1 to 25 of 457 Incident Response Jobs in the UK excluding London

firm's cybersecurity lawyers. The global team have experience advising clients on hundreds of incidents. Leveraging this experience, they feedback practical lessons learned into clients' cyber risk management and incident response programmes. What you will do Reporting to the global Head of Cyber Defence, the Cyber Defence and Security Operations Manager is a key role within the firm … a team of senior analysts and analysts, providing guidance and direction to protect the organisation's information assets and infrastructure from cyber threats. This will include: Security Monitoring and Incident Response Establish a positive and collaborative working relationship with your Managed Security Service Provider (MSSP) who performs Level 1 monitoring of our global security alerts and events. Orchestrate … data from multiple sources, to quickly assess potential incidents, their scope, and impact. Achieve deep understanding of the available toolsets and how to operate them to best effect in incident prevention, detection and response, providing feedback to the security architecture and engineering team about how they can be optimised. Make decisions on the implementation of containment measures at More ❯

will focus on creating a business strategy, gap analysis and implementation, for securing their Azure-based infrastructure, integrating security automation, ensuring PCI DSS compliance, vulnerability and penetration testing and incident response. This role will focus on developing and maintaining secure, scalable Azure DevOps pipelines and Infrastructure as Code (IaC) using Terraform. Their ideal candidate will have a strong background … every stage. Cloud Security Implementation: Leverage Azure Security Centre, Microsoft Defender for Cloud, and Microsoft Sentinel for advanced security monitoring. Threat Detection & SOAR Automation: Oversee Security Orchestration, Automation, and Response (SOAR) solutions including SOC Prime. Network & Application Security: Manage Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Vulnerability & Penetration Testing: Review Penetration Testing, vulnerability assessments, and security … proactively identify and remediate risks. PCI DSS Compliance: Conduct security audits, risk assessments, and ensure regulatory compliance. DNS Security: Implement and monitor DNS security solutions to prevent cyber threats. Incident Response: Formulating and documenting a solid process utilising a 3rd party support partner Security Monitoring & Logging: Develop SIEM solutions, logging strategies, and real-time threat intelligence. Monitor, audit More ❯

to continuously improve the college's overall security posture and stay ahead of evolving threats. •Work closely with the Help Desk and IT Security Team to provide customer support, incident response, and corrective actions. Includes training Help Desk staff in the Defender Security portal and basic triage procedures. •Create technical documentation for systems, policies, and procedures, including internal … security processes, phishing response procedures, and vendor security evaluation protocols. •Consult with the IT Security Team on policy development and maintenance, particularly in alignment with NIST 800-171 and Microsoft best practices. Drive effective and reasonable policies and practices to secure protected and sensitive data and ensure information security and compliance with relevant legislation. Monitor compliance with and contribute … Familiarity with common enterprise systems, security tools, and best practices in risk mitigation. •Knowledge in areas including firewalls, IDS/IPS, VPN, remote access, security logging, vulnerability management, security incident response, and penetration testing. •Preferred qualifications include relevant Information Security Certifications, and experience with NIST 800-171, and HECVAT. •A demonstrated ability to analyze and respond to security More ❯

security solutions (firewalls, SIEM, IDS/IPS, endpoint protection, cloud security). Shape strategic security recommendations and collaborate on technical win plans. Maintain and update security policies, procedures, and incident response plans. Deliver security awareness training and advise clients on best practices. Support audits and compliance initiatives (ISO 27001, NIST, GDPR, etc.). Work cross-functionally with internal … with SIEM, EDR, VPNs, firewalls, and cloud platforms (AWS, Azure, GCP). Expertise in Microsoft Sentinel, Cisco Splunk or Palo Alto QRadar, and KQL. Proven skills in threat detection, incident response, and forensic analysis. Knowledge of SOAR tools (especially Palo Alto XSOAR or similar). Familiarity with compliance standards: ISO 27001, NIST, CIS, GDPR, HIPAA. Bonus: scripting/ More ❯

