Cyber Security Jobs

• London
• On-site
• £450 – £455 pd
• Mid-level
• Contract

Hands-on SOC and incident response role monitoring, triaging and investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised platforms. You will contain and remediate incidents, document findings and evidence, and contribute to detection rules and response playbooks while working closely with security and engineering teams.

macOS · Linux · Containers +4

• United Kingdom
• Remote
• Senior

Senior technical consultant conducting front-page incident response investigations for Fortune 100 clients, performing host and network forensics across Windows, Mac and Linux, hunting threat actors in large data sets, and producing written and verbal findings for customers, regulators and legal counsel.

CrowdStrike · Bro/Zeek · Suricata +6

• Spain
• Remote
• Senior

Senior technical consultant conducting front-page incident response investigations for Fortune 100 organisations, hunting adversaries across large data sets and performing host and network forensics on Windows, Mac and Linux. Works under project leadership and outside counsel, producing written and verbal findings for executives, regulators and legal counsel.

CrowdStrike · Bro/Zeek · Suricata +6

• Newport
• Hybrid
• Mid-level
• Permanent

Hands-on role managing the full lifecycle of security incidents within an international CSIRT, investigating SOC alerts and performing host forensic analysis and reverse-engineering. You will industrialise SIEM and EDR tooling, build detection use cases and automated response workflows, and support SOC Level 1 and 2 processes, including on-call crisis response.

SIEM · EDR

• London
• On-site
• £475 – £525 pd
• Contract · Shift work

Hands-on SOC and incident response role investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised environments. Responsibilities include alert triage, severity assessment, containment and remediation, telemetry correlation, evidence documentation and improving detection playbooks. On-site shift work covering 10-hour shifts between 06:00 and 16:00.

SIEM · EDR · XDR +3

• United Kingdom
• Remote
• Mid-level

Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.

OSQuery · SQL · KQL +2

• United Kingdom
• £600 pd
• Lead
• Contract

Lead the response to major and Priority 1 cyber security incidents, coordinating technical and business stakeholders during live situations and driving containment, eradication and recovery. The role involves crisis decision-making, senior stakeholder communications, incident reviews and close work with security operations, infrastructure and technology teams to build resilience.

• United Kingdom
• Remote
• Senior · manages people

Leads incident response engagements for customers hit by cyberattacks, directing a team of consultants, running kick-off and daily update calls, and delegating forensic tasks. Handles multiple ransomware and BEC investigations concurrently, performing root cause analysis and producing executive-summary reports mapped to MITRE ATT&CK.

Splunk · ELK · Sophos

• London
• Director · manages people
• Permanent

Lead and grow a team of security engineers and incident managers, owning incident response processes, SLAs and metrics at AWS scale. Partner with service teams on prioritisation and remediation, drive automation and process improvements, and guide architectural and technical strategy across organisations.

AWS

• London
• Remote
• Lead

Lead and deliver reactive incident response engagements for clients, managing scoping, forensic investigations and containment of security incidents. Perform host-based analysis across Windows, Linux and macOS, examine firewall, web and database logs, and use tools such as EnCase, FTK, X-Ways, SIFT and Splunk to determine breach scope. Also mentors junior team members and provides remediation guidance to customers.

EnCase · FTK · X-Ways +5

• Manchester
• Entry level
• Permanent

Monitors networks and systems for threats, triages security alerts and documents suspicious activity, working with partner teams on daily threat detection and incident response across AWS technologies at scale. Involves security automation, tracking detective controls like GuardDuty, CrowdStrike Falcon and Wiz Defend, and periodic on-call including weekends.

AWS · Amazon GuardDuty · CrowdStrike Falcon +1

• Gloucestershire
• Hybrid
• £60,000 – £80,000 pa
• Mid-level
• Permanent

Investigate and respond to security incidents across endpoint, identity, network and cloud environments for a growing cyber security consultancy and MSSP. The role involves digital forensics, evidence collection, containment and recovery, plus developing IR playbooks and tabletop exercises, working alongside SOC, Threat Intelligence and Detection Engineering teams. It includes an on-call rota and occasional customer travel.

Velociraptor · KAPE · Timesketch +8

• London
• Hybrid
• Senior
• Permanent

Investigate and respond to security incidents for critical national infrastructure and other clients, covering endpoint, network and cloud environments. The role spans both managed SOC services and consulting engagements, contributing to incident preparation, recovery and improving clients' security posture.

SIEM

• London
• Remote
• £500 pd
• Senior
• Contract

Lead end-to-end management of cyber security incidents and major security events within a secure government programme, coordinating technical response teams through containment, eradication and recovery. Act as primary point of contact for incident communications, run response bridges and war-rooms, and produce post-incident reports and root cause analysis. Works alongside SOC, analysts, infrastructure teams and third-party suppliers to improve cyber resilience.

SIEM · EDR

• Sheffield
• Hybrid · 2–3 days in office
• £500 – £600 pd
• Senior
• Contract

Lead the response to high-severity IT incidents across network, infrastructure, cloud and security environments, coordinating technical teams, suppliers and stakeholders to restore services within agreed targets. The role involves chairing incident and crisis calls, post-incident reviews, root cause analysis, ITIL processes, disaster recovery and business continuity planning, plus executive reporting and on-call duties.

Cisco · VMware · ServiceNow +3