66 jobs for “Soc Detection Engineer”
NCC Group
Monitor, detect, investigate and respond to cyber security threats using the Splunk Enterprise Security toolset. Day-to-day work centres on analysing alerts, investigating incidents and helping strengthen the organisation's cyber defence capabilities within a security operations team.
Splunk Enterprise Security · Splunk
Radius Consultancy
Strengthen and maintain cyber security posture through assurance, incident response coordination, vulnerability management and governance. Work with frameworks including ISO 27001, SOC2, NIST and GDPR, overseeing MSSP and SOC activities, with technical involvement in investigations, threat analysis and major incidents.
EDR · SIEM · NDR +1
Vocative Consulting
First line of defence for day-to-day security hygiene at a SaaS vendor: patching the Windows estate, monitoring CrowdStrike, and assessing the impact of new vulnerabilities. Works closely with the infrastructure team, with a structured route into Azure and wider cloud security engineering.
CrowdStrike · Microsoft Defender · Azure +2
Vallum Associates
Hands-on cyber security engineering role protecting IT, OT, applications and infrastructure, acting as the local interface with central SOC, CERT and specialist teams. Responsibilities span implementing and operating controls (EDR, IAM, MFA, PAM, network segmentation, cloud, logging), vulnerability management and remediation, incident investigation support, and OT/ICS security using IEC 62443 and the NCSC CAF.
EDR · IAM · MFA +4
Experis · 501–1000 people · Late stage
Lead end-to-end management of cyber security incidents and major security events within a secure government programme, coordinating technical response teams through containment, eradication and recovery. Act as primary point of contact for incident communications, run response bridges and war-rooms, and produce post-incident reports and root cause analysis. Works alongside SOC, analysts, infrastructure teams and third-party suppliers to improve cyber resilience.
SIEM · EDR
HAYS Specialist Recruitment · 1001–5000 people · Public
Hands-on security architecture role across cloud, applications, APIs and infrastructure, with responsibility for PCI DSS 4.0 compliance, audit evidence and SOC 2 governance. Works closely with engineering, platform and product teams in a predominantly GCP and Kubernetes/GKE environment to drive DevSecOps and shift-left practices and reduce security debt.
GCP · GKE · AWS +5
Safran · 501–1000 people · Late stage
Lead information security across multiple UK sites for a defence and aerospace manufacturer, owning accreditation, compliance and incident response. Act as the key security point of contact within a global matrix, driving frameworks such as NCSC CAF, ITAR and export control, and supporting secure-by-design across IT, engineering and industrial teams. Requires regular UK and international travel.
NCSC CAF · IGI 1300
Cloudflare
Identifies, analyses and supports remediation of vulnerabilities across Cloudflare's infrastructure and cloud environments, triaging findings from Qualys, Nessus and Rapid7 against defined SLAs. Works with engineering, infrastructure and compliance teams on DoD IL4 and FedRAMP preparation, using AI-driven tooling to improve scanning, triage and automated remediation.
Qualys · Nessus · Rapid7 InsightVM +2
Darktrace · 2001–5000 people · Late stage
Deploy, integrate and optimise AI-driven cybersecurity across network, cloud, OT and email environments for post-sales customers. Handle deployment projects to SLOs, resolve support tickets and act as a trusted advisor on security infrastructure design, liaising with sales, customer success and operations.
AWS · Microsoft · Cisco +2
Adria Solutions
Own AWS infrastructure, CI/CD pipelines and observability for a new fintech platform, reporting to the CTO. Hands-on work spans Terraform IaC, Kubernetes, security controls, incident response and PCI-DSS/FCA compliance, with significant influence over tooling and scaling decisions in an early-stage team.
AWS · Terraform · Docker +1
Identify Solutions
Hands-on role taking technical ownership of cyber security across a predominantly Microsoft environment, working with an infrastructure team and external SOC partners. Day to day involves assessing the estate for security gaps, hardening systems, operating Defender/XDR, EDR and Sentinel, managing Entra ID access controls, and responding to incidents and vulnerabilities.
Microsoft Sentinel · SIEM · SOC +3
Hays Technology
Security Architect role shaping security across a cloud-native environment, working closely with Architecture, Engineering, Product and Operations teams. Focus areas include GCP security, Kubernetes, DevSecOps, application and API security, identity, resilience and compliance (PCI DSS, GDPR, ISO 27001, SOC 2). Strong commercial GCP and Kubernetes experience is essential.
GCP · Kubernetes · API Gateways +4
Click Digital
Lead the design of an enterprise third-site disaster recovery capability, assessing existing backup and resilience, defining RTO/RPO requirements and producing HLDs and LLDs. The role covers backup, replication, immutable storage and cyber recovery across VMware, Windows, Linux and Kubernetes/OpenShift, with technical workshops and architectural governance.
VMware · Active Directory · SQL Server +5
Palo Alto Networks
Senior technical product engineer role advising partners, customers and internal teams on cloud-native security, Cortex capabilities and SOC automation. Involves cross-functional projects, product roadmap feedback, and building playbooks and integrations across AWS, Azure and GCP.
AWS · Azure · GCP +3
E.ON
Owns cyber security compliance across PCI-DSS, the Smart Energy Code, Retail Energy Code and ITGC, managing external audits end-to-end. Leads protective monitoring with SOC/CERT and managed service providers, vulnerability management and penetration testing, and incident response up to Board level. Also mentors junior colleagues and supports DevSecOps teams with threat assessments and IaC reviews.
Splunk · Microsoft Sentinel · Qualys +7
