Cyber Security Jobs in Manchester

• Manchester
• Hybrid · 1 day in office
• £70,000 – £75,000 pa
• Mid-level

Hands-on security engineering role focused on Microsoft security platforms, including Defender XDR, Sentinel, Purview, Defender for Cloud and Entra. You will build security monitoring, telemetry and SOAR automation, investigate incidents and embed controls into cloud and development processes alongside security, cloud and engineering teams.

Microsoft Defender XDR · Microsoft Sentinel · Microsoft Purview +5

• Manchester
• £55,000 – £75,000 pa
• Mid-level

Design, build and maintain CI/CD pipelines in Azure DevOps, automating build, test, deployment and infrastructure provisioning. Manage Azure resources with Terraform, Bicep or ARM templates, support App Services and Function Apps, and integrate testing, code quality and security tooling such as SonarCloud and Snyk. Work closely with developers and stakeholders in a collaborative, flexible team.

Azure DevOps · Azure App Services · Azure Functions +7

• Greater Manchester
• Hybrid
• £40,000 – £46,500 pa
• Mid-level
• Permanent

Hands-on security role covering SIEM, EDR, email security and vulnerability platforms, plus IDS/IPS monitoring and incident investigation. You'll embed security into project lifecycles and SDLC, work with an MSP on alert management, and support Cyber Essentials and ISO 27001 governance and third-party risk assurance.

SIEM · EDR · XDR +2

• Manchester
• Hybrid · 3 days in office
• £54,000 – £55,000 pa
• Senior

Day-to-day operation of a SIEM platform, including monitoring, administration and optimisation, plus developing detection rules and investigating alerts through to resolution. Works with Infrastructure, Networking, DevOps and external partners on incident response, EDR management and control testing, with Google SecOps (Chronicle) experience advantageous.

Google SecOps · Chronicle · SIEM +4

• Manchester
• Hybrid
• £70,000 pa
• Senior

Hands-on architecture role designing and reviewing secure networks across LAN/WAN, cloud and perimeter infrastructure, with work on segmentation, access controls and secure connectivity. You'll build centralised logging and telemetry, improve asset discovery, and run architectural risk assessments and threat modelling alongside infrastructure, operations and security teams.

Splunk · Elastic/ELK · Cribl +7

• Royal Leamington Spa
• Hybrid · 3 days in office
• £550 – £650 pd
• Senior
• Contract

Hands-on contract role owning the end-to-end detection engineering lifecycle, translating threat intelligence, hunting findings and adversary techniques into effective detection rules. Builds behavioural analytics and detection content across endpoint, identity, cloud, network and email telemetry using KQL, SPL, Sigma, Python and PowerShell, with tuning, purple teaming and Detection-as-Code work alongside SOC, IR and Red Team specialists.

Microsoft Sentinel · Splunk · Elastic +6

• London
• Hybrid
• £75,000 – £85,000 pa
• Senior
• Permanent

Hands-on cyber recovery and remediation role supporting clients through major incidents such as ransomware, destructive malware and Active Directory or cloud compromise. You lead recovery workstreams, rebuild compromised environments, remove attacker persistence and design secure recovery approaches, working alongside incident response, forensics, technology teams and client leadership. Distinct from traditional incident response, it focuses on the recovery phase and long-term resilience.

Azure · AWS · Microsoft 365 +3

• Manchester
• Hybrid · 1 day in office
• £630 pd
• Senior
• Contract

Lead cyber assurance activities across complex OT and cloud environments, assessing controls against NCSC CAF, NIST and ISO standards and running internal and external audits. Work with architects, engineering teams and risk owners to embed risk governance and challenge technical decisions on critical infrastructure. A 12-month engagement on a major cyber transformation programme.

Azure · AWS · GCP +5

• Manchester
• Hybrid · 1 day in office
• £750 – £900 pd
• Director · manages people
• Contract

Lead and mature a global manufacturer's cyber security function, owning strategy, security operations, incident response, vulnerability management and cyber risk programmes. The role involves influencing board-level stakeholders and managing third-party security providers across Microsoft Azure, Microsoft 365 and Microsoft Security environments, with one day per week on-site in Manchester.

Azure · Microsoft 365 · Microsoft Security

• Manchester
• Remote
• £550 – £650 pd
• Lead
• Contract

Lead and deliver penetration testing engagements for a public sector customer, covering complex infrastructure, cloud, containerised and enterprise environments. The role involves identifying vulnerabilities, strengthening security posture, and providing expert guidance, coaching and technical leadership to colleagues and clients.

AWS · Docker · Kubernetes

• Manchester
• Hybrid · 2 days in office

Owns the end-to-end lifecycle of security products such as IAM, EDR, SIEM and cloud security, defining roadmaps, backlogs and measurable outcomes around risk reduction and control coverage. Works with engineering, GRC and vendors to deliver usable, auditable controls, balancing risk, cost and usability while acting as the main stakeholder contact.

IAM · EDR · SIEM

• United Kingdom
• Hybrid
• Senior

Produce tactical, operational and strategic threat intelligence assessments, analysing threat actors, intrusion techniques and emerging threats. Correlate OSINT, commercial intelligence and internal telemetry, translating findings into recommendations for SOC, detection engineering, threat hunting and red team exercises, and presenting to senior stakeholders.

MITRE ATT&CK

• London
• Hybrid · 2–3 days in office
• £50,000 – £75,000 pa
• Mid-level

Client-facing security role within a UK consultancy's growing Security Architecture practice, supporting government, defence and critical infrastructure programmes. Day to day involves threat modelling, risk assessment, reviewing solution and infrastructure designs, defining security requirements and controls, and running client workshops. Suits security engineers or consultants wanting to move into architecture, with occasional client site visits rather than frequent travel.

NIST · SABSA · TOGAF +5

• London
• Hybrid
• £67,000 pa
• Permanent

Designs and implements security solutions across cloud, on-premises and hybrid environments for a global technology consultancy's client projects. Day-to-day work covers SIEM log ingestion and routing, firewall and network security management, CIS benchmark assessments, and automating security processes with Python, Bash or PowerShell, Terraform and cloud platforms. Involves client-dependent on-call support and requires British passport holders without dual nationality for clearance.

Splunk · Microsoft Sentinel · Cribl +11

• Greater Manchester
• Hybrid · 1 day in office
• £500 – £520 pd
• Senior
• Contract

Review, secure and optimise a complex Azure integration environment over an initial three-month contract, improving networking, connectivity and integration services. Day to day involves assessing vulnerabilities, tuning Azure API Management and VNet integration, troubleshooting complex issues and producing technical documentation while working with internal teams.

Azure · Azure API Management · Azure Logic Apps +5