high a level of security operations delivery function Oversee and enhance security monitoring systems to detect and analyse potential security incidents. Conduct real-time analysis of security events and incident and escalate as necessary Support other teams on investigations into incidents, determining the root cause and impact. Document findings and lessons learned to improve incident response procedures. … Ensure runbooks are followed and are fit for purpose Incident Response: Lead and coordinate incident response activities to effectively contain, eradicate, and recover from security incidents. Develop and maintain incident response plans, ensuring they align with industry best practices. Escalation management in the event of a security incident Follow major incident process … to other analysts. Working with the Technical Teams to ensure all new and changed services are monitored accordingly Documentation: Maintain accurate and up-to-date documentation of security procedures, incident response plans, and analysis reports. Create post-incident reports for management and stakeholders. Support the creation of monthly reporting packs as per contractual requirements. Create and document More ❯

high a level of security operations delivery function Oversee and enhance security monitoring systems to detect and analyse potential security incidents. Conduct real-time analysis of security events and incident and escalate as necessary Support other teams on investigations into incidents, determining the root cause and impact. Document findings and lessons learned to improve incident response procedures. … Ensure runbooks are followed and are fit for purpose Incident Response: Lead and coordinate incident response activities to effectively contain, eradicate, and recover from security incidents. Develop and maintain incident response plans, ensuring they align with industry best practices. Escalation management in the event of a security incident Follow major incident process … to other analysts. Working with the Technical Teams to ensure all new and changed services are monitored accordingly Documentation: Maintain accurate and up-to-date documentation of security procedures, incident response plans, and analysis reports. Create post-incident reports for management and stakeholders. Support the creation of monthly reporting packs as per contractual requirements. Create and document More ❯

ISO 42001, GDPR, and DORA. This role focuses on internal audits, regulatory compliance, and readiness for external audits while also contributing to Cybersecurity Operations Center (CSOC) activities, including incident monitoring and response. How will you make an impact? Internal Audit Execution: Conduct internal audits to evaluate and enhance IT controls, compliance with standards, and risk management processes. Audit Preparation … audit teams to streamline processes and provide requested documentation and evidence. Security Monitoring: Use tools such as Rapid7 InsightIDR or other SIEM solutions to assist with security monitoring and incident detection. Incident Response Support: Participate in incident response efforts, documenting security incidents and assisting in containment and recovery actions. Threat Identification: Contribute to analyzing cybersecurity … Plus. Familiarity with CSOC tools such as Rapid7 InsightIDR or other SIEM solutions. Hands-on experience in internal and external audits, compliance assessments, and process improvement. Basic understanding of incident response frameworks and cybersecurity best practices. Exceptional analytical, organizational, and communication skills. Commitment to continuous learning and professional development in audit, compliance, and security. You will have an More ❯

Endpoint monitoring and analysis. * Malware analysis and forensics research. * Understanding/differentiation of intrusion attempts and false positives. * Lead investigations into security breaches, incidents, or suspicious activities and provide incident reports to stakeholders. * Enforce security policies, procedures, and guidelines for all IT systems and operations. * Provide recommendations for improving security practices to meet evolving regulatory and organisational needs. * Vulnerability … identification & mitigation/remediation. * Advise incident responders & other teams on cybersecurity threats. * Triage security events and incidents and apply containment and mitigation/remediation strategies. * Collaborate with other IT teams to ensure seamless security integration with infrastructure, applications, and services. * Maintain comprehensive documentation related to security configurations, incident reports, audits, and compliance activities. * Proactively monitor the performance of … avoidance actions to prevent wider problems. * Function as the point of escalation for the Service Desk for security-related tickets. * Analysis of weekly vulnerability scans and update relevant records. * Incident readiness and handling as part of the Computer Security Incident Response team (CSIRT). * Monitor and analyse security logs from various systems (including SIEM) and network devices More ❯

assessment of Clarks' security posture Support business continuity and disaster recovery processes and assist in the development and implementation of activities to improve Clarks' cyber resilience Support of security incident response activities, including providing expertise in triaging and resolving key issues, engaging with outsourced security operations and internal SecOps teams to ensure standards and policies are appropriately applied … and assisting in the creation and updating of relevant run books to help ensure effective incident management planning and execution Support for compliance and audit activities, working with internal and external stakeholders to understand requirements, identify remedial activity, and monitor progress Analysing emerging and developing threats and working with stakeholders to validate the potential impact on Clarks - and recommend … security controls and best practices across a number of the following areas/domains: Network and infrastructure (networking protocol knowledge is an advantage Endpoint (e.g. DLP, Endpoint Detection and Response, File Integrity, SIEM) Database technologies (SQL, Oracle) General cryptography practices (e.g. PKI) Cloud environments (Azure, AWS) Fundamental understanding of privacy and data protection laws and regulations and how they More ❯

