217 jobs for “Incident Response Analyst”
Darktrace London
Customer-facing role combining technical depth and commercial awareness to drive adoption of AI cybersecurity products across DACH enterprise accounts. Partners with security and IT stakeholders on technical success plans, use-case activation, health monitoring and renewal readiness, working alongside Account Executives, Solutions Engineering and Renewals. Requires fluency in German and English.
CrowdStrike United Kingdom
Hands-on SRE role focused on CrowdStrike's Commercial Cloud, covering operational ownership of availability, latency, throughput, monitoring, incident response and capacity planning across thousands of bare metal servers and VMs. Involves building automation and tooling in C++, Java, Python or Go, working with monitoring stacks like Prometheus, Grafana and ELK, and joining a global on-call rotation.
CrowdStrike United Kingdom
Senior consultants lead front-page incident response investigations for Fortune 100 clients, conducting host and network forensics across Windows, Mac and Linux and hunting adversaries in large data sets. Work is directed by project leadership and outside counsel, producing written and verbal findings for executives, regulators and legal teams.
Cloudflare London
Acts as primary technical responder for premium enterprise customers, autonomously investigating complex threat telemetry and handling live incident response for volumetric DDoS and application-layer attacks. Implements mitigation across OSI Layers 3, 4 and 7 using Cloudflare's security suite, performs packet and traffic flow analysis, and advises customers during active incidents. Requires 24x7 rotating shifts.
Amazon London
Respond to security incidents across AWS cloud services, triaging issues and driving internal teams to timely remediation while balancing technical and business risk. Build internal automation tools and utilities, mentor junior staff, and share on-call responsibilities. Works within AWS Cloud Response, coordinating multi-team responses and publishing guidance for customer-impacting issues.
Michael Page Liverpool £60,000 – £65,000 pa
Investigating and responding to escalated security incidents, performing detailed event analysis and threat detection while working with external security providers. Acts as a subject matter expert supporting cyber incident response, optimising SIEM, IAM and DLP platforms, running phishing simulations and security reviews across the technology estate.
NCC Group Remote
Designs, builds and maintains security automations that detect, investigate and respond to cyber threats, working closely with Incident Response to identify improvements and create new playbooks. Delivers scalable automation within the Splunk ecosystem, covering advanced analytics, scripting, new use cases, validation of automation behaviour and documentation, plus mentoring junior engineers.
TXP United Kingdom £440 – £490 pd
Monitor, investigate and respond to cyber security incidents within a Microsoft security environment, using Microsoft Sentinel and the Defender suite. The role covers alert triage, threat hunting, log and telemetry analysis, and creating and tuning Sentinel analytics rules, workbooks and detection use cases. You will also support incident response containment and recovery, produce reports, and work with infrastructure, cloud and application teams to improve SOC processes and detection engineering.
TrueWatch Dublin, Ireland £77,691 – £86,324 pa
Maintains reliability, availability and performance of cloud infrastructure, monitoring production environments and managing observability tooling for metrics, logs and alerts. Handles incident response, root cause analysis and post-incident reviews, while automating deployments with IaC and CI/CD and optimising AWS, Azure or GCP resources. Works with engineering and platform teams on scalability, security compliance and capacity planning.
Carbon 60 Stevenage £70 – £75 ph
Day-to-day BAU support, administration and configuration management across Windows infrastructure and workplace environments, including patching, change implementation and asset documentation. Acts as Tier 2/Tier 3 escalation for complex Windows issues, handling incident response, root cause analysis, monitoring, backups and security compliance. Requires active DV clearance and 100% onsite work in a highly secure, restricted environment.
Amtis Professional Cheshire West and Chester £50,000 – £55,000 pa
Hands-on role strengthening an organisation's ability to respond to, recover from and learn from cyber incidents. Combines practical system recovery and resilience testing with maintaining Business Continuity, Incident Response and Cyber Recovery plans, plus stakeholder coordination across IT and the wider business. Involves analysing system dependencies, incident reviews and producing resilience documentation.
Astute People Benfleet
Supports the compliance and integrity of control and information systems at a gas-fired power station, covering security strategy, policies, risk assessments, audits and incident response. Works with the Cyber Security Manager on OT security, ISA/IEC 62443 standards and regulatory frameworks, plus Management of Change and RCA investigations.
Radius Consultancy London £80,000 – £90,000 pa
Strengthen and maintain cyber security posture through assurance, incident response coordination, vulnerability management and governance. Work with frameworks including ISO 27001, SOC2, NIST and GDPR, overseeing MSSP and SOC activities, with technical involvement in investigations, threat analysis and major incidents.
Hays Technology Leeds £65,000 – £70,000 pa
Lead a cyber security team day to day, covering resource planning, rotas and performance management, while overseeing incident response, vulnerability management and cloud security migration. Act as escalation point for security incidents and lead war-gaming exercises within an ITIL and ISO 27001 framework, requiring hands-on Azure security expertise.
Hays Technology London £644 pd
Senior technical authority providing leadership across a large-scale AWS platform estate, covering cloud infrastructure, applications, ingest pipelines and live services. Defines engineering standards, governance and assurance, owns platform reliability and leads major incident response for critical 24/7 services, coordinating multiple teams and suppliers.
