1 to 25 of 35 Incident Response Jobs in the North West

Incident Response Consultant - Mid to Principal - UK Wide UK Remote | Up to £95,000 + benefits | SC Eligible Pref A specialist opportunity for experienced Incident Response professionals looking to work across a varied mix of proactive and reactive Digital Forensics & Incident Response (DFIR) engagements. … This is a hands-on consulting role where you will support organisations through cyber incidents while also helping them improve their readiness, resilience and response capability before incidents occur. Working remotely across the UK, you will join a team delivering high-quality DFIR services including incident investigation, containment ...

Splunk Enterprise Security, Microsoft Sentinel, and SIEM architecture including data models, correlation rules, and administrative functions. Security Operations: Strong analytical skills in threat detection, incident response, and security event analysis with experience in large enterprise environments (10,000+ endpoints). Data Pipeline Management: Hands-on experience with … tools like Cribl, plus understanding of data normalisation and parsing in Splunk Enterprise. SOAR & Automation: Experience with Security Orchestration platforms, playbook development, and automated response workflows for incident management. Network Security Fundamentals: Working knowledge of network architectures, firewalls, proxies, and common attack vectors with troubleshooting expertise. Communication & Documentation ...

infrastructure and established a modern, cloud-first security stack, it is an exciting time to join the business as we mature our detection, response, and automation capabilities across a global estate. You will work collaboratively with the business and the wider IT team - Infrastructure, Network, Development, DevOps, and Service … with Palo Alto Cortex XSIAM and XSOAR, Cortex XDR, Microsoft Purview, Mimecast, Abnormal, Nessus, and Microsoft 365. You will participate in security investigations and incident response, responding to events involving malware, data loss, phishing, or network intrusion, and supporting our data protection and vulnerability management activity. You will ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

protective monitoring processes led directly by DVSA or its service provider. It also responds to incidents of a technical nature in line with DVSA Incident Management procedures. It restores normal service operation as quickly as possible and minimises any adverse effect on business operations. This ensures that the best … Vehicle Standards Agency - Department for Transport Careers Job description Your responsibilities will include, but aren't limited to: Leading the rapid detection, investigation, and response to cyber security incidents, ensuring threats are contained, impact is minimised, and incidents are handled in line with DVSA policies, legal requirements, and best ...

highly available cloud services. Support business stakeholders in adopting modern cloud-native architectures and security best practices. Develop and implement automation for security monitoring, incident response, remediation, and operational processes. Ensure cloud platforms comply with organisational security standards, governance requirements, and software development lifecycle practices. Identify, assess … gaps. Contribute to cloud architecture reviews, security assessments, and threat modelling activities. Work with security tooling and SIEM platforms to improve visibility, detection, and response capabilities. Support incident, problem, and change management processes while maintaining operational excellence. Develop Infrastructure as Code (IaC) solutions to standardise and automate cloud ...

/7 operation with four shift teams working in a standard rotation. They are responsible for utilising the SOC's Security Incident and Event Management (SIEM) toolsets to detect and investigate potential Security and Service Incidents occurring within the monitored networks. These roles require a minimum of SC clearance … using the Protective Monitoring platform and Internet resources to identify cyber-attacks/security incidents. Categorise all suspected incidents in line with the Security Incident policy Recognise potential, successful and unsuccessful intrusion attempts and compromises through reviews and further analysis of relevant event detail and incident summary information. ...

coverage across on-site and offshore support hours. Use SQL scripting, automation, monitoring, and observability tools to improve operational resilience, service health, reliability, and incident response. To be successful in this role, we're seeking the following: Excellent SQL scripting skills. Strong scripting and automation skills using languages such … Proven skills and track record in AI automation, including the use of intelligent automation capabilities to reduce manual effort, improve operational efficiency, and enhance incident response workflows. Experience applying AI and automation solutions for alert correlation, anomaly detection, predictive monitoring, and service optimisation. Strong understanding of Site Reliability ...

first security stack already in place, it is an exciting time to join the business and learn your craft as we mature our detection, response, and automation capabilities across a global estate. You will work alongside the wider IT team - Infrastructure, Network, Development, DevOps, and Service Desk - gaining … understanding of how security supports the business. The purpose of this role is to build a working knowledge of security operations, protective monitoring, and incident handling by working closely with, and learning from, the wider InfoSec team. Reporting to the Associate Director - Cyber Security, with day-to-day guidance ...

driven automation and blameless postmortems. Champion AI‐enabled operations using AWS Bedrock/SageMaker and Model Context Protocol (MCP) for log analysis, anomaly detection, incident triage, and workflow orchestration; establish adoption guardrails. Define and enforce cloud guardrails and security controls (SCPs/IAM boundaries, OPA policies, tagging, centralized logging … core infrastructure fundamentals (networking, storage, DNS) and APM/telemetry tooling. What Would Make You Stand Out: Practical experience with agentic AI for operations—incident triage, runbooks, and change management—with clear guardrails, auditability, and human-in-the-loop controls. Supporting AI/ML workloads at scale: SageMaker endpoints ...