for completing the implementation of a number of strategic based security solutions for new security tooling or existing. The engineer will also participate in security related service management processes (incident, change and problem management) and will participate in the planning, design, enforcement and review of security controls which protect the integrity of the firm. Essential Duties and Responsibilities for … DLP. Standard, third party and privilege Identity Access Management Operate, manage and improve HSM key management infrastructure. Remediation of external, internal vulnerabilities, web application scanning and patch compliance. Cyber Incident Management and or Security Forensic experience. Documenting High Low and Detailed Level designs for review and presentation. Representing IT security at the Change Authority Board, Architecture Review Board Attend … years Cyber Security Engineer experience. Hands-on technical support experience in IT and Network Security Engineering and/or Systems Engineering roles. Substantial experience in Security Technology Management and Incident Response, including proficiency in SOC, Malware, Ransomware, Threat Analytics, Server and Endpoint security. Must be proficient in writing up documentation. Clear and concise presenting skills. Strong communication and More ❯

will focus on creating a business strategy, gap analysis and implementation, for securing their Azure-based infrastructure, integrating security automation, ensuring PCI DSS compliance, vulnerability and penetration testing and incident response. This role will focus on developing and maintaining secure, scalable Azure DevOps pipelines and Infrastructure as Code (IaC) using Terraform. Their ideal candidate will have a strong background … every stage. Cloud Security Implementation: Leverage Azure Security Centre, Microsoft Defender for Cloud, and Microsoft Sentinel for advanced security monitoring. Threat Detection & SOAR Automation: Oversee Security Orchestration, Automation, and Response (SOAR) solutions including SOC Prime. Network & Application Security: Manage Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Vulnerability & Penetration Testing: Review Penetration Testing, vulnerability assessments, and security … proactively identify and remediate risks. PCI DSS Compliance: Conduct security audits, risk assessments, and ensure regulatory compliance. DNS Security: Implement and monitor DNS security solutions to prevent cyber threats. Incident Response: Formulating and documenting a solid process utilising a 3rd party support partner Security Monitoring & Logging: Develop SIEM solutions, logging strategies, and real-time threat intelligence. Monitor, audit More ❯

defences by maintaining and optimising security operations tools and processes. You'll focus on monitoring, analysing, and responding to cyber threats, while supporting the SOC team and ensuring effective incident management across the business. Your role will involve collaborating with technology and business stakeholders, investigating security alerts, enhancing tooling performance, and supporting the delivery of continuous improvement and risk … to readiness for significant incidents and play a key role in proactive threat hunting and compliance reporting. What you'll be doing as a Senior Cyber Security Analyst: Security Incident Response : Investigate security alerts from SIEM and third-party MSSPs, triage and respond to incidents, and support root cause analysis to drive remediation. Stakeholder Engagement : Work closely with … alert tuning and automation. SOC Support & Escalation : Act as a key contact and escalation point for the SOC team, providing guidance and mentoring to support operational effectiveness. On-Call & Incident Readiness : Participate in a 24/7/365 on-call rota with MSSP partners, supporting out-of-hours investigations and maintaining incident readiness. Threat Hunting & Continuous Improvement More ❯

The SecOps Manager is a key figure in the organisation's cyber defence efforts, tasked with identifying, detecting, and responding to information security threats, as well as managing the response to cybersecurity incidents. Working closely with colleagues across IT and the wider organisation, this role ensures the protection of digital and information assets against a range of internal and … that impact identity management across the organisation. The post holder also serves as a technical authority within the team and department. What you'll need to succeed Security Operations & Incident Response Lead security operations services, including monitoring, incident response, threat management, and intrusion detection, using both internal and external resources. Manage the outsourced 24/… security operations service. Lead the organisation's response to security incidents, coordinating recovery efforts with internal teams and vendors. Establish and manage threat intelligence processes to ensure timely remediation of vulnerabilities. Monitor and analyse performance metrics to support security troubleshooting and continuous improvement. Identity & Access Management Provide expert technical leadership for identity and access management, ensuring secure, high-performing More ❯

