217 jobs for “Incident Response Analyst”
CrowdStrike London £72,000 – £130,000 pa
Technical analyst role in a virtual security operations centre, monitoring and investigating security alerts in real time. Involves incident handling across Windows, Mac and Linux, malware analysis, remote remediation, and serving as escalation point and mentor for junior analysts while producing customer-facing findings.
CrowdStrike United Kingdom
Monitors and performs in-depth analysis of security alerts across Windows, Mac and Linux, handling incidents end to end including malware analysis and remote remediation. Acts as technical escalation point and mentor for junior analysts while improving detection and triage processes in a virtual security operations centre.
Erin Associates Manchester £45,000 – £50,000 pa
Hands-on role strengthening an organisation's security posture and delivering initiatives across its Cyber Security Roadmap. Day to day involves managing Microsoft Defender, Intune, Entra ID and Microsoft 365 security controls, supporting vulnerability remediation, alert triage and incident response, and maintaining Cyber Essentials and CIS Controls compliance.
ITSS Recruitment London £60,000 – £70,000 pa
Hands-on security engineering role protecting critical systems and sensitive data across a broad estate covering cloud security, vulnerability management, incident response and security monitoring. Day to day involves operating the vulnerability management programme, administering Microsoft Defender, Purview, Entra ID, Sentinel and Azure security services, and advising infrastructure, application and business stakeholders on risk-based controls.
GCS London £600 – £700 pd
Lead a risk-based technical assurance programme across a global enterprise, independently assessing security control effectiveness in infrastructure, cloud, identity, applications and incident response. Manage and mentor a small team of Technical Assurance Analysts while producing board-level reporting and driving continuous controls monitoring and automated assurance.
Hays Technology Sheffield £450 – £500 pd
Owns end-to-end solution design across cybersecurity initiatives, producing architecture documents, high-level designs, patterns, decision records and risk assessments. Provides technical leadership and presents designs to Design Authorities and senior stakeholders, with deep IAM and HashiCorp Vault expertise. Requires three days per week onsite in Sheffield.
Peregrine Blackpool
Forward-deployed engineer embedded in a Cyber Capability Unit, building and deploying AI-powered security and fraud prevention solutions. Day to day covers AWS infrastructure, Terraform IaC, GitLab CI pipelines, testing, observability and incident response in regulated environments. Requires active SC clearance.
Sophos United Kingdom
Senior individual contributor researching how threat actors adopt, weaponize and exploit AI, from LLM-powered social engineering to attacks on agentic AI systems. Involves instrumenting telemetry to detect adversarial AI use, automating research workflows with LLMs and Python, and publishing deep-dive intelligence externally. Works alongside CTU researchers, SophosLabs analysts, MDR threat hunters and data scientists.
DB Cargo (UK) Limited Doncaster £70,000 – £75,000 pa
Acts as the cyber security subject matter expert within an IT Governance & Security function, leading governance, risk, compliance and resilience across business-critical applications, cloud services and operational railway systems. Owns the ISMS and NIS/GDPR compliance while managing security operations, threat monitoring, incident response and vulnerability management. Develops Microsoft Sentinel and Defender XDR capabilities and provides governance across Azure, AWS, Microsoft 365, Entra ID and Intune, including support for ERTMS/ETCS transformation.
Darktrace Paris, France
Customer-facing technical role partnering with security and IT stakeholders to drive platform adoption, reduce risk and demonstrate measurable value. You build technical success plans, spot adoption gaps and retention risks early, and feed technical health insights into renewals, QBRs and expansion discussions alongside Account Executives and Solutions Engineering.
Darktrace London
Customer-facing technical role partnering with security and IT stakeholders to drive platform adoption, reduce risk and improve customer health. Works with Account Executives, Solutions Engineering and Renewals on technical success plans, adoption analytics, QBRs and renewal readiness. Requires fluency in French and English.
Palo Alto Networks United Kingdom
Deliver white-glove onboarding and ongoing technical guidance for Managed XSIAM customers, analysing security data to improve detection coverage, alert quality and tenant hygiene. Lead customer touchpoints and security reviews while partnering with Unit 42 SOC engineering, Product and MDR teams to build automation workflows and scalable service frameworks.
CBSbutler Holdings Limited trading as CBSbutler London £475 – £525 pd
Hands-on SOC and incident response role investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised environments. Responsibilities include alert triage, severity assessment, containment and remediation, telemetry correlation, evidence documentation and improving detection playbooks. On-site shift work covering 10-hour shifts between 06:00 and 16:00.
Palo Alto Networks London
Lead and deliver reactive incident response engagements for clients, managing scoping, forensic investigations and containment of security incidents. Perform host-based analysis across Windows, Linux and macOS, examine firewall, web and database logs, and use tools such as EnCase, FTK, X-Ways, SIFT and Splunk to determine breach scope. Also mentors junior team members and provides remediation guidance to customers.
TRIA Sheffield £500 – £600 pd
Lead the response to high-severity IT incidents across network, infrastructure, cloud and security environments, coordinating technical teams, suppliers and stakeholders to restore services within agreed targets. The role involves chairing incident and crisis calls, post-incident reviews, root cause analysis, ITIL processes, disaster recovery and business continuity planning, plus executive reporting and on-call duties.
