Cyber Security Jobs

Darktrace · London

Investigates emerging cyber threats, performing in-depth malware analysis and reverse engineering while hunting for new attack trends and adversary TTPs. Produces threat intelligence reports, blogs and conference presentations, and develops data-driven methodologies and detections using Python, PowerShell or C/C++. Works hybrid, at least two days a week in the Cambridge or London office, alongside security researchers, analysts and product teams.

Darktrace · Cambridge

Investigates emerging cyber threats, performing in-depth malware analysis and reverse engineering of adversary tactics, techniques and procedures. Builds data-driven threat hunting methodologies, produces intelligence reports and detections, and presents findings at conferences. Works hybrid with security researchers, analysts and product teams, at least two days a week in Cambridge or London.

GEDU · London · £40,000 – £42,500 pa

The Information Security GRC Analyst will perform risk assessments, support the implementation of the ISO 27001 framework, and maintain information security policies. They will work closely with stakeholders to identify and mitigate risks, and assist in security certifications and technical investigations.

NCC Group · Manchester

Proactively hunts advanced threats across customer environments using a proprietary hunting framework, conducting intelligence-led, hypothesis-driven analysis of TTPs and behaviours. Works cross-functionally with SOC Analysts, Global Detection Engineers, Privacy and Engineering teams to align threat models and mitigate risks.

Reed Technology · Newcastle upon Tyne · £35,000 – £45,000 pa

Investigating and responding to security incidents at 2nd Line level, monitoring customer environments and SIEM alerts, and threat hunting across a Microsoft security stack including Sentinel, Defender and Entra. Uses KQL and PowerShell for investigations and automation, acts as an escalation point for junior analysts, and supports vulnerability assessment and remediation. Initially on a 4-on, 4-off night shift pattern before moving to an 8-hour shift model.

Reed Technology · Manchester · £60,000 – £65,000 pa

Producing threat assessments, intelligence reports and executive briefings, translating complex cyber threats into clear information for senior and non-technical stakeholders. Monitoring intelligence sources, assessing threat actors, TTPs and IOCs, and supporting incident response with security teams. Also leads and develops a small team while shaping the Cyber Threat Intelligence function.

Entrust · Paris, France

You will analyse EU digital identity and financial regulation, including eIDAS 2.0, ETSI standards and AML rules, assessing their impact on products and customers across EMEA. The role sits inside the Product organisation, so your assessments, comparison tables and recommendations feed directly into roadmaps, alongside certification work and external engagement with regulators.

Entrust · London

Analyses digital identity and financial regulation such as eIDAS 2.0, ETSI standards and EU AML rules, assessing their impact on products and customers across EMEA. Supports certification work including ETSI TS 119 461 and UK DVS, drafts consultation responses and position papers, and engages with regulators and industry working groups. Sits within the Product organisation, feeding regulatory insight directly into roadmaps and horizon-scanning.

Manpower · Lytham Saint Annes · £50,000 pa

Conducts red team exercises, critical control testing, cyber hygiene assessments and penetration testing to validate security controls and SOC detection capabilities. Produces detailed vulnerability reports for internal resolver groups and briefs leadership on defensive effectiveness. Requires hands-on infrastructure and web app testing with tools like Kali and Parrot across cloud, network and endpoint technologies.

Hays Technology · Sheffield · £450 – £500 pd

Owns end-to-end solution design across cybersecurity initiatives, producing architecture documents, high-level designs, patterns, decision records and risk assessments. Provides technical leadership and presents designs to Design Authorities and senior stakeholders, with deep IAM and HashiCorp Vault expertise. Requires three days per week onsite in Sheffield.

NCC Group · Remote

Oversee Security Operations Centre activities, lead incident response efforts, and mentor a team of analysts. The role centres on cyber threat detection and incident investigation, with strong hands-on use of the Splunk Enterprise Security platform. It is a lead-level position within a remote security operations team.

Sophos · United Kingdom

Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.

Sophos · United Kingdom

Senior individual contributor researching how threat actors adopt, weaponize and exploit AI, from LLM-powered social engineering to attacks on agentic AI systems. Involves instrumenting telemetry to detect adversarial AI use, automating research workflows with LLMs and Python, and publishing deep-dive intelligence externally. Works alongside CTU researchers, SophosLabs analysts, MDR threat hunters and data scientists.

CrowdStrike · Ireland

Investigates emerging malware and cyber threats across the full adversary kill chain, validating and improving Falcon's detection coverage. Works with Threat Research, Engineering, Data Science and Red Team to turn findings into product improvements, using automation, AI and machine learning to scale analysis.

CrowdStrike · United Kingdom

Investigates emerging malware and cyber threats across the full adversary kill chain, validating and improving Falcon's detection coverage. Works with Threat Research, Engineering, Data Science and Red Team to turn findings into product improvements, supporting external security testing programmes and building automation to speed analysis.