Cyber Security Jobs

• Edinburgh
• Senior

Technical specialist role in Security Operations investigating complex incidents across cloud, endpoint, identity, email and network environments. Combines intelligence-led threat hunting, detection engineering and AI-assisted analysis, acting as escalation point and translating findings into lasting defensive improvements with internal teams and external providers.

Microsoft Azure · Microsoft Entra · Microsoft Defender +5

• Stirling
• Mid-level

Technical specialist role in Security Operations investigating complex incidents across cloud, endpoint, identity, email and network environments. Combines intelligence-led threat hunting, detection engineering and AI-assisted analysis, acting as escalation point and translating findings into lasting defensive improvements alongside internal teams and external providers.

Microsoft Azure · Microsoft Entra · Microsoft Defender +5

• Farnborough
• Mid-level

Monitors and investigates security alerts across a 24x7 multi-customer CSOC, analysing telemetry from SIEM, EDR and XDR platforms to determine scope, severity and business impact. Correlates logs, maps adversary behaviour to MITRE ATT&CK, runs threat hunts and tunes detections, while maintaining incident records and coordinating containment and recovery actions.

Microsoft Sentinel · Microsoft Defender XDR · Microsoft Defender Vulnerability Management +2

• London
• Mid-level

Own the full software development lifecycle for distributed systems supporting threat disruption and legal response, building data pipelines that collect and expose threat intelligence for analysts and customers. Work primarily in Golang and TypeScript with Rust, Kafka, Redis, Kubernetes, Terraform and Postgres, collaborating with Threat Intelligence, Trust & Safety, Legal and Product teams, plus on-call rotations and mentoring.

Golang · TypeScript · Rust +7

• Manchester
• Hybrid
• Permanent

Proactively hunts advanced threats across customer environments using a proprietary hunting framework, conducting intelligence-led, hypothesis-driven analysis of TTPs and behaviours. Works cross-functionally with SOC Analysts, Global Detection Engineers, Privacy and Engineering teams to align threat models and mitigate risks.

• Newport
• Hybrid
• Mid-level
• Permanent

Hands-on role managing the full lifecycle of security incidents within an international CSIRT, investigating SOC alerts and performing host forensic analysis and reverse-engineering. You will industrialise SIEM and EDR tooling, build detection use cases and automated response workflows, and support SOC Level 1 and 2 processes, including on-call crisis response.

SIEM · EDR

• Reading
• On-site
• Entry level
• Internship

Six-month graduate internship in the Falcon Complete team, working from the Reading office on security alert triage, incident investigation and response, and basic malware analysis. Interns learn the Falcon platform and internal tooling, handle customer inquiries, and deliver a project to improve security controls.

CrowdStrike Falcon

• United Kingdom
• Remote
• Senior

Senior individual contributor researching how threat actors adopt, weaponize and exploit AI, from LLM-powered social engineering to attacks on agentic AI systems. Involves instrumenting telemetry to detect adversarial AI use, automating research workflows with LLMs and Python, and publishing deep-dive intelligence externally. Works alongside CTU researchers, SophosLabs analysts, MDR threat hunters and data scientists.

SIEM · SOAR · LLMs +1

• United Kingdom
• Remote
• Mid-level

Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.

OSQuery · SQL · KQL +2

• London
• £65,000 – £79,000 pa
• Senior · manages people
• Permanent

Hands-on security leadership role managing the technical cyber security environment and SOC, owning policies, ISO 27001 implementation and incident response. Works with the Head of IT on the Cyber Security Roadmap, manages a third-party SOC and one direct report, and uses tools such as Rapid 7, Sophos MTR, Solarwinds and ServiceNow. Based at Marylebone with travel across the Chiltern network and CTC clearance required.

Rapid7 · Sophos MTR · SolarWinds +4

• Reading
• Hybrid
• Entry level
• Internship

Internship on CrowdStrike's Technical Analysis Cell, researching nation-state and criminal intrusions through reverse engineering of malware and tooling. The intern builds automation for malware analysis, creates host- and network-based detection signatures, and produces threat intelligence reporting for varied audiences.

CrowdStrike · Disassemblers · Decompilers +1

• Milton Keynes
• Remote
• £12,000 – £150,000 pa
• Director · manages people

Lead a globally distributed engineering organisation spanning cyber security, backend development, sensor infrastructure and AI-driven vulnerability research. Set technical strategy and standards while providing hands-on direction across architecture, system design and code review, and drive adoption of AI, LLMs and autonomous workflows to accelerate vulnerability discovery and exploit analysis.

LLM

• Royal Leamington Spa
• Hybrid · 3 days in office
• £550 – £650 pd
• Senior
• Contract

Hands-on contract role owning the end-to-end detection engineering lifecycle, translating threat intelligence, hunting findings and adversary techniques into effective detection rules. Builds behavioural analytics and detection content across endpoint, identity, cloud, network and email telemetry using KQL, SPL, Sigma, Python and PowerShell, with tuning, purple teaming and Detection-as-Code work alongside SOC, IR and Red Team specialists.

Microsoft Sentinel · Splunk · Elastic +6

• London
• Mid-level

Acts as primary technical responder for premium enterprise customers, autonomously investigating complex threat telemetry and handling live incident response for volumetric DDoS and application-layer attacks. Implements mitigation across OSI Layers 3, 4 and 7 using Cloudflare's security suite, performs packet and traffic flow analysis, and advises customers during active incidents. Requires 24x7 rotating shifts.

Cloudflare · Magic Transit · Magic Firewall +7

• London

The Application Security Consultant will act as a technical authority and trusted advisor to engineering and product teams, leading application security reviews, conducting various security assessments, and integrating security into the development lifecycle. The role involves working across internal IT and customer-facing products, promoting secure coding practices, and delivering security training.