgow
Hands-on technical role leading security monitoring, incident response and threat detection using SIEM, EDR, DLP and vulnerability management tools. Acts as a technical SME, mentoring junior analysts and collaborating with global IT teams to maintain ISO 27001-aligned controls and BAU security operations.
CV-Library Fleet
Owns day-to-day security alerting, investigations and incident response across a cloud-native microservice platform and internal IT estate, directing a Platform Ops team on remediation. Manages SIEM, endpoint and Microsoft 365 security tooling, vulnerability management, IAM and penetration testing engagements, while maintaining ISO 27001 documentation and UK GDPR compliance.
eFinancialCareers London £650 – £750 pd
Investigate and respond to cyber security incidents across enterprise environments, triaging alerts from SIEM, EDR/XDR, cloud, identity and network tools. Conduct digital forensics, proactive threat hunting and detection tuning, coordinating containment and recovery with infrastructure, cloud and identity teams. Six-month contract within a collaborative security function defending a large enterprise.
eFinancialCareers London £67,000 pa
Designs and implements security solutions across cloud, on-premises and hybrid environments for a global technology consultancy's client projects. Day-to-day work covers SIEM log ingestion and routing, firewall and network security management, CIS benchmark assessments, and automating security processes with Python, Bash or PowerShell, Terraform and cloud platforms. Involves client-dependent on-call support and requires British passport holders without dual nationality for clearance.
RiverSafe London
Client-facing consulting role leading end-to-end security engagements across security architecture, cloud security, DevSecOps, application security and security operations. You'll run workshops, design controls in AWS/Azure/GCP, produce risk-based deliverables and help identify follow-on work, contributing to proposals and account growth.
Experis London £500 pd
Lead end-to-end management of cyber security incidents and major security events within a secure government programme, coordinating technical response teams through containment, eradication and recovery. Act as primary point of contact for incident communications, run response bridges and war-rooms, and produce post-incident reports and root cause analysis. Works alongside SOC, analysts, infrastructure teams and third-party suppliers to improve cyber resilience.
CrowdStrike United Kingdom
As an Associate Consultant on the Platform Professional Services team, you'll act as a trusted advisor helping customers operationalise Falcon Next-Gen SIEM, answering technical questions, demonstrating capabilities and shaping a roadmap. You'll work with log management, XDR and SOAR features, transfer knowledge of Falcon LogScale NGSIEM, and feed customer insights back to product teams.
CrowdStrike United Kingdom
Embedded technical advisor partnering with strategic customers to drive adoption, optimization and operational support of the CrowdStrike Falcon platform. Involves deployment, configuration, troubleshooting, scripting with Falcon APIs, and mentoring customer security teams across endpoint, identity and cloud modules.
Airbus Newport
Hands-on role managing the full lifecycle of security incidents within an international CSIRT, investigating SOC alerts and performing host forensic analysis and reverse-engineering. You will industrialise SIEM and EDR tooling, build detection use cases and automated response workflows, and support SOC Level 1 and 2 processes, including on-call crisis response.
Hays Technology Leeds £45,000 – £50,000 pa
Support the development and operation of security controls, analyse threat intelligence, manage vulnerabilities and help with incident response across a global technology estate. Work with Azure and Microsoft security tooling such as Sentinel, Defender and Intune, alongside SIEM, EDR and firewalls, in a hybrid Leeds team.