The SecOps Manager is a key figure in the organisation's cyber defence efforts, tasked with identifying, detecting, and responding to information security threats, as well as managing the response to cybersecurity incidents. Working closely with colleagues across IT and the wider organisation, this role ensures the protection of digital and information assets against a range of internal and … that impact identity management across the organisation. The post holder also serves as a technical authority within the team and department. What you'll need to succeed Security Operations & Incident Response Lead security operations services, including monitoring, incident response, threat management, and intrusion detection, using both internal and external resources. Manage the outsourced 24/… security operations service. Lead the organisation's response to security incidents, coordinating recovery efforts with internal teams and vendors. Establish and manage threat intelligence processes to ensure timely remediation of vulnerabilities. Monitor and analyse performance metrics to support security troubleshooting and continuous improvement. Identity & Access Management Provide expert technical leadership for identity and access management, ensuring secure, high-performing More ❯

responsible for implementing and managing security infrastructure, responding to threats, and ensuring compliance across systems. You'll work with various cyber security solutions while driving security best practices and incident response. If you have experience in cybersecurity tools, governance, and access management-and want to use your skills to support a mission that changes lives-this is your chance … Operations Specialist you will play a critical role in protecting our digital infrastructure. You'll lead the implementation and management of SIEM systems, Fortinet security tools, and endpoint detection & response (EDR) while conducting vulnerability assessments and penetration testing to stay ahead of cyber threats. You'll enhance identity and access management (IAM) by maintaining Active Directory, Entra ID, MFA … and Zero Trust security principles. Your expertise in network security, VPNs, SD-WAN, and Microsoft Defender solutions will help safeguard our systems, while your contributions to incident response, governance, and security strategy will shape the future of our cybersecurity posture. If you're passionate about cybersecurity and want to make a meaningful impact, then this role is for More ❯

our vulnerability management program, working closely with our operational support, infrastructure, and development teams. Plus, you'll be right in the thick of security event monitoring, threat intelligence, and incident management - keeping us one step ahead! What you'll be doing: Delivering SOC Capabilities: You'll be a key team member in delivering ongoing Security Operations Centre (SOC) capabilities … policy, standards, and guidelines. Threat Intelligence: You'll monitor and apply current and emerging threat intelligence, using tools like Google Threat Intelligence to proactively spot and tackle digital threats. Incident Response: You'll actively monitor for security incidents and jump into action with our incident response teams to contain, investigate, and prevent future security hiccups. Defining More ❯

our vulnerability management program, working closely with our operational support, infrastructure, and development teams. Plus, you'll be right in the thick of security event monitoring, threat intelligence, and incident management - keeping us one step ahead! What you'll be doing: Delivering SOC Capabilities: You'll be a key team member in delivering ongoing Security Operations Centre (SOC) capabilities … policy, standards, and guidelines. Threat Intelligence: You'll monitor and apply current and emerging threat intelligence, using tools like Google Threat Intelligence to proactively spot and tackle digital threats. Incident Response: You'll actively monitor for security incidents and jump into action with our incident response teams to contain, investigate, and prevent future security hiccups. Defining More ❯

management experience (operational leadership or within an audit/control function) covering Technology Infrastructure, Cyber Security or Resilience. Experience of one or more of the following areas: cloud technologies, incident response, vulnerability management, threat management, information risk management, data leakage protection, identity & access management, technology areas includes Unix/Linux, Windows, Databases, or Middleware storage technologies or Networks. … Additionally, ITIL service management processes including Incident, Problem and Change, Data Backup and Recovery. Knowledge of new and emerging technology, cyber security, and resilience risks and mitigating controls. Relevant professional qualifications (e.g. CISA, CISSP, CRISC, TOGAF or other relevant technical qualification; and graduate degree). Practical understanding of relevant regulatory environment. Strong ability to oversee and deliver timely delivery More ❯

and audits. Vulnerability Analysis: Conduct assessments and penetration testing. Develop mitigation strategies and track vulnerabilities. Forensic Analysis: Analyze security incidents, collect evidence, and prepare reports to improve security posture. Incident Response: Lead response efforts, develop plans, and conduct post-incident reviews. Security Tools: Manage security tools like firewalls and intrusion detection systems. Evaluate new technologies. Documentation … plus), and understanding of secure development lifecycle. Proficiency with security tools, firewalls (Palo Alto preferred), IDS, endpoint security. Strong understanding of network protocols, VPNs, and security architecture. Experience in incident detection, analysis, response, forensic and malware analysis. Skills in scripting and automation (Python, PowerShell). Knowledge of frameworks like ISO 27001, NIST, Cyber Essentials. Understanding of risk management … clear security documentation and communicate technical info effectively. Solid organizational skills and ability to work in a team environment. Extensive experience in cybersecurity roles, especially in security operations and incident management. Project management experience and relevant certifications (CCSP, CEH, Security+, AWS, Azure) are highly desirable. What You ll Get in Return Discretionary annual bonus 25 days' holiday, holiday buying More ❯

