Cyber Security Jobs

Sophos · United Kingdom

Senior individual contributor researching how threat actors adopt, weaponize and exploit AI, from LLM-powered social engineering to attacks on agentic AI systems. Involves instrumenting telemetry to detect adversarial AI use, automating research workflows with LLMs and Python, and publishing deep-dive intelligence externally. Works alongside CTU researchers, SophosLabs analysts, MDR threat hunters and data scientists.

Sophos · United Kingdom

Leads incident response engagements for customers hit by cyberattacks, directing a team of consultants, running kick-off and daily update calls, and delegating forensic tasks. Handles multiple ransomware and BEC investigations concurrently, performing root cause analysis and producing executive-summary reports mapped to MITRE ATT&CK.

Twinstream Limited · Bristol · £50,000 – £60,000 pa

Hands-on senior role taking operational ownership of a corporate IT estate, managing cloud services, Microsoft 365, Entra ID, networking, endpoint security and automation. Involves leading complex incident resolution, patching, backups and business continuity while mentoring colleagues and working with suppliers alongside the IT Technical Lead.

TRIA · Sheffield · £500 – £600 pd

Lead the response to high-severity IT incidents across network, infrastructure, cloud and security environments, coordinating technical teams, suppliers and stakeholders to restore services within agreed targets. The role involves chairing incident and crisis calls, post-incident reviews, root cause analysis, ITIL processes, disaster recovery and business continuity planning, plus executive reporting and on-call duties.

Exceed Cyber limited · London · £800 – £900 pd

Translate high-level SecOps transition strategies into detailed, low-level implementation plans across security engineering, threat and vulnerability management and security testing. Define operational readiness criteria, phase-gate checklists and multi-year delivery roadmaps, coordinating dependencies with architecture, GRC and technical SMEs. Requires active SC clearance and UK Government or regulated-environment experience.

DCV Technologies · Royal Leamington Spa · £550 – £650 pd

Hands-on contract role owning the end-to-end detection engineering lifecycle, translating threat intelligence, hunting findings and adversary techniques into effective detection rules. Builds behavioural analytics and detection content across endpoint, identity, cloud, network and email telemetry using KQL, SPL, Sigma, Python and PowerShell, with tuning, purple teaming and Detection-as-Code work alongside SOC, IR and Red Team specialists.

CBSbutler Holdings Limited trading as CBSbutler · Aberdeen · £650 – £720 pd

Lead and coordinate cybersecurity assessments, risk remediation and control improvements across Operational Technology environments, translating security gaps into practical remediation plans. Work with OT/ICS engineers, IT, technical authorities and third-party suppliers to strengthen critical operational systems, covering asset inventories, privileged access, network segmentation, monitoring and incident response.

GCS · United Kingdom · £750 – £850 pd

Hands-on engineering role building and securing production-grade Kubernetes clusters on bare-metal and on-premises infrastructure, spanning Linux, networking, storage and compute layers. Involves implementing security hardening, logging and observability pipelines (Fluent Bit, OpenTelemetry, Grafana), SIEM integration and EDR/vulnerability tooling, plus an on-call rota for critical infrastructure.

Creideas · Thame · £600 – £850 pd

Part-time consultant guiding a client's migration from traditional data centres to AWS, acting as an escalation point and mentor for a small team of engineers. Works closely with the CISO on security reviews and strategy, applying SIEM, EDR and vulnerability management skills. Mostly remote with occasional in-person catch-ups.

Framatome · Bristol · £63,120 – £94,680 pa

Combines deep technical cybersecurity expertise with commercial skills to build a local cybersecurity practice and drive client relationships within the UK nuclear sector. Leads market-entry strategy, develops pipelines for consulting and field services, and acts as senior subject matter expert on OT/ICS and critical infrastructure security. Also recruits and develops a local team while aligning with global business lines.

Akkodis · Hessle · £35,000 – £45,000 pa

Hands-on security operations role covering alert triage, incident response and root-cause analysis, plus tuning SIEM, EDR/XDR and monitoring tooling to cut false positives. You will drive automation and security improvement projects while liaising with a managed SOC and internal infrastructure, cloud and application teams.

Akkodis · Prudhoe · £35,000 – £45,000 pa

Hands-on security operations role covering alert triage, incident response and root-cause analysis, alongside tuning SIEM, EDR/XDR and monitoring tooling to improve detection and cut false positives. You will also drive security automation, deliver improvement projects and act as liaison with a managed SOC and internal infrastructure, cloud and application teams.

Darktrace · London

Customer-facing technical role supporting sales teams with pre-sales and post-sales engagements, including running Proof of Value exercises and presenting threat intelligence reports to audiences from technical teams to C-level executives. Also involves designing custom client integrations and defining solution architectures across network and security systems such as firewalls, IDS/IPS and SIEM.

Circle Recruitment · London · £30,000 – £45,000 pa

Hands-on SOC role monitoring and triaging SIEM, EDR and cloud alerts, investigating incidents and supporting containment and response. Also provides second-line support across Azure, AWS, identity, network and endpoint environments, with occasional on-call and shift handovers. Requires SC clearance eligibility and is majority onsite in Manchester or London.

TXP · United Kingdom · £440 – £490 pd

Monitor, investigate and respond to cyber security incidents within a Microsoft security environment, using Microsoft Sentinel and the Defender suite. The role covers alert triage, threat hunting, log and telemetry analysis, and creating and tuning Sentinel analytics rules, workbooks and detection use cases. You will also support incident response containment and recovery, produce reports, and work with infrastructure, cloud and application teams to improve SOC processes and detection engineering.