Cyber Security Jobs

• Royal Leamington Spa
• Hybrid · 3 days in office
• £550 – £650 pd
• Senior
• Contract

Hands-on contract role owning the end-to-end detection engineering lifecycle, translating threat intelligence, hunting findings and adversary techniques into effective detection rules. Builds behavioural analytics and detection content across endpoint, identity, cloud, network and email telemetry using KQL, SPL, Sigma, Python and PowerShell, with tuning, purple teaming and Detection-as-Code work alongside SOC, IR and Red Team specialists.

Microsoft Sentinel · Splunk · Elastic +6

• United Kingdom
• Hybrid
• Senior

Produce tactical, operational and strategic threat intelligence assessments, analysing threat actors, intrusion techniques and emerging threats. Correlate OSINT, commercial intelligence and internal telemetry, translating findings into recommendations for SOC, detection engineering, threat hunting and red team exercises, and presenting to senior stakeholders.

MITRE ATT&CK

• Cambridge

Join a global team developing and improving threat detection capabilities across key product areas. You'll respond to customer incidents, analyse cyber threat intelligence, and build detection schemes aligned to adversary techniques, collaborating with Development, Security Research and SOC teams.

Darktrace · GitLab

• Hessle
• Hybrid
• £35,000 – £45,000 pa
• Mid-level
• Permanent

Hands-on security operations role covering alert triage, incident response and root-cause analysis, plus tuning SIEM, EDR/XDR and monitoring tooling to cut false positives. You will drive automation and security improvement projects while liaising with a managed SOC and internal infrastructure, cloud and application teams.

Microsoft Sentinel · Microsoft Defender XDR · CrowdStrike +7

• Prudhoe
• Hybrid
• £35,000 – £45,000 pa
• Permanent

Hands-on security operations role covering alert triage, incident response and root-cause analysis, alongside tuning SIEM, EDR/XDR and monitoring tooling to improve detection and cut false positives. You will also drive security automation, deliver improvement projects and act as liaison with a managed SOC and internal infrastructure, cloud and application teams.

Microsoft Sentinel · Microsoft Defender XDR · CrowdStrike +6

• London
• Hybrid · 3 days in office
• £100,000 – £120,000 pa
• Lead · manages people
• Permanent

Hands-on leadership of an MDR security operations function, owning SLA and KPI delivery across a varied mid-market client base while line-managing SOC Analysts and Senior Analysts. Sets investigation quality standards, handles major incidents and escalations, and matures detection, runbooks and automation, including AI-assisted SOC tooling. Combines client-facing service governance with people development and pre-sales support.

Microsoft Sentinel · Microsoft Defender

• Liverpool
• Hybrid
• £60,000 – £65,000 pa
• Senior
• Contract

Act as the escalation point for an external MSSP, investigating and responding to security incidents and performing detailed event analysis to identify threats. Drive hands-on remediation, detection engineering, and security reviews across cloud and enterprise collaboration environments, using frameworks like MITRE ATT&CK. A one-year fixed-term contract with strong extension potential, hybrid across Liverpool, Glasgow, or London.

MITRE ATT&CK

• London
• Hybrid · 3 days in office
• £100,000 – £110,000 pa
• Mid-level · manages people

Leads a security operations function within a professional services firm, providing technical leadership across incident response, detection engineering and vulnerability management. Works with infrastructure, risk and third-party SOC providers, managing outsourced security suppliers and embedding security into technology projects. Hybrid role, three days a week in the City of London office.

Microsoft Azure · Entra ID · SIEM +1

• Birmingham
• Remote
• £90,000 – £95,000 pa
• Lead · manages people

Hands-on lead role split roughly 60/40 between Azure security engineering and SOC leadership, owning Sentinel, KQL detection engineering and incident response while mentoring three analysts. Involves DevSecOps tooling, IaC hardening of AKS and supply chain security across a large multi-tenant SaaS platform.

Microsoft Azure · Microsoft Sentinel · Microsoft Defender for Cloud +7

• Farnborough
• Hybrid · 2 days in office
• £75,000 – £85,000 pa
• Senior

Senior technical authority owning security architecture across SOC platforms, integrations and services, including HLDs, LLDs, controls and testing requirements. Shapes detection strategies, rules and use cases, provides architectural governance, and supports SOC maturity, assurance and accreditation (CREST) while exploring automation and AI. Works with engineers, analysts and stakeholders in Defence and National Security environments.

CREST

• Gloucestershire
• Hybrid
• £60,000 – £80,000 pa
• Mid-level
• Permanent

Investigate and respond to security incidents across endpoint, identity, network and cloud environments for a growing cyber security consultancy and MSSP. The role involves digital forensics, evidence collection, containment and recovery, plus developing IR playbooks and tabletop exercises, working alongside SOC, Threat Intelligence and Detection Engineering teams. It includes an on-call rota and occasional customer travel.

Velociraptor · KAPE · Timesketch +8

• Filton
• Hybrid
• £45,000 – £55,000 pa
• Senior

Join a defence and security organisation's Cyber Operations team to test security controls, validate SOC detection capabilities and uncover vulnerabilities before exploitation. You'll support Red Team exercises, conduct infrastructure and web application testing, produce risk reports and brief stakeholders, working alongside Threat Intelligence and Incident Response specialists.

Kali Linux · Parrot OS · Active Directory +7

• Stevenage
• On-site
• £90 – £100 ph
• Mid-level
• Contract

Hands-on security engineering role within a defence organisation's growing Cyber Security Operations function. Day to day involves managing and optimising SIEM and threat detection platforms, building automation and security playbooks, onboarding logs and data, and investigating events to improve detection coverage. Works closely with analysts and engineers on platform upgrades and lifecycle activities in a highly secure environment.

Microsoft Sentinel · Splunk · QRadar +2

• Dublin, Ireland
• Hybrid
• Senior · manages people
• Permanent

Lead a cloud-first security operations function, owning detection, investigation and response across cloud, endpoint, identity and SaaS estates. Manage a small team and an outsourced monitoring partner, drive detection tuning, and shape a measured plan for AI and automation in the SOC. The role is operational rather than shift-based, with a clear boundary from architecture.

Microsoft

• Stevenage
• On-site
• £45,000 – £50,000 pa
• Mid-level
• Shift work

Designs, configures and maintains network security solutions including next-generation firewalls, secure proxies and IDS/IPS, while supporting 24/7 incident response alongside SOC analysts. Involves analysing network traffic and packet captures, remediating vulnerabilities and standardising security tooling in a highly secure engineering environment.

Cisco · Check Point · Palo Alto +5