6 of 6 MITRE ATT&CK Jobs in the South East

rules using KQL. Translate threat intelligence, attacker behaviours and operational requirements into measurable detection use cases. Map detection content to the MITRE ATT&CK framework and help identify gaps in detection coverage. Validate required log sources, schemas and field mappings before developing detection logic. Test … detection engineering principles, false-positive reduction and the detection content lifecycle. Experience developing threat-informed use cases and mapping detections to MITRE ATT&CK tactics and techniques. Ability to assess log source suitability, data quality, parsing and field availability for detection requirements. Experience with ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

automation skills (Python, Bash or similar). Experience configuring SIEM platforms. Understanding of security frameworks and threat frameworks such as MITRE ATT&CK . Desirable Experience with Microsoft Defender. Experience with additional SIEM or observability platforms. DevSecOps and CI/CD pipeline security experience. Security ...

/CD principles within secure environments Strong written reporting and technical documentation skills Understanding of threat frameworks such as MITRE ATT&CK Desirable criteria Experience working within Defence, National Security or protectively marked environments Experience with Active Directory, Windows Services, Scheduled Tasks and IIS SIEM ...

endpoint detection platforms Knowledge of identity and access management, directory services, or privileged access solutions Understanding of security frameworks such as MITRE ATT&CK Experience working in secure or regulated environments Strong problem-solving skills and ability to work at a detailed technical level Familiarity ...