1 to 25 of 53 Incident Response Jobs in the North of England

Incident Response Consultant - Mid to Principal - UK Wide UK Remote | Up to £95,000 + benefits | SC Eligible Pref A specialist opportunity for experienced Incident Response professionals looking to work across a varied mix of proactive and reactive Digital Forensics & Incident Response (DFIR) engagements. … This is a hands-on consulting role where you will support organisations through cyber incidents while also helping them improve their readiness, resilience and response capability before incidents occur. Working remotely across the UK, you will join a team delivering high-quality DFIR services including incident investigation, containment ...

knowledge with clear communication. You will help turn complex cyber security information into practical advice, reports, evidence and improvement actions. You will also support incident response, vulnerability management, assurance activity and the development of cyber security controls, policies and procedures. Main duties of the job This role would … such as Microsoft 365, Azure, Entra ID, Intune and Defender would be helpful. We would also welcome experience of areas such as vulnerability management, incident response, SIEM or Managed Detection and Response services, supplier assurance, cyber security frameworks or NHS information governance requirements. At NTW Solutions ...

Splunk Enterprise Security, Microsoft Sentinel, and SIEM architecture including data models, correlation rules, and administrative functions. Security Operations: Strong analytical skills in threat detection, incident response, and security event analysis with experience in large enterprise environments (10,000+ endpoints). Data Pipeline Management: Hands-on experience with … tools like Cribl, plus understanding of data normalisation and parsing in Splunk Enterprise. SOAR & Automation: Experience with Security Orchestration platforms, playbook development, and automated response workflows for incident management. Network Security Fundamentals: Working knowledge of network architectures, firewalls, proxies, and common attack vectors with troubleshooting expertise. Communication & Documentation ...

infrastructure and established a modern, cloud-first security stack, it is an exciting time to join the business as we mature our detection, response, and automation capabilities across a global estate. You will work collaboratively with the business and the wider IT team - Infrastructure, Network, Development, DevOps, and Service … with Palo Alto Cortex XSIAM and XSOAR, Cortex XDR, Microsoft Purview, Mimecast, Abnormal, Nessus, and Microsoft 365. You will participate in security investigations and incident response, responding to events involving malware, data loss, phishing, or network intrusion, and supporting our data protection and vulnerability management activity. You will ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

Cyber Assessment Framework and its application to organisational security. \n Understanding of NIS2, GDPR and the Data Protection Act. \n Experience developing and testing incident response and business continuity plans. \n Strong understanding of cyber security risk, governance, controls and remediation. \n Excellent stakeholder management and communication skills. … information security activities. \n Work collaboratively with internal teams and external partners to deliver security initiatives and improvements. \n Develop, review and rehearse incident response plans, ensuring the organisation is prepared to detect, investigate and respond effectively to cyber incidents and data breaches. \n Work with relevant teams ...

fintech. They're looking for a Senior Security Operations Analyst to sit at the heart of their Information Security function, owning threat detection and incident response at real scale. Senior Security Operations Analyst Salary - £54,000 - £65,000 + bonus Location - Manchester or Leeds - Hybrid The opportunity SIEM … Networks, DevOps and an outsourced SOC. Threat intelligence & hunting - monitor intelligence from multiple sources, identify trends and emerging threats, and lead coordinated hunting activity. Incident response - analyse, contain, and remediate security incidents, communicating clearly across teams and escalating where needed. EDR - day-to-day interaction with the Endpoint ...

mitigate any risk. You will also be expected to maintain an awareness of the changing threat landscape and industry standards. Proactively work with Incident Response and Engineering to identify tactics and techniques used by threats actors and opportunities to improve the security of our environment. Propose and support … exercises. Ensure all relevant vulnerabilities are correctly triaged, risk assessed, logged and assigned to remediation teams. Support remediation teams with remediation strategies. Assist Incident Response team with the investigation and resolution of Security Incidents when required. Create and maintain operation procedures, configuration and technical documentation to a high ...

protective monitoring processes led directly by DVSA or its service provider. It also responds to incidents of a technical nature in line with DVSA Incident Management procedures. It restores normal service operation as quickly as possible and minimises any adverse effect on business operations. This ensures that the best … Vehicle Standards Agency - Department for Transport Careers Job description Your responsibilities will include, but aren't limited to: Leading the rapid detection, investigation, and response to cyber security incidents, ensuring threats are contained, impact is minimised, and incidents are handled in line with DVSA policies, legal requirements, and best ...

protective monitoring processes led directly by DVSA or its service provider. It also responds to incidents of a technical nature in line with DVSA Incident Management procedures. It restores normal service operation as quickly as possible and minimises any adverse effect on business operations. This ensures that the best … Vehicle Standards Agency - Department for Transport Careers Job description Your responsibilities will include, but aren't limited to: Leading the rapid detection, investigation, and response to cyber security incidents, ensuring threats are contained, impact is minimised, and incidents are handled in line with DVSA policies, legal requirements, and best ...

Principles of Cyber Security, Level 2) equips you with the practical skills employers are actively seeking. From threat intelligence and security testing to incident response and ethical compliance, you ll gain hands-on experience that prepares you for today s fast-growing cyber security and IT roles. … Understand cyber security principles and core frameworks Threat Intelligence: Develop expertise to identify risks Testing: Conduct cyber security testing, identify vulnerabilities and implement controls Incident Response: Prepare for and respond to cyber security incidents Ethics: Understand legislation and ethical conduct within cyber security Professional Skills: Build professional skills ...

