This role involves designing, building, and operating secure, scalable AWS platforms. You will work hands-on with multi-disciplinary teams, support application and platform workloads, and contribute to continuous improvement of cloud platforms and delivery pipelines.
This role involves leading technical security consulting engagements, working closely with client stakeholders to solve complex security challenges and deliver high-quality consulting outputs. The consultant will also identify and develop opportunities for follow-on work, contributing to account growth and client value.
Hands-on SOC and incident response role monitoring, triaging and investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised platforms. You will contain and remediate incidents, document findings and evidence, and contribute to detection rules and response playbooks while working closely with security and engineering teams.
A 12-week summer internship in CrowdStrike's Professional Services division focused on incident response, covering host and cloud forensics, large-scale log analysis, introductory red teaming and strategic consulting. Interns complete a dedicated IR course and run a mock engagement end to end, working fully remotely with occasional social events near London, Reading or Edinburgh.
A 12-week summer internship in CrowdStrike's Professional Services division focused on incident response, covering host and cloud forensics, large-scale log analysis, introductory red teaming and strategic consulting. Interns complete a dedicated IR course and run a mock engagement end to end, working fully remotely with occasional social events near London, Reading or Edinburgh.
Hands-on SOC and incident response role investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised environments. Responsibilities include alert triage, severity assessment, containment and remediation, telemetry correlation, evidence documentation and improving detection playbooks. On-site shift work covering 10-hour shifts between 06:00 and 16:00.
Lead complex DFIR engagements while managing a regional team of six to seven professionals, spending around 70% of time on hands-on technical delivery. Direct ransomware and business email compromise investigations across endpoint, cloud and on-premises environments, acting as senior escalation point and advising clients, legal advisers and insurers.
Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.
Leads incident response engagements for customers hit by cyberattacks, directing a team of consultants, running kick-off and daily update calls, and delegating forensic tasks. Handles multiple ransomware and BEC investigations concurrently, performing root cause analysis and producing executive-summary reports mapped to MITRE ATT&CK.
Lead and grow a team of security engineers and incident managers, owning incident response processes, SLAs and metrics at AWS scale. Partner with service teams on prioritisation and remediation, drive automation and process improvements, and guide architectural and technical strategy across organisations.
Lead and deliver reactive incident response engagements for clients, managing scoping, forensic investigations and containment of security incidents. Perform host-based analysis across Windows, Linux and macOS, examine firewall, web and database logs, and use tools such as EnCase, FTK, X-Ways, SIFT and Splunk to determine breach scope. Also mentors junior team members and provides remediation guidance to customers.
Monitors networks and systems for threats, triages security alerts and leads incident response using AWS technologies and services at massive scale. Contributes to security automation and posture improvements, tracks detective controls like GuardDuty, CrowdStrike Falcon and Wiz Defend, and requires periodic on-call including weekends.
Investigate and respond to security incidents for critical national infrastructure and other clients, covering endpoint, network and cloud environments. The role spans both managed SOC services and consulting engagements, contributing to incident preparation, recovery and improving clients' security posture.
Lead end-to-end management of cyber security incidents and major security events within a secure government programme, coordinating technical response teams through containment, eradication and recovery. Act as primary point of contact for incident communications, run response bridges and war-rooms, and produce post-incident reports and root cause analysis. Works alongside SOC, analysts, infrastructure teams and third-party suppliers to improve cyber resilience.
Owns the end-to-end major incident lifecycle in a complex, multi-supplier enterprise IT environment, coordinating technical teams, suppliers and business stakeholders to restore services quickly. Drives root-cause investigations, post-incident reviews and continual service improvement, using ITIL 4 and ServiceNow. Requires active SC clearance and sole British, Italian or Japanese citizenship.
Lead the response to high-severity IT incidents across network, infrastructure, cloud and security environments, coordinating technical teams, suppliers and stakeholders to restore services within agreed targets. The role involves chairing incident and crisis calls, post-incident reviews, root cause analysis, ITIL processes, disaster recovery and business continuity planning, plus executive reporting and on-call duties.
Governance and coordination role tracking security incidents across a complex multi-supplier SIAM environment, from identification through to closure. You coordinate updates between suppliers and security stakeholders, monitor SLAs and escalation trends, and produce incident reports, dashboards and audit-ready records. Distinct from a hands-on SOC position, with no threat hunting or technical remediation involved.