Encryption : Protect data at rest, in transit, and in use through encryption and tokenization. Network Security : Design secure network architectures, implement IDS/IPS, firewalls, and VPNs. Security Monitoring & Incident Response : Build monitoring solutions, develop incident response strategies. Compliance & Governance : Ensure adherence to regulations, conduct audits, and establish security frameworks. Secure DevOps & Automation : Incorporate security into … Skills : Strong knowledge of cybersecurity technologies and practices Expertise in security frameworks (CIS, ISF, Mitre, NIST, or equivalent) Deep understanding of CIS18 controls and security architecture concepts Experience with incident investigation and remediation Proficiency in cloud security (Azure, AWS, or Google Cloud) Excellent stakeholder management and communication skills Relevant cybersecurity certifications (CISSP, CISM, CEH, etc.) Requirements Bachelor's degree More ❯

The team you'll be working with: SOC Analyst (L1) We are currently recruiting for an Associate level Managed Detection and Response SOC Analyst Level 1 to join our growing Security Operations Centre business. This role will be based on-site in Birminham, we need canddiates that are able towork in a job that involves 24/7 operations … log data and network traffic using the Protective Monitoring platform and Internet resources to identify cyber-attacks/security incidents. Categorise all suspected incidents in line with the Security Incident policy Recognise potential, successful, and unsuccessful intrusion attempts and compromises through reviews and further analysis of relevant event detail and incident summary information. Write up high quality security … incident tickets using a combination of existing knowledge resources and independent research. Assist with remediation activities (or support customer stakeholders) to inhibit cyber-attacks, clean up IT systems and secure networks against repeat attacks. Produce security incident review reports to present information about the security incident and provide security improvement recommendations based on the security incident More ❯

the UK Network Perimeter working with the best standard technologies. The SOC Analyst reports to the SOC Manager. The SOC Analyst conducts a range of analysis and assists the incident response team with investigations that need to be escalated to an embedded member of staff. The SOC Analyst key responsibilities are: Effective Tier 1 to 2 alert triage … with project activity Assist proactive threat hunting in collaboration with the CTI function Assist IR in HR and InfoSec related investigations Ensure the timely triage and remediation of any incident or request tickets raised to the SOC Participate in the activity of adding/removing URLs from the AcceptList and BlockList Attend routine security meetings Conduct activities in line … of Malware capabilities, attack vectors, propagation and impact. Good communication skills liaising with the business and suppliers. Desirable Skillset/experience (Senior grade): Root cause analysis and leading T2 incident investigations Process/Playbook/Runbook development Working knowledge of detection engineering, false positive improvements Capability to tune SIEM rules or create custom detections Scripted automation experience e.g. Python More ❯

such as ISO27001, Cyber Essentials Plus, PCI/DSS Stay ahead of cyber threats, maintaining and improving security monitoring and risk management processes Support vulnerability management, penetration testing, and incident response Requirements for this role: 3+ years' experience in a senior cyber security role Strong knowledge of security frameworks (NIST, NCSC, CIS, MITRE ATT&CK) Hands-on experience More ❯

a comprehensive cybersecurity strategy, ensuring alignment with business objectives and regulatory requirements (ISO 27001, NIST, GDPR). Proactively monitor, detect, and respond to security threats, vulnerabilities, and breaches, leading incident response and forensic investigations. Conduct regular security audits, penetration testing, and risk assessments, implementing corrective actions to strengthen defences. Oversee firewalls, IDS/IPS, endpoint protection, encryption, and More ❯

and SaaS platforms to validate compliance with the client’s security standards Assist in threat modelling, risk assessments, and documenting security controls across infrastructure and application layers Participate in incident response efforts and support the identification of root causes and mitigation strategies Requirements of Security Architect role: Minimum of 5 years' experience in IT security, ideally including exposure More ❯