Cyber Security Jobs

RiverSafe · London

Client-facing consulting role leading end-to-end security engagements across security architecture, cloud security, DevSecOps, application security and security operations. You'll run workshops, design controls in AWS/Azure/GCP, produce risk-based deliverables and help identify follow-on work, contributing to proposals and account growth.

Appvia · London · £75,000 – £90,000 pa

Design, build and operate secure AWS platforms using Terraform, Kubernetes/EKS and CI/CD for public and private sector clients. You will own technical delivery in your area, create reusable modules and deployment patterns, and mentor less experienced engineers within multi-disciplinary consulting teams.

DCV Technologies · Royal Leamington Spa · £550 – £650 pd

Hands-on contract role owning the end-to-end detection engineering lifecycle, translating threat intelligence, hunting findings and adversary techniques into effective detection rules. Builds behavioural analytics and detection content across endpoint, identity, cloud, network and email telemetry using KQL, SPL, Sigma, Python and PowerShell, with tuning, purple teaming and Detection-as-Code work alongside SOC, IR and Red Team specialists.

eFinancialCareers · London

Own and lead the end-to-end Threat Intelligence Platform, driving strategic design, delivery and development to maximise value across a global cyber defense organisation. Build API integrations and connectors across commercial intelligence sources, govern intelligence standards such as source reliability, confidence scoring and TLP handling, and mentor junior analysts while producing intelligence for technical and executive audiences.

Darktrace · Cambridge

Join a global team developing and improving threat detection capabilities across key product areas. You'll respond to customer incidents, analyse cyber threat intelligence, and build detection schemes aligned to adversary techniques, collaborating with Development, Security Research and SOC teams.

Sophos · United Kingdom

Senior individual contributor researching how threat actors adopt, weaponize and exploit AI, from LLM-powered social engineering to attacks on agentic AI systems. Involves instrumenting telemetry to detect adversarial AI use, automating research workflows with LLMs and Python, and publishing deep-dive intelligence externally. Works alongside CTU researchers, SophosLabs analysts, MDR threat hunters and data scientists.

Experis · Winchester · £41,000 – £50,000 pa

Monitor, triage and investigate security alerts across SIEM and wider security tooling, identifying indicators of compromise and conducting initial incident investigations. Support the full incident response lifecycle including containment, remediation and post-incident learning, while tuning detection rules to reduce false positives. Work with security and infrastructure teams on threat intelligence, trend reporting and continual service improvement.

Amazon · London

Builds and operates automation platforms that onboard threat detection, remediate security risk and accelerate incident response across every AWS account. Day to day involves designing loosely specified features, writing well-tested Python and TypeScript on AWS services, instrumenting systems for operational excellence, and participating in an on-call rotation. The team runs foundational services at very high scale with a strong 'you build it, you run it' culture.

Amazon · London

Builds and operates automation platforms that onboard threat detection, remediate security risk and accelerate incident response across every AWS account. The role spans designing loosely specified features, owning operational health through instrumentation and automation, and participating in an on-call rotation, using AWS services, Python and TypeScript at very high scale.

VIQU IT · Glasgow

Hands-on technical role leading security monitoring, incident response and threat detection using SIEM, EDR, DLP and vulnerability management tools. Acts as a technical SME, mentoring junior analysts and collaborating with global IT teams to maintain ISO 27001-aligned controls and BAU security operations.

NCC Group · Remote

Oversee Security Operations Centre activities, lead incident response efforts, and mentor a team of analysts. The role centres on cyber threat detection and incident investigation, with strong hands-on use of the Splunk Enterprise Security platform. It is a lead-level position within a remote security operations team.

Forward Role · Leeds · £54,000 – £65,000 pa

Owns day-to-day SIEM operations, defining and tuning detection rules and investigating alerts through to resolution. Runs incident response, threat intelligence and hunting, and EDR management while collaborating with Infrastructure, Networks, DevOps and an outsourced SOC. Also helps design and document security policies, standards and control test methods.

Michael Page · Liverpool · £60,000 – £65,000 pa

Investigating and responding to escalated security incidents, performing detailed event analysis and threat detection while working with external security providers. Acts as a subject matter expert supporting cyber incident response, optimising SIEM, IAM and DLP platforms, running phishing simulations and security reviews across the technology estate.

CBSbutler Holdings Limited trading as CBSbutler · London · £475 – £525 pd

Hands-on SOC and incident response role investigating cyber security threats across macOS endpoints, Linux cloud workloads, microservices and containerised environments. Responsibilities include alert triage, severity assessment, containment and remediation, telemetry correlation, evidence documentation and improving detection playbooks. On-site shift work covering 10-hour shifts between 06:00 and 16:00.

Yolk Recruitment · Cardiff · £62,000 – £72,000 pa

Hands-on security engineering role focused on building and improving controls across a Microsoft-centric estate, including Defender, Sentinel, Azure and Entra ID. Involves vulnerability management, data protection with Purview, incident response support and embedding security into projects, with influence over strategy rather than pure SOC operations.

Sophos · United Kingdom

Owns the strategy, roadmap and execution for the Endpoint Windows Platform, translating OS and security requirements into product priorities. Partners closely with Engineering, Microsoft and cross-portfolio teams on agent architecture, performance and platform change management, and supports go-to-market enablement.

Yolk Recruitment · Cardiff · £62,000 – £72,000 pa

Hands-on security engineering role within an established Cyber Resilience function, strengthening security operations across a complex technology estate. Day to day covers Microsoft Defender and Sentinel, Azure and Entra ID security, vulnerability management, Purview data protection and threat detection, plus security input into projects and architecture. Also acts as a security SME to technical and non-technical stakeholders.