1 to 25 of 133 MITRE ATT&CK Jobs in England

delivered in a consistent and scalable way. Working directly with customers, you will define detection strategies, design use cases aligned to MITRE ATT&CK, and guide improvements in visibility, coverage and response maturity. You will work closely with platform onboarding and engineering teams, supplementing them … SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real‐world attack techniques Map customer log sources to detection use cases to assess coverage and identify gaps Design ...

delivered in a consistent and scalable way. Working directly with customers, you will define detection strategies, design use cases aligned to MITRE ATT&CK, and guide improvements in visibility, coverage and response maturity. You will work closely with platform onboarding and engineering teams, supplementing them … rulesets across SIEM and XDR platformsDevelop and tune detection logic using KQL or equivalent query languagesDesign detection use cases aligned to MITRE ATT&CK and real-world attack techniquesMap customer log sources to detection use cases to assess coverage and identify gapsDesign and implement SOAR ...

Operations Centre (SOC) activities, expanding log coverage, and building high-quality detections in our SIEM. You will use frameworks such as MITRE ATT&CK and MITRE D3FEND to assess threat scenarios, prioritize detection engineering work, and strengthen both preventative and detective controls. What … operations, including monitoring, triage, investigation, and response to security alerts. Assess the company threat landscape using MITRE ATT&CK and MITRE D3FEND to identify detection and mitigation opportunities. Connect and maintain log sources into our SIEM to ensure relevant coverage across corporate ...

team. Tools: Azure, Active Directory, CrowdStrike Falcon, Zscaler, Vulnerability Management (Qualys, Tenable Nessus, Rapid7), Incident Response ownership experience & Playbooks/Mitre Att&ck) Demonstrable experience leading cyber security incident response (incident command), from detection through containment and remediation. Working knowledge of MITRE ATT … prioritisation of the Endpoint, Platform and Incident Response backlog, ordered against the enterprise cyber risk register and exploitation-based intelligence (e.g. MITRE ATT&CK). Curate the backlog from inputs across Houston and London, including the endpoint detection and response (CrowdStrike) execution lead. Maintain alignment ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

Months £110k plus bens - UK REMOTE Senior SOAR Engineer | Splunk SOAR | Splunk Enterprise Security | Cyber Security | Security Automation | Python | MITRE ATT&CK | NIST An opportunity has arisen for an experienced Senior SOAR Engineer to join a high-performing Cyber Security Engineering team responsible for designing … experience in Python or Java, Perl, R or C++ Deep understanding of security incident response processes Knowledge of security frameworks including MITRE ATT&CK and NIST Strong knowledge of Windows, Linux/UNIX and database technologies What's on Offer? Salary ...

maintain modern SIEM platform (e.g. Sentinel) including KQL detection rules, workbooks, logging pipelines, and AI-assisted alert triage.Map detection coverage against MITRE ATT&CK tactics and techniques. Identify and close visibility gaps across the cloud estate.Maintain alignment to PCI DSS, SOC2, ISO27001 NIST … proficiency in Python, PowerShell, or Bash for security automation.Strong grasp of PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud.Nice to haveAZ-500, AWS Certified Security – Specialty, or equivalent cloud security certification.Experience integrating ATT&CK Navigator ...

modern SIEM platform (e.g. Sentinel) including KQL detection rules, workbooks, logging pipelines, and AI-assisted alert triage. Map detection coverage against MITRE ATT&CK tactics and techniques. Identify and close visibility gaps across the cloud estate. Maintain alignment to PCI DSS, SOC2, ISO27001 NIST … Python, PowerShell, or Bash for security automation. Strong grasp of PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. Nice to have AZ-500, AWS Certified Security – Specialty, or equivalent cloud security certification. Experience integrating ATT&CK ...

