Cyber Security Jobs

• Leeds
• Hybrid · 3 days in office
• £45,000 – £50,000 pa
• Mid-level
• Permanent

Support the development and operation of security controls, analyse threat intelligence, manage vulnerabilities and help with incident response across a global technology estate. Work with Azure and Microsoft security tooling such as Sentinel, Defender and Intune, alongside SIEM, EDR and firewalls, in a hybrid Leeds team.

Microsoft Azure · Microsoft Sentinel · Microsoft Defender for Endpoint +7

• Southampton
• Hybrid · 3 days in office
• £65,000 pa
• Mid-level

Operational security role monitoring alerts, investigating incidents and maintaining controls across on-prem, cloud and SaaS environments. You'll handle firewalls, VPNs, endpoint protection, vulnerability management and secure configuration, supporting audits, pen tests and NIST/NIS compliance alongside infrastructure and service delivery teams.

Microsoft Azure · Microsoft 365 · Entra ID +7

• Abingdon
• £37,000 – £45,000 pa
• Mid-level

Hands-on security operations role within an MSP, monitoring and investigating alerts across Microsoft 365, Sophos and other platforms for both internal and client environments. Acts as a technical escalation point for the Service Desk and Infrastructure teams, covering incident response, vulnerability and patch management, tenant hardening and remediation tracking.

Microsoft 365 · Sophos · Microsoft Defender +3

• London
• Hybrid · 3 days in office
• £45,000 – £50,000 pa
• Mid-level

Supports continuous improvement of cyber security processes, tools and operational practices, including vulnerability management, threat detection and security monitoring. Works with technical teams to optimise and integrate SIEM, EDR and identity security platforms, and develops reporting to track security performance. Exposure to Microsoft Logic Apps or Power BI is advantageous.

SIEM · EDR · Microsoft Logic Apps +1

• London
• Hybrid · 2–3 days in office
• £50,000 – £75,000 pa
• Mid-level

Client-facing security role within a UK consultancy's growing Security Architecture practice, supporting government, defence and critical infrastructure programmes. Day to day involves threat modelling, risk assessment, reviewing solution and infrastructure designs, defining security requirements and controls, and running client workshops. Suits security engineers or consultants wanting to move into architecture, with occasional client site visits rather than frequent travel.

NIST · SABSA · TOGAF +5

• Bracknell
• On-site
• £599 – £600 pd
• Mid-level · manages people
• Contract · Shift work

Overseeing Security Operators on a 24/7 shift team, performing initial threat investigations with SIEM tools, monitoring for faults and anomalies, and managing incidents by identifying, prioritising and escalating threats. Requires technical leadership and enterprise IT knowledge in networking and servers, with active DV clearance.

SIEM

• Nottingham
• Hybrid
• £60,875 – £81,543 pa
• Senior
• Permanent

Independently manage operational cybersecurity activities including incident response, risk and vulnerability assessments, and security control implementation across cloud, network and endpoint environments. Maintain regulatory compliance, support audits and governance, and join an out-of-hours incident response rota.

SIEM

• Liverpool
• Hybrid
• £60,000 – £65,000 pa
• Senior
• Contract

Act as the escalation point for an external MSSP, investigating and responding to security incidents and performing detailed event analysis to identify threats. Drive hands-on remediation, detection engineering, and security reviews across cloud and enterprise collaboration environments, using frameworks like MITRE ATT&CK. A one-year fixed-term contract with strong extension potential, hybrid across Liverpool, Glasgow, or London.

MITRE ATT&CK

• Glasgow
• Hybrid · 2 days in office
• Senior

Hands-on technical role leading security monitoring, incident response and threat detection using SIEM, EDR, DLP and vulnerability management tools. Acts as a technical SME, mentoring junior analysts and collaborating with global IT teams to maintain ISO 27001-aligned controls and BAU security operations.

ServiceNow · Cherwell · Jira +1

• Sunderland
• £26,100 pa
• Junior

Support a manufacturing organisation's security team by monitoring SIEM alerts, investigating potential threats and assisting with vulnerability management across business and production systems. The role also covers access reviews, compliance with information security standards, awareness activities and risk assessments, working closely with IT, engineering and production colleagues.

SIEM

• Ashington
• £26,100 pa
• Junior

Support a manufacturing organisation's security operations by monitoring SIEM alerts, investigating potential threats and assisting with vulnerability management across business and production systems. The role involves access reviews, compliance support, awareness activities and risk assessments, working with IT, engineering and external providers to keep production disruption to a minimum.

SIEM

• Liverpool
• Hybrid
• Mid-level
• Permanent

Day-to-day work centres on information security risk assessments across technology, applications, projects and business processes, tracking mitigations and escalating significant risks. The role also covers third-party supplier due diligence, security assurance reviews, vulnerability remediation tracking, policy maintenance and incident support, working alongside Security Operations and IT teams.

ISO 27001 · NIST

• County Galway
• Hybrid · 2–3 days in office
• £45,000 – £55,000 pa
• Mid-level

Day-to-day work centres on analysing, triaging and prioritising vulnerabilities across enterprise infrastructure, applications and platforms, then coordinating remediation with infrastructure and engineering teams. The role involves reviewing threat intelligence and security advisories, producing dashboards and metrics on remediation progress, and improving vulnerability management tooling and processes within a large professional services security function.

Tenable · Qualys · Rapid7 +2

• London
• Remote
• £500 pd
• Senior
• Contract

Lead end-to-end management of cyber security incidents and major security events within a secure government programme, coordinating technical response teams through containment, eradication and recovery. Act as primary point of contact for incident communications, run response bridges and war-rooms, and produce post-incident reports and root cause analysis. Works alongside SOC, analysts, infrastructure teams and third-party suppliers to improve cyber resilience.

SIEM · EDR

• London
• On-site
• £70,000 – £75,000 pa
• Director · manages people

Lead the information security strategy for a London-based organisation, supported by a Cyber Security Analyst. Own the ISMS aligned to ISO27001, oversee risk assessments, incident response, supplier and auditor relationships, awareness training, disaster recovery testing and internal audits, working closely with senior stakeholders.