Cyber Security Jobs

• Cardiff
• Remote
• £62,000 – £72,000 pa
• Mid-level

Hands-on security engineering role focused on building and improving controls across a Microsoft-centric estate, including Defender, Sentinel, Azure and Entra ID. Involves vulnerability management, data protection with Purview, incident response support and embedding security into projects, with influence over strategy rather than pure SOC operations.

Microsoft Defender · Microsoft Sentinel · Azure +2

• Royston
• £58,000 – £60,000 pa
• Senior

Owns AI security initiatives within a Cyber Security and Compliance team, evaluating and integrating AI security tooling and defending against threats such as prompt injection, data leakage and model poisoning. Also builds AI-driven detection, vulnerability management and incident response capabilities, running threat modelling and adversarial testing of AI systems alongside stakeholders.

Python · OWASP Top 10 for LLM Applications · MITRE ATLAS +1

• United Kingdom
• Remote
• Mid-level

Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.

OSQuery · SQL · KQL +2

• London
• Hybrid · 2–3 days in office
• £55,000 – £65,000 pa
• Senior

Owns the entire IT estate for a cybersecurity SaaS company, covering identity and access management, macOS device management, SaaS administration and end-to-end joiners, movers and leavers. An engineering-led role focused on automation, AI enablement and security controls that support SOC 2, ISO 27001 and Cyber Essentials Plus audits, working alongside the Director of Information Security and a Senior SecOps Engineer.

macOS · MDM · SSO +6

• Bromley
• Hybrid
• £55,000 – £62,000 pa
• Mid-level
• Permanent

Operational security role focused on monitoring alerts across endpoints, identities, email and cloud using Rapid7 SIEM, Microsoft Defender and Sophos. You will triage and investigate incidents such as malware, phishing and identity compromise, tune detection tooling, and help build incident response playbooks and runbooks.

Microsoft Defender · Microsoft 365 Defender · Entra ID +7

• London
• Hybrid · 3–4 days in office
• £60,000 – £65,000 pa
• Senior

Hands-on, client-facing role owning managed security services and Microsoft cloud projects for a London MSP. You'll lead incident response, detection tuning and SIEM triage alongside the NOC/SOC, design Entra ID and Microsoft 365 security, and deliver Azure and tenant-to-tenant migrations. Also involves Cyber Essentials and ISO 27001 work, vulnerability assessments and mentoring engineers.

Microsoft 365 · Azure · Entra ID +7

• Coventry
• Hybrid · 3 days in office
• £455 pm
• Senior
• Contract · Part time

Designs, implements and maintains enterprise network security across on-prem, cloud and hybrid environments, leading Zero Trust and segmentation initiatives. Hands-on with enterprise firewalls, Azure/AWS network security, VPNs and secure remote access, while collaborating with SOC teams on detection and response. Contract role with three days per week on-site in Coventry.

Palo Alto · Check Point · Cisco Firepower +7

• London
• On-site
• £450 – £455 pd
• Mid-level
• Contract

Hands-on SOC and incident response role monitoring, triaging and investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised platforms. You will contain and remediate incidents, document findings and evidence, and contribute to detection rules and response playbooks while working closely with security and engineering teams.

macOS · Linux · Containers +4

• Belfast
• On-site
• Junior

Hands-on role investigating escalated security alerts, triaging and responding to cyber incidents, and gathering forensic evidence following established playbooks. You'll work with a global follow-the-sun team across time zones, support security tooling and process improvement, and participate in an on-call rota with rotational evening and weekend shifts.

SIEM · IDS/IPS · EDR +7

• Newport
• Hybrid
• Mid-level
• Permanent

Hands-on role managing the full lifecycle of security incidents within an international CSIRT, investigating SOC alerts and performing host forensic analysis and reverse-engineering. You will industrialise SIEM and EDR tooling, build detection use cases and automated response workflows, and support SOC Level 1 and 2 processes, including on-call crisis response.

SIEM · EDR

• United Kingdom
• Remote
• Lead

Deliver white-glove onboarding and ongoing technical guidance for Managed XSIAM customers, analysing security data to improve detection coverage, alert quality and tenant hygiene. Lead customer touchpoints and security reviews while partnering with Unit 42 SOC engineering, Product and MDR teams to build automation workflows and scalable service frameworks.

XSIAM · Unit 42

• London
• Remote
• Lead · manages people

Lead strategic advisor for enterprise customers modernising their Security Operations Centres through XSIAM deployment, covering log ingestion, detection engineering and automation. The role combines executive-level consulting with hands-on SIEM/SOAR/EDR technical work, mentoring professional services teams and feeding field insights back to Product and R&D. Requires security clearance eligibility and up to 30% travel.

XSIAM · Splunk · IBM QRadar

• Nottingham
• £26,100 pa
• Junior

Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and keeping critical financial data secure. Day to day involves monitoring security alerts, reviewing logs, investigating incidents, maintaining documentation and supporting security testing and compliance activities.

• Sutton-in-Ashfield
• £26,100 pa
• Junior

Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and keeping critical financial data secure. Day to day involves monitoring security alerts, reviewing logs, investigating incidents, and maintaining documentation, with hands-on exposure to security monitoring tools and incident management processes.

• Cambridge
• Senior

Provides technical leadership for FPGA-based solutions in security-focused systems, owning architecture, VHDL RTL design, verification, and integration with embedded and host software. Balances hands-on implementation with planning, estimation, and mentoring, while defining development processes such as CI/CD and configuration management.

Xilinx · Zynq · Versal +6