416 jobs for “Security Operations Specialist”
NCC Group
Oversee Security Operations Centre activities, lead incident response efforts, and mentor a team of analysts. The role centres on cyber threat detection and incident investigation, with strong hands-on use of the Splunk Enterprise Security platform. It is a lead-level position within a remote security operations team.
Splunk Enterprise Security
Bridewell · 51–200 people · Series B
Owns the technical relationship between a customer and their managed security service, handling queries, escalations, projects and service improvements. Requires deep Microsoft Security stack knowledge and collaboration with customers and their suppliers to evolve Security Operations capabilities. The role is designed to integrate closely with other Managed Security Service functions, promoting cross-team collaboration and thought leadership.
Microsoft Security
Experis · 501–1000 people · Late stage
Monitor, triage and investigate security alerts across SIEM and wider security tooling, identifying indicators of compromise and conducting initial incident investigations. Support the full incident response lifecycle including containment, remediation and post-incident learning, while tuning detection rules to reduce false positives. Work with security and infrastructure teams on threat intelligence, trend reporting and continual service improvement.
Microsoft Sentinel · Microsoft Defender · QRadar +2
Back TO Work
Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and keeping critical financial data secure. Day to day involves monitoring security alerts, reviewing logs, investigating incidents, maintaining documentation and supporting security testing and compliance activities.
Back TO Work
Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and keeping critical financial data secure. Day to day involves monitoring security alerts, reviewing logs, investigating incidents, and maintaining documentation, with hands-on exposure to security monitoring tools and incident management processes.
NCC Group
Monitor, detect, investigate and respond to cyber security threats using the Splunk Enterprise Security toolset. Day-to-day work centres on analysing alerts, investigating incidents and helping strengthen the organisation's cyber defence capabilities within a security operations team.
Splunk Enterprise Security · Splunk
A&O Shearman
Hands-on role investigating escalated security alerts, triaging and responding to cyber incidents, and gathering forensic evidence following established playbooks. You'll work with a global follow-the-sun team across time zones, support security tooling and process improvement, and participate in an on-call rota with rotational evening and weekend shifts.
SIEM · IDS/IPS · EDR +7
Akkodis
Hands-on security operations role covering alert triage, incident response and root-cause analysis, plus tuning SIEM, EDR/XDR and monitoring tooling to cut false positives. You will drive automation and security improvement projects while liaising with a managed SOC and internal infrastructure, cloud and application teams.
Microsoft Sentinel · Microsoft Defender XDR · CrowdStrike +7
Akkodis
Hands-on security operations role covering alert triage, incident response and root-cause analysis, alongside tuning SIEM, EDR/XDR and monitoring tooling to improve detection and cut false positives. You will also drive security automation, deliver improvement projects and act as liaison with a managed SOC and internal infrastructure, cloud and application teams.
Microsoft Sentinel · Microsoft Defender XDR · CrowdStrike +6
Risk Ledger
Owns the entire IT estate for a cybersecurity SaaS company, covering identity and access management, macOS device management, SaaS administration and end-to-end joiners, movers and leavers. An engineering-led role focused on automation, AI enablement and security controls that support SOC 2, ISO 27001 and Cyber Essentials Plus audits, working alongside the Director of Information Security and a Senior SecOps Engineer.
macOS · MDM · SSO +6
Fynity
Investigating and triaging complex security alerts across SIEM, EDR, network traffic and log data, supporting incident response and escalation. Threat hunting using MITRE ATT&CK, developing detection rules and playbooks, and producing incident reports. Fully on-site in Farnborough on a 24/7 shift pattern supporting defence and national security environments.
Microsoft Sentinel · Splunk · Elastic +2
Sophos
Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.
OSQuery · SQL · KQL +2
Sophos
Senior individual contributor researching how threat actors adopt, weaponize and exploit AI, from LLM-powered social engineering to attacks on agentic AI systems. Involves instrumenting telemetry to detect adversarial AI use, automating research workflows with LLMs and Python, and publishing deep-dive intelligence externally. Works alongside CTU researchers, SophosLabs analysts, MDR threat hunters and data scientists.
SIEM · SOAR · LLMs +1
CrowdStrike · 1001–5000 people · Public
Builds AI agents and automated workflows that help Counter Adversary Operations analysts investigate threats, enrich detections and act on intelligence. Combines Python development and REST API integration with CrowdStrike's Charlotte AI and Falcon Fusion SOAR, testing agents for accuracy and safety and partnering closely with analysts.
CrowdStrike Falcon · Charlotte AI · Falcon Fusion SOAR +7
CrowdStrike · 1001–5000 people · Public
Builds AI agents and automated workflows that help threat analysts investigate, enrich and act on intelligence across the Falcon platform and third-party tools. Combines Python development and REST API integration with LLM and SOAR tooling, testing agents for accuracy and safety before they reach customer environments.
CrowdStrike Falcon · Charlotte AI · Falcon Fusion SOAR +7