Principles of Cyber Security, Level 2) equips you with the practical skills employers are actively seeking. From threat intelligence and security testing to incident response and ethical compliance, you’ll gain hands-on experience that prepares you for today’s fast-growing cyber security and IT roles. … Understand cyber security principles and core frameworks Threat Intelligence: Develop expertise to identify risks Testing: Conduct cyber security testing, identify vulnerabilities and implement controls Incident Response: Prepare for and respond to cyber security incidents Ethics: Understand legislation and ethical conduct within cyber security Professional Skills: Build professional skills ...

highly available cloud services. Support business stakeholders in adopting modern cloud-native architectures and security best practices. Develop and implement automation for security monitoring, incident response, remediation, and operational processes. Ensure cloud platforms comply with organisational security standards, governance requirements, and software development lifecycle practices. Identify, assess … gaps. Contribute to cloud architecture reviews, security assessments, and threat modelling activities. Work with security tooling and SIEM platforms to improve visibility, detection, and response capabilities. Support incident, problem, and change management processes while maintaining operational excellence. Develop Infrastructure as Code (IaC) solutions to standardise and automate cloud ...

/7 operation with four shift teams working in a standard rotation. They are responsible for utilising the SOC's Security Incident and Event Management (SIEM) toolsets to detect and investigate potential Security and Service Incidents occurring within the monitored networks. These roles require a minimum of SC clearance … using the Protective Monitoring platform and Internet resources to identify cyber-attacks/security incidents. Categorise all suspected incidents in line with the Security Incident policy Recognise potential, successful and unsuccessful intrusion attempts and compromises through reviews and further analysis of relevant event detail and incident summary information. ...

/7 operation with four shift teams working in a standard rotation. They are responsible for utilising the SOC's Security Incident and Event Management (SIEM) toolsets to detect and investigate potential Security and Service Incidents occurring within the monitored networks. These roles require a minimum of SC clearance … using the Protective Monitoring platform and Internet resources to identify cyber-attacks/security incidents. Categorise all suspected incidents in line with the Security Incident policy Recognise potential, successful and unsuccessful intrusion attempts and compromises through reviews and further analysis of relevant event detail and incident summary information. ...

coverage across on-site and offshore support hours. Use SQL scripting, automation, monitoring, and observability tools to improve operational resilience, service health, reliability, and incident response. To be successful in this role, we're seeking the following: Excellent SQL scripting skills. Strong scripting and automation skills using languages such … Proven skills and track record in AI automation, including the use of intelligent automation capabilities to reduce manual effort, improve operational efficiency, and enhance incident response workflows. Experience applying AI and automation solutions for alert correlation, anomaly detection, predictive monitoring, and service optimisation. Strong understanding of Site Reliability ...

first security stack already in place, it is an exciting time to join the business and learn your craft as we mature our detection, response, and automation capabilities across a global estate. You will work alongside the wider IT team - Infrastructure, Network, Development, DevOps, and Service Desk - gaining … understanding of how security supports the business. The purpose of this role is to build a working knowledge of security operations, protective monitoring, and incident handling by working closely with, and learning from, the wider InfoSec team. Reporting to the Associate Director - Cyber Security, with day-to-day guidance ...

Engineer Role Overview We are looking for a Senior Cloud Network SRE/Cloud Platform Engineer with strong expertise in GCP/AWS networking, incident management, Kubernetes, and platform reliability engineering . The ideal candidate should be capable of troubleshooting complex cloud networking issues, leading production incident resolution … Peer-to-Peer communication . Support and manage Kubernetes platforms (GKE/EKS) . Build and maintain monitoring, alerting, and observability solutions. Perform incident response, problem management, and Root Cause Analysis (RCA). Automate operational tasks using Python and Shell scripting . Manage Infrastructure as Code (Terraform ...

driven automation and blameless postmortems. Champion AI‐enabled operations using AWS Bedrock/SageMaker and Model Context Protocol (MCP) for log analysis, anomaly detection, incident triage, and workflow orchestration; establish adoption guardrails. Define and enforce cloud guardrails and security controls (SCPs/IAM boundaries, OPA policies, tagging, centralized logging … core infrastructure fundamentals (networking, storage, DNS) and APM/telemetry tooling. What Would Make You Stand Out: Practical experience with agentic AI for operations—incident triage, runbooks, and change management—with clear guardrails, auditability, and human-in-the-loop controls. Supporting AI/ML workloads at scale: SageMaker endpoints ...

Work closely with development teams to support application deployments Improve automation, monitoring and operational efficiency Optimise cloud performance and spend across multiple environments Support incident response, troubleshooting and root cause analysis Implement networking, security and disaster recovery best practices Produce clear technical documentation and infrastructure standards ...

Group Policy environments in line with recognised security standards. Apply CIS Benchmarks, STIGs and other system-hardening standards. Support security monitoring, logging, alerting and incident response using Elastic Stack and Elastic Security. Contribute to vulnerability management, root-cause analysis and remediation activity. Support security controls across VMware Cloud … Benchmarks or similar hardening standards. Knowledge of zero-trust, network segmentation, IAM, encryption and secure architecture. Experience with vulnerability management, SIEM, logging and incident response. Strong TCP/IP networking knowledge, including routing, VPNs and secure connectivity. Experience with Elastic Stack or Elastic Security would be highly advantageous. Exposure ...