Work closely with development teams to support application deployments Improve automation, monitoring and operational efficiency Optimise cloud performance and spend across multiple environments Support incident response, troubleshooting and root cause analysis Implement networking, security and disaster recovery best practices Produce clear technical documentation and infrastructure standards ...

Group Policy environments in line with recognised security standards. Apply CIS Benchmarks, STIGs and other system-hardening standards. Support security monitoring, logging, alerting and incident response using Elastic Stack and Elastic Security. Contribute to vulnerability management, root-cause analysis and remediation activity. Support security controls across VMware Cloud … Benchmarks or similar hardening standards. Knowledge of zero-trust, network segmentation, IAM, encryption and secure architecture. Experience with vulnerability management, SIEM, logging and incident response. Strong TCP/IP networking knowledge, including routing, VPNs and secure connectivity. Experience with Elastic Stack or Elastic Security would be highly advantageous. Exposure ...

within SIEM. Investigate SIEM alerts and other security incidents through to completion. Work within the Information Security Team to provide a dynamic monitoring and incident response capability. Monitor and analyse security events identifying trends, attacks, and potential threats. Identify and raise problems. Communicate & escalate these via the appropriate … documentation of security policies, solutions, standards, and processes. Designing effective test methods for logical security controls. Day to day management of Endpoint Detection and Response (EDR). REQUIREMENTS: A good understanding of technical and network security requirements. Ability to proactively identify control weakness and vulnerabilities. Knowledge ...

Implement and manage robust security protocols and procedures, identifying potential threats and vulnerabilities across operational processes Oversee regular vulnerability assessments, ensuring rapid response and ongoing improvement of penetration testing plans and methodologies Ensure clear understanding within the team of the criticality of information and technology resources to enable effective … liaison for security-related matters, maintaining strong communication with the Cyber Team Collaborate closely with IT and Cyber teams to strengthen security posture, support incident response, and contribute to security policy development (including certificate and encryption key management governance) Provide oversight for Access Management capability, managing team workload ...

cutting-edge technologies and contribute to the stability and performance of their network infrastructure. Key Responsibilities: Monitoring and Management: Oversee Monitoring Event Management and Incident Management, ensuring timely Level 1 triage of networking issues. Network Operations: Provide operational support for network environments, including switching, routing, perimeter security, traffic management … advanced tools such as Splunk, SevOne, IBM Watson AI Ops, Wireshark, NetScout, and Gigamon to identify service impacts and interpret monitors, dashboards, and logs. Incident Response: React effectively to production failures, managing triage efforts, engaging appropriate teams, and communicating with management and technical escalation. Documentation and Reporting: Maintain ...

HR. System Ownership & Architecture: Maintain end-to-end service health, lead deployment/operations, reduce system risks via clear documentation, and guide technical architecture. Incident Management & Quality: Oversee live production incident response, conduct postmortems, maintain high code standards, and participate in on-call rotations as needed. Continuous ...

HR. System Ownership & Architecture: Maintain end-to-end service health, lead deployment/operations, reduce system risks via clear documentation, and guide technical architecture. Incident Management & Quality: Oversee live production incident response, conduct postmortems, maintain high code standards, and participate in on-call rotations as needed. Continuous ...

Azure App Services, Function Apps and other services Integrate tools for automated testing, code quality and security (e.g. SonarCloud, Snyk) Set up monitoring and incident response with Azure Monitor and Application Insights Manage secrets and access control to support secure cloud practices Work closely with developers and stakeholders ...

Azure App Services, Function Apps and other services Integrate tools for automated testing, code quality and security (e.g. SonarCloud, Snyk) Set up monitoring and incident response with Azure Monitor and Application Insights Manage secrets and access control to support secure cloud practices Work closely with developers and stakeholders ...

using IaC and GitOps practicesBuild and maintain CI/CD pipelines to enable development teams to deploy applications quickly and reliablyImprove monitoring, observability and incident response to enhance system reliability and resilienceContribute to the ongoing replatforming of services towards AWS and Kubernetes, identifying opportunities to automate, improve performance ...

templates, to deploy modular and repeatable cloud resources. * Experience configuring Azure Monitor, Log Analytics, Application Insights and operational telemetry to support platform health and incident response. Azure Platform Engineer In accordance with the Employment Agencies and Employment Businesses Regulations 2003, this position is advertised based upon DGH Recruitment Limited ...

Front-end development on the web platform — React and Next.js, TypeScript throughout, consuming the GraphQL layer. Keeping production healthy: dashboards, alerting and on-call incident response using modern observability tooling. Defining and managing cloud infrastructure as code, and working with the containerised deployment setup. Owning the database layer ...

commercial agreements, including complex IT, cloud services, digital transformation, cybersecurity and product security arrangements within the company's risk tolerance Advising on cybersecurity governance, incident response preparedness, regulatory notification and disclosure requirements across multiple jurisdictions, as part of an enterprise governance framework appropriate for a US publicly traded ...