Cyber Security Jobs

• United Kingdom
• Remote
• Lead

Serve as technical lead on front-page incident response engagements for Fortune 100 organisations, conducting intrusion investigations under outside counsel and performing host and network forensics across Windows, Mac and Linux. The role also involves hunting threat actors in large datasets, cloud IR in AWS, Azure or GCP, and communicating findings to executives, regulators and legal teams.

CrowdStrike · AWS · Azure +6

• Sheffield
• £55,000 – £60,000 pa
• Senior

Senior escalation point for complex technical issues, leading infrastructure and cloud project delivery for clients and internal systems. Runs discovery workshops, produces designs and statements of work, and acts as technical lead on Priority 1 incidents, while mentoring engineers and setting technical standards.

Microsoft 365 · Azure · Entra ID +7

• London
• Remote
• Lead · manages people

Lead strategic advisor for enterprise customers modernising their Security Operations Centres through XSIAM deployment, covering log ingestion, detection engineering and automation. The role combines executive-level consulting with hands-on SIEM/SOAR/EDR technical work, mentoring professional services teams and feeding field insights back to Product and R&D. Requires security clearance eligibility and up to 30% travel.

XSIAM · Splunk · IBM QRadar

• United Kingdom
• Remote
• Entry level

As an Associate Consultant on the Platform Professional Services team, you'll act as a trusted advisor helping customers operationalize Falcon Next-Gen SIEM, answering technical questions, demonstrating capabilities, and laying out a roadmap. You'll work with log management, XDR and SOAR features alongside other Falcon engineers and cross-functional teams, feeding customer insights back to product management.

CrowdStrike Falcon · Falcon Next-Gen SIEM · Falcon LogScale +7

• London
• Mid-level

Deploy, integrate and optimise AI-driven cybersecurity across network, cloud, OT and email environments for post-sales customers. Handle deployment projects to SLOs, resolve support tickets and act as a trusted advisor on security infrastructure design, liaising with sales, customer success and operations.

AWS · Microsoft · Cisco +2

• London
• On-site
• Mid-level

Deliver 2nd line support for laptops, desktops, applications and peripherals across a London hub, managing tickets and resolving issues at first contact. Administer Active Directory and Microsoft 365, handle onboarding and access provisioning, run patching and monitoring checks, and support security tooling such as SentinelOne, Qualys and Mimecast alongside a central IT function.

Microsoft 365 · Active Directory · Windows 11 +5

• Glasgow
• Hybrid · 2 days in office
• Senior

Hands-on technical role leading security monitoring, incident response and threat detection using SIEM, EDR, DLP and vulnerability management tools. Acts as a technical SME, mentoring junior analysts and collaborating with global IT teams to maintain ISO 27001-aligned controls and BAU security operations.

ServiceNow · Cherwell · Jira +1

• London
• Hybrid · 1–2 days in office
• £750 – £850 pd
• Senior
• Contract

Strategic advisory and architecture role supporting a major network transformation for an international professional services organisation. Involves assessing existing network security environments, defining vendor-neutral target architectures and guardrails, evaluating Zero Trust, SASE/SSE, SD-WAN and segmentation, and translating decisions into procurement-ready requirements and supplier evaluation criteria.

SASE · SSE · SD-WAN +3

• London
• £75,000 – £110,000 pa

This role involves conducting manual penetration testing and security assessments of web applications, APIs, and enterprise platforms. You will identify and exploit vulnerabilities, produce detailed technical reports, and work closely with application owners and security stakeholders to improve the organization's cyber resilience.

• London
• Hybrid · 3 days in office
• £100,000 – £110,000 pa
• Mid-level · manages people

Leads a security operations function within a professional services firm, providing technical leadership across incident response, detection engineering and vulnerability management. Works with infrastructure, risk and third-party SOC providers, managing outsourced security suppliers and embedding security into technology projects. Hybrid role, three days a week in the City of London office.

Microsoft Azure · Entra ID · SIEM +1

• County Galway
• Hybrid · 2–3 days in office
• £45,000 – £55,000 pa
• Mid-level

Day-to-day work centres on analysing, triaging and prioritising vulnerabilities across enterprise infrastructure, applications and platforms, then coordinating remediation with infrastructure and engineering teams. The role involves reviewing threat intelligence and security advisories, producing dashboards and metrics on remediation progress, and improving vulnerability management tooling and processes within a large professional services security function.

Tenable · Qualys · Rapid7 +2

• London
• Director · manages people

Lead and develop the organisation's cyber security strategy, owning the information security framework including ISO 27001 and Cyber Essentials Plus. Reporting to the CIO, you will run security operations, manage an outsourced SOC, oversee incident response and vulnerability management, and mentor the security team. Legal-sector experience is mandatory, and the role spans Microsoft/Azure cloud security and SaaS assurance.

Microsoft Azure · SOC

• Liverpool
• Hybrid
• £60,000 – £65,000 pa
• Senior
• Contract

Investigating and responding to escalated security incidents, performing detailed event analysis and threat detection while working with external security providers. Acts as a subject matter expert supporting cyber incident response, optimising SIEM, IAM and DLP platforms, running phishing simulations and security reviews across the technology estate.

SIEM · IAM · DLP +1

• Liverpool
• Hybrid
• £60,000 – £65,000 pa
• Senior
• Contract

Act as the escalation point for an external MSSP, investigating and responding to security incidents and performing detailed event analysis to identify threats. Drive hands-on remediation, detection engineering, and security reviews across cloud and enterprise collaboration environments, using frameworks like MITRE ATT&CK. A one-year fixed-term contract with strong extension potential, hybrid across Liverpool, Glasgow, or London.

MITRE ATT&CK

• London
• Hybrid
• Senior · manages people
• Permanent

Client-facing consulting role helping complex organisations assess cyber risk and turn priorities into transformation roadmaps. You'll lead multidisciplinary teams across strategy, governance, risk and operating model engagements, working with frameworks such as NIST CSF, ISO 27001, NCSC CAF, CRI and NIS2 alongside CISO and CIO-level stakeholders.

NIST CSF · ISO 27001 · NCSC CAF +2