254 jobs for “Threat Detection”
Sophos United Kingdom
Hands-on engineering role managing a modern identity stack across the full lifecycle, from passwordless authentication and adaptive access controls to identity governance and non-human identities. You will configure and operate Microsoft Entra ID, Saviynt and Active Directory directly, integrate applications via SAML, OIDC, OAuth and SCIM, and join an out-of-hours support rota.
Sophos United Kingdom
Leads incident response engagements for customers hit by cyberattacks, directing a team of consultants, running kick-off and daily update calls, and delegating forensic tasks. Handles multiple ransomware and BEC investigations concurrently, performing root cause analysis and producing executive-summary reports mapped to MITRE ATT&CK.
Amazon Manchester
Monitors networks and systems for threats, triages security alerts and documents suspicious activity, working with partner teams on daily threat detection and incident response across AWS technologies at scale. Involves security automation, tracking detective controls like GuardDuty, CrowdStrike Falcon and Wiz Defend, and periodic on-call including weekends.
CrowdStrike Ireland
Leads a team of three data scientists at the intersection of machine learning, big data and cybersecurity, setting technical standards and strategy for threat detection and agentic AI systems. Drives ML projects from research through production deployment, partnering with security research, engineering and product teams, while mentoring staff and contributing hands-on technical work.
CrowdStrike United Kingdom
Lead a team of data scientists applying machine learning, large language models and reverse engineering to cybersecurity problems at massive scale, handling trillions of events daily. The role blends technical leadership, roadmap planning and stakeholder alignment with hands-on work on malware detection and threat analysis.
William Scott Consulting Ltd Gerrards Cross £115,000 – £125,000 pa
Owns and matures a group information security and cyber operations function, developing the strategy and roadmap across incident management, risk, governance, compliance, resilience and assurance. Leads MDR/XDR, monitoring, threat detection and vulnerability management, sits on the IT Senior Leadership Team, and drives the function from around Maturity Level 2 to Level 4.
Square One Resources Coventry £455 pm
Designs, implements and maintains enterprise network security across on-prem, cloud and hybrid environments, leading Zero Trust and segmentation initiatives. Hands-on with enterprise firewalls, Azure/AWS network security, VPNs and secure remote access, while collaborating with SOC teams on detection and response. Contract role with three days per week on-site in Coventry.
Darktrace London
Investigates emerging cyber threats, performing in-depth malware analysis and reverse engineering while hunting for new attack trends and adversary TTPs. Produces threat intelligence reports, blogs and conference presentations, and develops data-driven methodologies and detections using Python, PowerShell or C/C++. Works hybrid, at least two days a week in the Cambridge or London office, alongside security researchers, analysts and product teams.
Darktrace Cambridge
Investigates emerging cyber threats, performing in-depth malware analysis and reverse engineering of adversary tactics, techniques and procedures. Builds data-driven threat hunting methodologies, produces intelligence reports and detections, and presents findings at conferences. Works hybrid with security researchers, analysts and product teams, at least two days a week in Cambridge or London.
Endeavour Recruitment London £115,000 – £125,000 pa
Own the information and cyber security agenda for an international organisation, defining strategy, policies and technical baselines across networks, cloud, identity and endpoints. A senior individual-contributor role without line management, working with infrastructure, technology and external providers to drive vulnerability management, monitoring, incident response and security architecture. Requires hands-on technical depth plus the ability to influence senior stakeholders.
Constant Recruitment Ltd Folkestone £45,000 – £50,000 pa
Hands-on leadership role coordinating a SOC team of around 15, prioritising alerts, acting as escalation point and supporting threat detection, investigation and incident response. Involves client service reviews, reporting, coaching analysts and improving playbooks, using Microsoft Sentinel and Defender XDR, with scope to develop people-management skills.
CBSbutler Holdings Limited trading as CBSbutler Aberdeen £650 – £720 pd
Lead and coordinate cybersecurity assessments, risk remediation and control improvements across Operational Technology environments, translating security gaps into practical remediation plans. Work with OT/ICS engineers, IT, technical authorities and third-party suppliers to strengthen critical operational systems, covering asset inventories, privileged access, network segmentation, monitoring and incident response.
MJA (London) Ltd London
Lead and develop the organisation's cyber security strategy, owning the information security framework including ISO 27001 and Cyber Essentials Plus. Reporting to the CIO, you will run security operations, manage an outsourced SOC, oversee incident response and vulnerability management, and mentor the security team. Legal-sector experience is mandatory, and the role spans Microsoft/Azure cloud security and SaaS assurance.
Cloudflare London
Acts as primary technical responder for premium enterprise customers, autonomously investigating complex threat telemetry and handling live incident response for volumetric DDoS and application-layer attacks. Implements mitigation across OSI Layers 3, 4 and 7 using Cloudflare's security suite, performs packet and traffic flow analysis, and advises customers during active incidents. Requires 24x7 rotating shifts.
Cloudflare London €68,000 – €94,000 pa
Owns the strategic roadmap for Cloudflare's Email Security product, driving differentiation against legacy incumbents and integrating with the Zero Trust stack (Gateway, CASB, DLP). Works closely with Threat Intelligence and Detections teams, engages customers directly, and evangelizes the platform internally and externally.