Engineering: Build, tune and maintain detection rules, correlation logic and alerting across SIEM and EDR. Engineer high-fidelity detections mapped to MITRE ATT&CK. Continuously reduce false positives and expand coverage. Automation: Engineer automation for security operations at scale — scripting (Python, Bash, PowerShell) for response orchestration, access … security events, perform root cause analysis, and apply threat intelligence to improve defensive posture. Understand attacker TTPs and operationalise frameworks like MITRE ATT&CK and NIST CSF. Vulnerability Management: Own the vulnerability management programme end to end — scanning, prioritisation, remediation tracking, SLA enforcement and executive ...

teams and vendors to ensure high-quality telemetry Detection Engineering Design and implement detection use cases aligned to frameworks such as MITRE ATT&CK Build and tune correlation rules, alerts, dashboards, and anomaly detections Continuously improve detection quality and reduce false positives SOC & Incident Response … networks, Windows/Linux systems, cloud platforms (Azure, AWS, GCP), identity systems, and endpoint security tools Knowledge of frameworks such as MITRE ATT&CK and threat hunting methodologies Essential Requirements Degree (or equivalent experience) in a computing or related discipline Proven experience across IT infrastructure ...

related toolsets to detect signs of compromise and investigate security events to completion Proactively conduct threat hunting using threat intelligence frameworks (MITRE ATT&CK, Cyber Kill Chain) and available security platforms to identify and mitigate emerging threats Assess new and evolving cyber threats … Demonstrable experience responding to cyber threats and working in an Azure-focused cloud environment Proven experience with the Cyber Kill Chain, MITRE ATT&CK, and other security defence and intelligence frameworks Experience in stakeholder management and engagement at C-Suite level Experience working for Critical ...

Create high-fidelity detections using operational threat intelligence, incident learnings and purple team findings. Measure and improve detection coverage using the MITRE ATT&CK framework. Continuously reduce false positives while improving visibility into emerging attacker techniques.SOAR & Automation EngineeringDesign and maintain SOAR playbooks that automate alert … similar languages. Experience working within cloud environments (AWS preferred; Azure or GCP experience also valued). Solid understanding of the MITRE ATT&CK framework. Experience supporting security incident response. Comfortable working with Git, APIs and engineering workflows. Excellent communication skills with both Security and Engineering ...

security-related programmes through data analysis, assessments and reporting. Apply common analysis techniques and frameworks, including Kill Chain, Pyramid of Pain, MITRE ATT&CK and Diamond Model, to enhance threat detection and response capabilities. Contribute to the strategic, operational and tactical components of the Intelligence … tools and platforms, including Recorded Future, OpenCTI, Cribl and Splunk. Knowledge of threat modelling techniques, including Kill Chain, Pyramid of Pain, MITRE ATT&CK and Diamond Model. Strong analytical and problem-solving skills, with the ability to identify and prioritise actionable intelligence. Experience working with ...

dependencies, and error handling Ensure consistency and usability for wider teams Strategic Contribution Support use cases aligned to threat modelling and MITRE ATT&CK Contribute to automation playbooks and response strategies Stay current with tools, frameworks, and emerging threats Collaboration Embed automation into SOC workflows … platforms Proficiency in scripting (e.g., Python, PowerShell) Experience working with APIs, webhooks, and authentication methods Knowledge of threat frameworks (e.g., MITRE ATT&CK) Understanding of cloud security, identity, and event-driven automation Strong communication and analytical skills Security clearance (NPPV and/ ...

candidate will possess strong analytical skills, solid knowledge in cybersecurity, networking, cloud technologies, security frameworks such as NIST and/or MITRE ATT&CK, and hands-on experience with enterprise security tools and platforms. This role requires a minimum of 4 years of experience … other email-based threats.Monitor Data Leak Protection (DLP) tools and investigate potential unauthorized data exfiltration events.Conduct threat hunting activities using MITRE ATT&CK framework to proactively identify adversary techniques within the environment.Collaborate with IT, Infrastructure, networking, and application teams to investigate security events and support ...

will be responsible for producing an executive summary-style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team-player attitude with a willingness to share knowledge ...

experience writing KQL queries, PowerShell, or CLI commands.Exposure to automation or playbooks (Logic Apps, Defender workflows).Knowledge of frameworks such as MITRE ATT&CK or NIST CSF.Relevant certifications such as:SC‐900, SC‐200 (or working toward), AZ‐900, AZ‐500CISSP, CIPP/E, CompTIA … experience writing KQL queries, PowerShell, or CLI commands.Exposure to automation or playbooks (Logic Apps, Defender workflows).Knowledge of frameworks such as MITRE ATT&CK or NIST CSF.Relevant certifications such as:SC‐900, SC‐200 (or working toward), AZ‐900, AZ‐500CISSP, CIPP/E, CompTIA ...

