Cyber Security Jobs

• London
• Mid-level

Acts as primary technical responder for premium enterprise customers, autonomously investigating complex threat telemetry and handling live incident response for volumetric DDoS and application-layer attacks. Implements mitigation across OSI Layers 3, 4 and 7 using Cloudflare's security suite, performs packet and traffic flow analysis, and advises customers during active incidents. Requires 24x7 rotating shifts.

Cloudflare · Magic Transit · Magic Firewall +7

• London
• Senior

Builds and operates Cloudflare's Chromium-based browser isolation engine, working across C++, Rust, Go and TypeScript on remote rendering, streaming and distributed session services. The role spans systems programming, distributed systems and security, leading multi-component initiatives and on-call incident response.

Chromium · Cloudflare Workers · Nomad +3

• Aarhus, Denmark
• Remote
• Senior
• Permanent

Owns major components of the Windows kernel-mode endpoint sensor, architecting and building anti-virus and EDR features that cut across file system, memory, process and networking subsystems. Works on cross-platform deliverables with shared components across Windows, Mac and Linux, leading projects from design through delivery and demo.

Windows · Mac · Linux +1

• London
• Remote
• Senior
• Permanent

Builds and owns major components of the Falcon endpoint sensor, a Windows kernel-mode driver that observes system activity, detects malicious behaviour and provides on-box prevention plus telemetry to the cloud. Work spans OS internals such as file system, memory, process and networking, with cross-platform components shared across Windows, Mac and Linux.

Windows · Mac · Linux +1

• Ashington
• £26,100 pa
• Junior

Support a manufacturing organisation's security operations by monitoring SIEM alerts, investigating potential threats and assisting with vulnerability management across business and production systems. The role involves access reviews, compliance support, awareness activities and risk assessments, working with IT, engineering and external providers to keep production disruption to a minimum.

SIEM

• London
• Hybrid · 2 days in office
• £115,000 – £125,000 pa
• Director

Own the information and cyber security agenda for an international organisation, defining strategy, policies and technical baselines across networks, cloud, identity and endpoints. A senior individual-contributor role without line management, working with infrastructure, technology and external providers to drive vulnerability management, monitoring, incident response and security architecture. Requires hands-on technical depth plus the ability to influence senior stakeholders.

Microsoft Azure · Microsoft 365 · Google Enterprise +3

• United Kingdom
• Hybrid
• Mid-level

Joins the Information Security Service Delivery team to assess, design, configure and integrate security technology controls, acting as a technical escalation point for security concepts. Works hands-on with Zscaler, Okta, Crowdstrike, cloud and endpoint security, threat modelling and security architecture frameworks, ensuring designs meet policies and regulatory requirements.

Zscaler · Okta · CrowdStrike +5

• Leeds

Deliver continuous security testing across customer external attack surfaces, combining automated scanning with hands-on manual assessment. Validate scanner findings, chain vulnerabilities to demonstrate realistic attack paths, and produce proof-of-concepts and remediation advice. Work directly with customers while contributing to internal tooling and methodology.

Burp Suite Professional · SQLMap · Python +7

• Stevenage
• On-site
• £45,000 – £50,000 pa
• Mid-level
• Shift work

Designs, configures and maintains network security solutions including next-generation firewalls, secure proxies and IDS/IPS, while supporting 24/7 incident response alongside SOC analysts. Involves analysing network traffic and packet captures, remediating vulnerabilities and standardising security tooling in a highly secure engineering environment.

Cisco · Check Point · Palo Alto +5

• London
• Mid-level
• Permanent

Detect and mitigate invalid traffic and ad fraud across Amazon's advertising network by reverse-engineering malware, inspecting network traffic and hunting threats, including on the dark web. The role blends security engineering, botnet mitigation and intelligence sharing with teams across Amazon, requiring creativity and judgement in a highly ambiguous fraud landscape.

• Bradford
• Hybrid · 2 days in office
• £45,000 – £50,000 pa
• Mid-level
• Permanent

Hands-on role operating, monitoring and improving cyber security controls across infrastructure, cloud, endpoints, identity, networks and business systems. Day to day covers alert triage and incident response, vulnerability scanning and remediation tracking, hardening and patch assurance, Entra ID and Microsoft cloud security, plus email/web controls and Cyber Essentials support. Joins a newly formed, growing technical team on a hybrid basis.

Entra ID · Microsoft 365 · Conditional Access +6

• London
• £90,000 – £110,000 pa
• Senior

Hands-on platform role spanning platform engineering, SRE, developer experience and DevSecOps. You'll build and maintain cloud infrastructure in AWS and GCP with Terraform and container orchestration, create CI/CD pipelines and self-service golden paths, and embed shift-left security, observability and SRE practices across a small, growing platform team.

AWS · GCP · Grafana +7

• London
• Hybrid
• £70,000 – £80,000 pa
• Lead

Hands-on owner of governance, risk and compliance, maintaining the ISO 27001 ISMS, leading external audits and taking SOC 2 from Type 1 to Type 2. Owns the enterprise risk framework and risk register, manages compliance tooling and supports customer security questionnaires, working across engineering, sales and leadership.

Risk Ledger

• London
• Hybrid
• Lead · manages people

Lead a newly formed backend team owning several key products, including an integration layer for SIEM platforms, a system engaging conversational scammers at scale, and email analysis for phishing detection. Split time between hands-on engineering (30-50%) and managing a delivery roadmap, modernising legacy platforms while commercialising new ones.

Go · OpenSearch · MongoDB +5

• London
• Hybrid · 2–3 days in office
• £50,000 – £75,000 pa
• Mid-level

Client-facing security role within a UK consultancy's growing Security Architecture practice, supporting government, defence and critical infrastructure programmes. Day to day involves threat modelling, risk assessment, reviewing solution and infrastructure designs, defining security requirements and controls, and running client workshops. Suits security engineers or consultants wanting to move into architecture, with occasional client site visits rather than frequent travel.

NIST · SABSA · TOGAF +5