Cyber Security Jobs

Appvia · London · £75,000 – £90,000 pa

Design, build and operate secure AWS platforms using Terraform, Kubernetes/EKS and CI/CD for public and private sector clients. You will own technical delivery in your area, create reusable modules and deployment patterns, and mentor less experienced engineers within multi-disciplinary consulting teams.

RiverSafe · London

Client-facing consulting role leading end-to-end security engagements across security architecture, cloud security, DevSecOps, application security and security operations. You'll run workshops, design controls in AWS/Azure/GCP, produce risk-based deliverables and help identify follow-on work, contributing to proposals and account growth.

Experis · London · £450 – £455 pd

Hands-on SOC and incident response role monitoring, triaging and investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised platforms. You will contain and remediate incidents, document findings and evidence, and contribute to detection rules and response playbooks while working closely with security and engineering teams.

CrowdStrike · United Kingdom

Senior consultants lead front-page incident response investigations for Fortune 100 clients, conducting host and network forensics across Windows, Mac and Linux and hunting adversaries in large data sets. Work is directed by project leadership and outside counsel, producing written and verbal findings for executives, regulators and legal teams.

CrowdStrike · Spain

Serve as a senior technical consultant on front-page incident response engagements for Fortune 100 organisations, conducting intrusion investigations under project leadership and outside counsel. Perform host and network forensics across Windows, Mac and Linux, hunt threat actors in large datasets, and produce written and verbal findings for customers, regulators and legal counsel.

Airbus · Newport

Hands-on role managing the full lifecycle of security incidents within an international CSIRT, investigating SOC alerts and performing host forensic analysis and reverse-engineering. You will industrialise SIEM and EDR tooling, build detection use cases and automated response workflows, and support SOC Level 1 and 2 processes, including on-call crisis response.

CBSbutler Holdings Limited trading as CBSbutler · London · £475 – £525 pd

Hands-on SOC and incident response role investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised environments. Responsibilities include alert triage, severity assessment, containment and remediation, telemetry correlation, evidence documentation and improving detection playbooks. On-site shift work covering 10-hour shifts between 06:00 and 16:00.

Sophos · United Kingdom

Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.

eFinancialCareers · London · £650 – £750 pd

Investigate and respond to cyber security incidents across enterprise environments, triaging alerts from SIEM, EDR/XDR, cloud, identity and network tools. Conduct digital forensics, proactive threat hunting and detection tuning, coordinating containment and recovery with infrastructure, cloud and identity teams. Six-month contract within a collaborative security function defending a large enterprise.

Sophos · United Kingdom

Leads incident response engagements for customers hit by cyberattacks, directing a team of consultants, running kick-off and daily update calls, and delegating forensic tasks. Handles multiple ransomware and BEC investigations concurrently, performing root cause analysis and producing executive-summary reports mapped to MITRE ATT&CK.

Amazon · London

Lead and grow a team of security engineers and incident managers, owning incident response processes, SLAs and metrics at AWS scale. Partner with service teams on prioritisation and remediation, drive automation and process improvements, and guide architectural and technical strategy across organisations.

Palo Alto Networks · London

Lead and deliver reactive incident response engagements for clients, managing scoping, forensic investigations and containment of security incidents. Perform host-based analysis across Windows, Linux and macOS, examine firewall, web and database logs, and use tools such as EnCase, FTK, X-Ways, SIFT and Splunk to determine breach scope. Also mentors junior team members and provides remediation guidance to customers.

Amazon · Manchester

Monitors networks and systems for threats, triages security alerts and documents suspicious activity, working with partner teams on daily threat detection and incident response across AWS technologies at scale. Involves security automation, tracking detective controls like GuardDuty, CrowdStrike Falcon and Wiz Defend, and periodic on-call including weekends.

Bridewell · London

Investigate and respond to security incidents for critical national infrastructure and other clients, covering endpoint, network and cloud environments. The role spans both managed SOC services and consulting engagements, contributing to incident preparation, recovery and improving clients' security posture.

Experis · London · £500 pd

Lead end-to-end management of cyber security incidents and major security events within a secure government programme, coordinating technical response teams through containment, eradication and recovery. Act as primary point of contact for incident communications, run response bridges and war-rooms, and produce post-incident reports and root cause analysis. Works alongside SOC, analysts, infrastructure teams and third-party suppliers to improve cyber resilience.

TRIA · Sheffield · £500 – £600 pd

Lead the response to high-severity IT incidents across network, infrastructure, cloud and security environments, coordinating technical teams, suppliers and stakeholders to restore services within agreed targets. The role involves chairing incident and crisis calls, post-incident reviews, root cause analysis, ITIL processes, disaster recovery and business continuity planning, plus executive reporting and on-call duties.

ARM · Reading · £500 – £600 pd

Owns the end-to-end major incident lifecycle in a complex, multi-supplier enterprise IT environment, coordinating technical teams, suppliers and business stakeholders to restore services quickly. Drives root-cause investigations, post-incident reviews and continual service improvement, using ITIL 4 and ServiceNow. Requires active SC clearance and sole British, Italian or Japanese citizenship.