19 of 19 MITRE ATT&CK Jobs in the South East

delivered in a consistent and scalable way. Working directly with customers, you will define detection strategies, design use cases aligned to MITRE ATT&CK, and guide improvements in visibility, coverage and response maturity. You will work closely with platform onboarding and engineering teams, supplementing them … SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real‐world attack techniques Map customer log sources to detection use cases to assess coverage and identify gaps Design ...

delivered in a consistent and scalable way. Working directly with customers, you will define detection strategies, design use cases aligned to MITRE ATT&CK, and guide improvements in visibility, coverage and response maturity. You will work closely with platform onboarding and engineering teams, supplementing them … rulesets across SIEM and XDR platformsDevelop and tune detection logic using KQL or equivalent query languagesDesign detection use cases aligned to MITRE ATT&CK and real-world attack techniquesMap customer log sources to detection use cases to assess coverage and identify gapsDesign and implement SOAR ...

team. Tools: Azure, Active Directory, CrowdStrike Falcon, Zscaler, Vulnerability Management (Qualys, Tenable Nessus, Rapid7), Incident Response ownership experience & Playbooks/Mitre Att&ck) Demonstrable experience leading cyber security incident response (incident command), from detection through containment and remediation. Working knowledge of MITRE ATT … prioritisation of the Endpoint, Platform and Incident Response backlog, ordered against the enterprise cyber risk register and exploitation-based intelligence (e.g. MITRE ATT&CK). Curate the backlog from inputs across Houston and London, including the endpoint detection and response (CrowdStrike) execution lead. Maintain alignment ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

teams and vendors to ensure high-quality telemetry Detection Engineering Design and implement detection use cases aligned to frameworks such as MITRE ATT&CK Build and tune correlation rules, alerts, dashboards, and anomaly detections Continuously improve detection quality and reduce false positives SOC & Incident Response … networks, Windows/Linux systems, cloud platforms (Azure, AWS, GCP), identity systems, and endpoint security tools Knowledge of frameworks such as MITRE ATT&CK and threat hunting methodologies Essential Requirements Degree (or equivalent experience) in a computing or related discipline Proven experience across IT infrastructure ...

security-related programmes through data analysis, assessments and reporting. Apply common analysis techniques and frameworks, including Kill Chain, Pyramid of Pain, MITRE ATT&CK and Diamond Model, to enhance threat detection and response capabilities. Contribute to the strategic, operational and tactical components of the Intelligence … tools and platforms, including Recorded Future, OpenCTI, Cribl and Splunk. Knowledge of threat modelling techniques, including Kill Chain, Pyramid of Pain, MITRE ATT&CK and Diamond Model. Strong analytical and problem-solving skills, with the ability to identify and prioritise actionable intelligence. Experience working with ...

will be responsible for producing an executive summary-style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team-player attitude with a willingness to share knowledge ...

Analyse network traffic, endpoint activity, logs and alerts to uncover malicious behaviour. Drive continuous improvement of detection capabilities aligned to the MITRE ATT&CK framework. Enhance SOC processes, tooling, playbooks and operational effectiveness. Mentor and develop analysts, helping build the next generation of cyber security … mentoring analysts in an operational security environment. It would be great if you had: Detection engineering or threat-informed defence experience. MITRE ATT&CK framework knowledge. Python, PowerShell or Bash scripting skills. Malware analysis or reverse engineering exposure. CREST, Blue Team Level 1 or similar ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

vulnerability management and security remediation Experience working with recognised security frameworks including: NIST ISO 27001 CIS Controls Cyber Essentials Knowledge of MITRE ATT&CK, Cyber Kill Chain and modern threat intelligence methodologies Excellent analytical, troubleshooting and stakeholder management skills Technical Environment Experience with several ...

including TCP/IP, DNS, firewalls, and proxies. Experience within a SOC, NOC, or 24/7 operational environment. Familiarity with MITRE ATT&CK, CVEs, and vulnerability management. Exposure to cloud security monitoring across Azure, AWS, or Microsoft 365. Desirable Certifications Microsoft SC-200 CompTIA ...

Security Information and Event Management (SIEM) platforms Security Orchestration, Automation and Response (SOAR) solutions Threat intelligence and threat modelling frameworks, including MITRE ATT&CK and Cyber Kill Chain Network security, operating systems and security technologies Microsoft security technologies, including Microsoft Defender and Purview Data Loss ...

Sentinel Familiarity with Microsoft Defender tools (Endpoint & O365) Exposure to Azure cloud logging and Kubernetes environments Knowledge of attacker TTPs and MITRE ATT&CK frameworks Proactive, collaborative, and innovative mindset Desirable/Nice-to-Have: Experience with Python , Terraform , or CI/CD pipelines Familiarity ...

technologies, including IDS/IPS, EDR, ATP, malware protection, and monitoring platforms. Experience with threat hunting methodologies and familiarity with the MITRE ATT&CK framework preferred. Working knowledge of incident response processes, adversary tactics and techniques, and cyber threat intelligence. Strong technical expertise in Windows ...

Operations’ function.• Define and maintain the RESPOND capability taxonomy, mapped to NIST CSF (Respond/Recover), NIST SP 800-61r3, MITRE ATT&CK, and D3FEND.• Set roadmap and strategy for SOAR platforms (Splunk SOAR, Microsoft Sentinel SOAR/Logic Apps), case management, evidence collection ...

automation skills (Python, Bash or similar). Experience configuring SIEM platforms. Understanding of security frameworks and threat frameworks such as MITRE ATT&CK . Desirable Experience with Microsoft Defender. Experience with additional SIEM or observability platforms. DevSecOps and CI/CD pipeline security experience. Security ...

trust or network access security technologies. Performed vulnerability assessment, exposure analysis or remediation prioritisation across enterprise technology environments. Applied threat intelligence, MITRE ATT&CK or exploitation-based evidence to prioritise mitigations. Supported or led cyber security investigations and incident response activities. Collaborated with infrastructure, cloud ...

/CD principles within secure environments Strong written reporting and technical documentation skills Understanding of threat frameworks such as MITRE ATT&CK Desirable criteria Experience working within Defence, National Security or protectively marked environments Experience with Active Directory, Windows Services, Scheduled Tasks and IIS SIEM ...