Cyber Security Jobs

• Derby
• £26,100 pa
• Junior

Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and helping keep critical financial data secure. Day to day involves monitoring alerts, reviewing logs, escalating potential threats, investigating incidents and maintaining documentation, with hands-on exposure to security monitoring tools and incident management processes.

• London
• Hybrid
• £70,000 – £75,000 pa
• Mid-level
• Permanent

Hands-on role blending DevOps, cloud and security across AWS and Azure environments, embedding controls into CI/CD and Infrastructure as Code. You'll improve IAM, monitoring and vulnerability management while supporting client migrations and the company's push towards SOC 2 compliance, working alongside Platform/DevOps and Compliance teams.

AWS · Azure · GuardDuty +7

• London
• Hybrid
• £70,000 – £80,000 pa
• Lead

Hands-on owner of governance, risk and compliance, maintaining the ISO 27001 ISMS, leading external audits and taking SOC 2 from Type 1 to Type 2. Owns the enterprise risk framework and risk register, manages compliance tooling and supports customer security questionnaires, working across engineering, sales and leadership.

Risk Ledger

• Winchester
• On-site
• £41,000 – £50,000 pa
• Mid-level

Monitor, triage and investigate security alerts across SIEM and wider security tooling, identifying indicators of compromise and conducting initial incident investigations. Support the full incident response lifecycle including containment, remediation and post-incident learning, while tuning detection rules to reduce false positives. Work with security and infrastructure teams on threat intelligence, trend reporting and continual service improvement.

Microsoft Sentinel · Microsoft Defender · QRadar +2

• Remote
• Hybrid
• Lead · manages people

Oversee Security Operations Centre activities, lead incident response efforts, and mentor a team of analysts. The role centres on cyber threat detection and incident investigation, with strong hands-on use of the Splunk Enterprise Security platform. It is a lead-level position within a remote security operations team.

Splunk Enterprise Security

• Manchester
• Remote
• Mid-level
• Permanent

Monitor, detect and respond to cyber incidents for customers from a 24/7 Global Security Operations Centre, working with the Microsoft Security Stack, Splunk, EDR, IDS and IPS tools integrated into a Unified Cyber Platform. The L2 role sits within an MXDR team of over 100 accredited experts handling hundreds of millions of log events daily.

Microsoft Security Stack · Splunk · EDR +3

• Farnborough
• On-site
• £48,000 – £58,000 pa
• Senior
• Shift work

Investigating and triaging complex security alerts across SIEM, EDR, network traffic and log data, supporting incident response and escalation. Threat hunting using MITRE ATT&CK, developing detection rules and playbooks, and producing incident reports. Fully on-site in Farnborough on a 24/7 shift pattern supporting defence and national security environments.

Microsoft Sentinel · Splunk · Elastic +2

• London
• On-site
• £475 – £525 pd
• Contract · Shift work

Hands-on SOC and incident response role investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised environments. Responsibilities include alert triage, severity assessment, containment and remediation, telemetry correlation, evidence documentation and improving detection playbooks. On-site shift work covering 10-hour shifts between 06:00 and 16:00.

SIEM · EDR · XDR +3

• London
• Director · manages people

Lead and develop the organisation's cyber security strategy, owning the information security framework including ISO 27001 and Cyber Essentials Plus. Reporting to the CIO, you will run security operations, manage an outsourced SOC, oversee incident response and vulnerability management, and mentor the security team. Legal-sector experience is mandatory, and the role spans Microsoft/Azure cloud security and SaaS assurance.

Microsoft Azure · SOC

• Harrow
• Remote
• Senior
• Permanent

Hands-on architect role at an Elastic partner, designing SOC and SIEM architectures on Elastic/ELK for UK Defence and NATO clients. You own the architecture with the client and stay close to delivery, supporting greenfield builds and recovering existing environments alongside a team of 30+ SMEs, mostly working remotely with occasional client-site visits.

Elastic · ELK · Elasticsearch +4

• Leicester
• £55,000 – £65,000 pa

Broad cyber security role in a financial services business, covering strategy, managing an external SOC, incident response and vulnerability management. Also involves developing AI governance and controls for Microsoft Copilot, plus security across Microsoft cloud, endpoint and identity environments, with training and guidance for non-technical colleagues.

Microsoft Defender · Microsoft Sentinel · Microsoft Copilot +2

• London
• Hybrid
• Senior
• Permanent

Investigate and respond to security incidents for critical national infrastructure and other clients, covering endpoint, network and cloud environments. The role spans both managed SOC services and consulting engagements, contributing to incident preparation, recovery and improving clients' security posture.

SIEM

• Bracknell
• £60,000 – £70,000 pa
• Senior

Hands-on technical role maintaining and improving a secure Gateway solution, with a focus on networking, Red Hat Enterprise Linux, and Shell/Bash scripting. You'll work with Solution Architects and Engineering Leads, support SOC and 3rd Line teams, and take on increasing project ownership with a path to Project Lead.

Red Hat Enterprise Linux · VMware · vSphere +5

• London
• £65,000 – £79,000 pa
• Senior · manages people
• Permanent

Hands-on security leadership role managing the technical cyber security environment and SOC, owning policies, ISO 27001 implementation and incident response. Works with the Head of IT on the Cyber Security Roadmap, manages a third-party SOC and one direct report, and uses tools such as Rapid 7, Sophos MTR, Solarwinds and ServiceNow. Based at Marylebone with travel across the Chiltern network and CTC clearance required.

Rapid7 · Sophos MTR · SolarWinds +4

• Birmingham
• £50,000 – £60,000 pa
• Lead

Owns the technical administration and optimisation of the Mimecast email security platform across a group and its subsidiaries, acting as the group subject-matter expert. Configures enterprise email-security policies, manages mail flow, DNS and SPF/DKIM/DMARC authentication, and investigates phishing, spoofing and BEC incidents while liaising with an external SOC/MDR provider.

Mimecast · SOC · MDR