Cyber Security Jobs

• United Kingdom
• Remote
• Entry level

Monitors and performs in-depth analysis of security alerts on the CrowdStrike platform, handling incidents across Windows, Mac and Linux, including malware analysis and remote remediation. Works in a virtual security operations centre, responding to threats in real time and producing written and verbal findings for customer management.

CrowdStrike · Windows · Mac OS +6

• Winchester
• On-site
• £41,000 – £50,000 pa
• Mid-level

Monitor, triage and investigate security alerts across SIEM and wider security tooling, identifying indicators of compromise and conducting initial incident investigations. Support the full incident response lifecycle including containment, remediation and post-incident learning, while tuning detection rules to reduce false positives. Work with security and infrastructure teams on threat intelligence, trend reporting and continual service improvement.

Microsoft Sentinel · Microsoft Defender · QRadar +2

• Ireland
• Remote
• Mid-level

Analyzes large-scale security telemetry, threat intelligence feeds and detection data to surface trends, anomalies and emerging threats, and builds dashboards and reporting workflows in SQL, Python and Logscale. Works cross-functionally with product and data engineering teams to turn raw security data into actionable insights and KPIs for the Office of Adversary Strategy.

LogScale · Tableau · Power BI +2

• Manchester
• Remote
• Mid-level
• Permanent

Monitor, detect and respond to cyber incidents for customers from a 24/7 Global Security Operations Centre, working with the Microsoft Security Stack, Splunk, EDR, IDS and IPS tools integrated into a Unified Cyber Platform. The L2 role sits within an MXDR team of over 100 accredited experts handling hundreds of millions of log events daily.

Microsoft Security Stack · Splunk · EDR +3

• Bath
• Hybrid · 2 days in office
• £30,000 pa
• Entry level

Join a technical operations team conducting cybercrime incident response, classifying malicious websites, apps, emails and phone numbers, and communicating findings to customers and affected parties. The role involves shift work covering weekends, with hybrid flexibility from a Bath office, and full training is provided for candidates without prior cybersecurity experience.

Udemy · Coursera

• Newcastle upon Tyne
• Remote
• £35,000 – £45,000 pa
• Mid-level
• Shift work

Investigating and responding to security incidents at 2nd Line level, monitoring customer environments and SIEM alerts, and threat hunting across a Microsoft security stack including Sentinel, Defender and Entra. Uses KQL and PowerShell for investigations and automation, acts as an escalation point for junior analysts, and supports vulnerability assessment and remediation. Initially on a 4-on, 4-off night shift pattern before moving to an 8-hour shift model.

Microsoft Sentinel · Microsoft Defender · Microsoft Entra

• London
• Mid-level

Hands-on incident response role covering detection, triage, investigation, containment and recovery of cyber incidents in a complex enterprise environment. Day to day involves monitoring SIEM and EDR/XDR alerts, analysing logs, packet captures and forensic images, threat hunting, and mapping activity to MITRE ATT&CK. Also maintains playbooks, evidence records and post-incident reports, and briefs senior stakeholders.

Microsoft Sentinel · Defender XDR · Defender for Identity +7

• London
• Hybrid · 3 days in office
• £45,000 – £50,000 pa
• Mid-level

Supports continuous improvement of cyber security processes, tools and operational practices, including vulnerability management, threat detection and security monitoring. Works with technical teams to optimise and integrate SIEM, EDR and identity security platforms, and develops reporting to track security performance. Exposure to Microsoft Logic Apps or Power BI is advantageous.

SIEM · EDR · Microsoft Logic Apps +1

• London
• On-site
• £30,000 – £45,000 pa
• Mid-level

Hands-on SOC role monitoring and triaging SIEM, EDR and cloud alerts, investigating incidents and supporting containment and response. Also provides second-line support across Azure, AWS, identity, network and endpoint environments, with occasional on-call and shift handovers. Requires SC clearance eligibility and is majority onsite in Manchester or London.

Microsoft Sentinel · ELK Stack · Azure +7

• Remote
• Remote
• Mid-level
• Contract

Monitor, detect, investigate and respond to cyber security threats using the Splunk Enterprise Security toolset. Day-to-day work centres on analysing alerts, investigating incidents and helping strengthen the organisation's cyber defence capabilities within a security operations team.

Splunk Enterprise Security · Splunk

• Manchester
• Hybrid · 3 days in office
• £54,000 – £55,000 pa
• Senior

Day-to-day operation of a SIEM platform, including monitoring, administration and optimisation, plus developing detection rules and investigating alerts through to resolution. Works with Infrastructure, Networking, DevOps and external partners on incident response, EDR management and control testing, with Google SecOps (Chronicle) experience advantageous.

Google SecOps · Chronicle · SIEM +4

• Nottingham
• £26,100 pa
• Junior

Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and keeping critical financial data secure. Day to day involves monitoring security alerts, reviewing logs, investigating incidents, maintaining documentation and supporting security testing and compliance activities.

• Sutton-in-Ashfield
• £26,100 pa
• Junior

Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and keeping critical financial data secure. Day to day involves monitoring security alerts, reviewing logs, investigating incidents, and maintaining documentation, with hands-on exposure to security monitoring tools and incident management processes.

• Newport
• Hybrid
• Mid-level
• Permanent

Hands-on role managing the full lifecycle of security incidents within an international CSIRT, investigating SOC alerts and performing host forensic analysis and reverse-engineering. You will industrialise SIEM and EDR tooling, build detection use cases and automated response workflows, and support SOC Level 1 and 2 processes, including on-call crisis response.

SIEM · EDR

• Nottingham
• Hybrid
• £60,875 – £81,543 pa
• Senior
• Permanent

Independently manage operational cybersecurity activities including incident response, risk and vulnerability assessments, and security control implementation across cloud, network and endpoint environments. Maintain regulatory compliance, support audits and governance, and join an out-of-hours incident response rota.

SIEM