Analyse network traffic, endpoint activity, logs and alerts to uncover malicious behaviour. Drive continuous improvement of detection capabilities aligned to the MITRE ATT&CK framework. Enhance SOC processes, tooling, playbooks and operational effectiveness. Mentor and develop analysts, helping build the next generation of cyber security … mentoring analysts in an operational security environment. It would be great if you had: Detection engineering or threat-informed defence experience. MITRE ATT&CK framework knowledge. Python, PowerShell or Bash scripting skills. Malware analysis or reverse engineering exposure. CREST, Blue Team Level 1 or similar ...

implement SOAR workflows to automate detection, response, and security operations processes. Conduct proactive threat hunting using SIEM/EDR data and MITRE ATT&CK‐aligned techniques. Support vulnerability assessment and security scanning activities using relevant tools. Provide input into penetration testing activities and interpret findings … Security (ES). Solid understanding of network protocols, cloud security (AWS/Azure), and threat detection methodologies. Working knowledge of the MITRE ATT&CK framework. Experience building automation or SOAR playbooks for security operations. CrowdStrike certifications (CCFA/CCFR/CCSE – any combination preferred). ...

maintain threat detection use cases aligned to real-world attack scenarios Build and tune detection logic using industry frameworks such as MITRE ATT&CK Conduct proactive, hypothesis-led threat hunting across client environments Analyse telemetry, threat intelligence and security data to identify suspicious activity Develop … threats and improving security operations. You'll ideally have experience with: Threat Hunting Detection Engineering Security Operations Centres (SOC) SIEM technologies MITRE ATT&CK Framework Threat Intelligence Detection rule creation and tuning Security telemetry analysis Incident detection and investigation Writing detection use cases and playbooks ...

will build, validate, tune, and optimize detection logic and coverage, leveraging attacker tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK to improve accuracy and reduce false positives Execute and coordinate security event response activities, including containment, isolation, escalation, and remediation, applying … paths, including credential theft, privilege escalation, and session/token abuse Considerable understanding of attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CK Record of improving operational effectiveness, including reducing alert noise, improving detection coverage, and decreasing mean time to detect and respond Great ...

assessments. SupportSOC operations with threat context and priority setting. Identifyand monitor Indicators of Compromise (IOCs) and Tactics, Techniques &Procedures (TTPs) using MITRE ATT&CK framework. Collaborateon play-book development and threat detection use cases. Performattribution and malware behavioural analysis to inform decision-making. Leadthreat actor … e.g., MISP, Anomali, ThreatConnect) Strongknowledge of malware families, TTPs, and IOC tracking Experienceusing SIEM, SOAR, and endpoint detection tools Workingknowledge of MITRE ATT&CK, Cyber Kill Chain, and Diamond Model Abilityto produce high-quality, executive-ready threat reports Desired Skills Certificationssuch as GCTI, GREM, GCIA ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

proactive threat hunting based on attacker behaviour, not vendor alertsTranslating threat intelligence and incident learnings into durable, reusable detectionsMapping detections to MITRE ATT&CK and real-world attack pathsReducing alert fatigue through logic refinement, correlation, and contextual enrichmentAdvising and supporting during high-severity security incidents … plane, SaaS)Familiarity with threat intelligence platforms and frameworks such as PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud.Additional InformationBring all of you to workWe create the conditions for high performers to thrive, through real ownership, fewer blockers ...

build and continuously improve detection content, managed as code and version-controlled, mapping coverage to adversary tactics and techniques using the MITRE ATT&CK framework and prioritising the techniques most relevant to a financial services SaaS provider. Telemetry and visibility – maintain a clear view … detections. Working knowledge of cloud security and native cloud telemetry sources (AWS and/or Azure). Practical use of the MITRE ATT&CK framework to structure detection coverage and gap analysis. Hands-on experience building and operating SOAR playbooks and response automation, orchestrating across ...