Cyber Security Jobs

• Winchester
• On-site
• £41,000 – £50,000 pa
• Mid-level

Monitor, triage and investigate security alerts across SIEM and wider security tooling, identifying indicators of compromise and conducting initial incident investigations. Support the full incident response lifecycle including containment, remediation and post-incident learning, while tuning detection rules to reduce false positives. Work with security and infrastructure teams on threat intelligence, trend reporting and continual service improvement.

Microsoft Sentinel · Microsoft Defender · QRadar +2

• Manchester
• Remote
• Mid-level
• Permanent

Monitor, detect and respond to cyber incidents for customers from a 24/7 Global Security Operations Centre, working with the Microsoft Security Stack, Splunk, EDR, IDS and IPS tools integrated into a Unified Cyber Platform. The L2 role sits within an MXDR team of over 100 accredited experts handling hundreds of millions of log events daily.

Microsoft Security Stack · Splunk · EDR +3

• Remote
• Remote
• Mid-level
• Contract

Monitor, detect, investigate and respond to cyber security threats using the Splunk Enterprise Security toolset. Day-to-day work centres on analysing alerts, investigating incidents and helping strengthen the organisation's cyber defence capabilities within a security operations team.

Splunk Enterprise Security · Splunk

• Nottingham
• £26,100 pa
• Junior

Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and keeping critical financial data secure. Day to day involves monitoring security alerts, reviewing logs, investigating incidents, maintaining documentation and supporting security testing and compliance activities.

• Sutton-in-Ashfield
• £26,100 pa
• Junior

Support the monitoring and protection of business systems for a growing financial services organisation, identifying security threats and keeping critical financial data secure. Day to day involves monitoring security alerts, reviewing logs, investigating incidents, and maintaining documentation, with hands-on exposure to security monitoring tools and incident management processes.

• Farnborough
• On-site
• £48,000 – £58,000 pa
• Senior
• Shift work

Investigating and triaging complex security alerts across SIEM, EDR, network traffic and log data, supporting incident response and escalation. Threat hunting using MITRE ATT&CK, developing detection rules and playbooks, and producing incident reports. Fully on-site in Farnborough on a 24/7 shift pattern supporting defence and national security environments.

Microsoft Sentinel · Splunk · Elastic +2

• London
• Hybrid · 3 days in office
• £100,000 – £120,000 pa
• Lead · manages people
• Permanent

Hands-on leadership of an MDR security operations function, owning SLA and KPI delivery across a varied mid-market client base while line-managing SOC Analysts and Senior Analysts. Sets investigation quality standards, handles major incidents and escalations, and matures detection, runbooks and automation, including AI-assisted SOC tooling. Combines client-facing service governance with people development and pre-sales support.

Microsoft Sentinel · Microsoft Defender

• Liverpool
• Hybrid
• £60,000 – £65,000 pa
• Senior
• Contract

Act as the escalation point for an external MSSP, investigating and responding to security incidents and performing detailed event analysis to identify threats. Drive hands-on remediation, detection engineering, and security reviews across cloud and enterprise collaboration environments, using frameworks like MITRE ATT&CK. A one-year fixed-term contract with strong extension potential, hybrid across Liverpool, Glasgow, or London.

MITRE ATT&CK

• Birmingham
• Remote
• £90,000 – £95,000 pa
• Lead · manages people

Hands-on lead role split roughly 60/40 between Azure security engineering and SOC leadership, owning Sentinel, KQL detection engineering and incident response while mentoring three analysts. Involves DevSecOps tooling, IaC hardening of AKS and supply chain security across a large multi-tenant SaaS platform.

Microsoft Azure · Microsoft Sentinel · Microsoft Defender for Cloud +7

• Stevenage
• On-site
• £45,000 – £50,000 pa
• Mid-level
• Shift work

Designs, configures and maintains network security solutions including next-generation firewalls, secure proxies and IDS/IPS, while supporting 24/7 incident response alongside SOC analysts. Involves analysing network traffic and packet captures, remediating vulnerabilities and standardising security tooling in a highly secure engineering environment.

Cisco · Check Point · Palo Alto +5

• Bromley
• Hybrid
• £55,000 – £62,000 pa
• Mid-level
• Permanent

Operational security role focused on monitoring alerts across endpoints, identities, email and cloud using Rapid7 SIEM, Microsoft Defender and Sophos. You will triage and investigate incidents such as malware, phishing and identity compromise, tune detection tooling, and help build incident response playbooks and runbooks.

Microsoft Defender · Microsoft 365 Defender · Entra ID +7

• London
• Remote
• Lead · manages people

Lead strategic advisor for enterprise customers modernising their Security Operations Centres through XSIAM deployment, covering log ingestion, detection engineering and automation. The role combines executive-level consulting with hands-on SIEM/SOAR/EDR technical work, mentoring professional services teams and feeding field insights back to Product and R&D. Requires security clearance eligibility and up to 30% travel.

XSIAM · Splunk · IBM QRadar

• United Kingdom
• Remote
• Mid-level

Performs advanced investigative, forensic and containment work during active cyber incidents for Managed Detection and Response customers, correlating alerts and telemetry to establish scope and root cause. Mentors junior IR and SOC analysts, maintains engagement documentation and playbooks, and supports Incident Advisors with validated technical findings. Includes weekend and holiday rotation cover.

OSQuery · SQL · KQL +2

• Newport
• Hybrid
• Mid-level
• Permanent

Hands-on role managing the full lifecycle of security incidents within an international CSIRT, investigating SOC alerts and performing host forensic analysis and reverse-engineering. You will industrialise SIEM and EDR tooling, build detection use cases and automated response workflows, and support SOC Level 1 and 2 processes, including on-call crisis response.

SIEM · EDR

• Filton
• Hybrid
• £45,000 – £55,000 pa
• Senior

Join a defence and security organisation's Cyber Operations team to test security controls, validate SOC detection capabilities and uncover vulnerabilities before exploitation. You'll support Red Team exercises, conduct infrastructure and web application testing, produce risk reports and brief stakeholders, working alongside Threat Intelligence and Incident Response specialists.

Kali Linux · Parrot OS · Active Directory +7