Cyber Security Jobs

Michael Page · Liverpool · £60,000 – £65,000 pa

Act as the escalation point for an external MSSP, investigating and responding to security incidents and performing detailed event analysis to identify threats. Drive hands-on remediation, detection engineering, and security reviews across cloud and enterprise collaboration environments, using frameworks like MITRE ATT&CK. A one-year fixed-term contract with strong extension potential, hybrid across Liverpool, Glasgow, or London.

TXP · United Kingdom · £440 – £490 pd

Monitor, investigate and respond to cyber security incidents within a Microsoft security environment, using Microsoft Sentinel and the Defender suite. The role covers alert triage, threat hunting, log and telemetry analysis, and creating and tuning Sentinel analytics rules, workbooks and detection use cases. You will also support incident response containment and recovery, produce reports, and work with infrastructure, cloud and application teams to improve SOC processes and detection engineering.

Mimecast · London · £124,000 – £186,000 pa

Owns architectural direction for Mimecast's Email & Collaboration Security product line, spanning email threat detection, DMARC, data platforms and response capabilities. Works across product, engineering and the Architecture Leadership Team to define integration contracts, ADRs and NFR targets, with cost-per-outcome reasoning and daily AI tooling use.

Mimecast · London · £44,000 – £66,000 pa

Acts as the trusted technical advisor for a portfolio of mid-market accounts, working in a three-person pod with an Account Manager and Renewals Manager. Owns platform adoption, configuration health and value scoring across email security, HRM and Incydr products, and packages proof-of-value and business reviews for executive audiences. Also leads churn mitigation and identifies expansion signals ahead of renewal.

Sophos · United Kingdom

Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.

Sophos · United Kingdom

Defines and scales a global partner enablement strategy across VARs, MSPs, MSSPs and distributors, covering role-based learning journeys, certifications and content lifecycle governance. Leads a matrixed global team, using generative AI and prompt-driven workflows to scale curriculum and technical content, with accountability for AI-related OKRs and enablement metrics such as partner ramp time and pipeline contribution.

Experis · London · £450 – £455 pd

Hands-on SOC and incident response role monitoring, triaging and investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised platforms. You will contain and remediate incidents, document findings and evidence, and contribute to detection rules and response playbooks while working closely with security and engineering teams.

Amazon · Manchester

Monitors networks and systems for threats, triages security alerts and leads incident response using AWS technologies and services at massive scale. Contributes to security automation and posture improvements, tracks detective controls like GuardDuty, CrowdStrike Falcon and Wiz Defend, and requires periodic on-call including weekends.

Amazon · London

Builds AI/ML-driven security automation systems that detect, analyse and respond to threats at Amazon scale, integrating automated detection into the company's security infrastructure. Works alongside security engineers and scientists on proactive, offensive and defensive tooling, researching and prototyping new approaches. Distinct for its focus on autonomous security across one of the world's largest tech ecosystems.

ITSS Recruitment · London · £60,000 – £70,000 pa

Hands-on security engineering role protecting critical systems and sensitive data across a broad estate covering cloud security, vulnerability management, incident response and security monitoring. Day to day involves operating the vulnerability management programme, administering Microsoft Defender, Purview, Entra ID, Sentinel and Azure security services, and advising infrastructure, application and business stakeholders on risk-based controls.

Vermelo RPO · Salford

Owns the end-to-end lifecycle of security products such as IAM, EDR, SIEM and cloud security, defining roadmaps, backlogs and measurable outcomes around risk reduction and adoption. Works with engineering, GRC and vendors to ensure controls are usable, auditable and aligned to business needs, balancing risk, cost and usability.

RiverSafe · London

Client-facing consulting role leading end-to-end security engagements across security architecture, cloud security, DevSecOps, application security and security operations. You'll run workshops, design controls in AWS/Azure/GCP, produce risk-based deliverables and help identify follow-on work, contributing to proposals and account growth.

CrowdStrike · United Kingdom

Lead a team of three data scientists building machine learning and agentic AI systems for threat detection, malware analysis and security automation. Set technical standards, own ML roadmaps from research to production, and partner with security research, engineering and product teams while staying hands-on with Python, ML frameworks and large-scale data.

CrowdStrike · Spain

Lead a team of three data scientists building machine learning and agentic AI systems for threat detection, malware analysis and security automation. Set technical standards, drive ML strategy from research to production, and partner with security research, engineering and product teams. Requires dual expertise in ML and cybersecurity.

Adecco · Colchester · £51,000 – £55,000 pa

Hands-on role maintaining and improving an organisation's cyber security posture across its IT infrastructure, covering security operations, incident response, vulnerability management and compliance. Day to day involves SIEM, endpoint security and Microsoft tooling such as Entra ID, Defender, Purview and Intune, plus audit support and security improvement projects. Predominantly remote with occasional travel to the Essex office.