1 to 25 of 105 MITRE ATT&CK Jobs in the UK excluding London

SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real-world attack techniques Map customer log sources to detection use cases to assess coverage and identify gaps Design … consultant Lead workshops covering detection engineering, use case design and SOC maturity Guide customers on improving detection coverage and aligning to MITRE ATT&CK Clearly explain detection strategies, gaps and recommendations to both technical and non-technical stakeholders Work closely with platform onboarding and engineering ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

will be responsible for producing an executive summary‐style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances``` Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team‐player attitude with a willingness to share knowledge ...

SIEM administration or platform support. Key Responsibilities Design, develop and maintain threat-led detection rules aligned with MITRE ATT&CK and organisational threat models. Translate threat intelligence, threat hunting insights, red/purple team findings and incident investigations into effective detection use cases. Develop behavioural … Experience Strong hands-on experience in SOC Detection Engineering, including detection rule development, validation, tuning and lifecycle management. Excellent knowledge of MITRE ATT&CK, attacker TTPs, behavioural analytics and threat-led detection methodologies. Experience translating cyber threat intelligence, threat modelling and threat hunting findings into ...

engineering, vulnerability and exposure management, IAM/PAM, Zero Trust, cloud security, and security control mapping. Security standards: Practical use of MITRE ATT&CK, STIX/TAXII, CVE, CWE, CAPEC, NIST frameworks, CIS Controls, and common threat-intelligence vocabularies. GenAI and GraphRAG: LLM-based extraction … sources; implement incremental loading, event-time handling, reconciliation, and recovery patterns. Engineer mappings between enterprise security data and standards such as MITRE ATT&CK and STIX while managing versioning, extensions, and organization-specific concepts. Design query patterns, graph projections, indexes, constraints, partitioning strategies, retention policies ...

escalation playbooks; suggest improvements based on recurring issues or inefficiencies. Threat Awareness: Maintain awareness of current cyber threats, attacker techniques (MITRE ATT&CK), and industry trends relevant to the organisations threat landscape. About You: As an experienced SOC Analyst, your skills and experience may include … systems. Working knowledge of SIEM platforms (e.g. Microsoft sentinel, Splunk, Elastic, QRadar). Awareness of security frameworks and methodologies (NIST CSF, MITRE ATT&CK, ISO27001). #J-18808-Ljbffr ...

threat detection platforms. Create and optimise detection logic using technologies such as Splunk and endpoint security solutions. Map detections against the MITRE ATT&CK framework to ensure comprehensive threat coverage. Continuously improve detection quality by analysing alert fidelity, false positives, and operational effectiveness. Validate detections … following: Splunk and SPL YARA rule development EDR detection engineering SIEM content development and tuning Experience mapping detections to the MITRE ATT&CK framework. Strong understanding of modern security principles including Zero Trust, identity-first security, secrets management, and network segmentation. Desirable Experience Experience with ...

Cloud and Entra ID Protection. Own detection engineering: write and tune KQL analytics rules and hunting queries, map coverage to MITRE ATT&CK, track false‐positive rates, and retire rules that no longer earn their place. Automate response with automation rules and Logic Apps playbooks … rules and Logic Apps playbooks. Strong KQL and detection engineering: you can write, tune and defend an analytics rule mapped to MITRE ATT&CK, and explain why it fires and why it does not. Incident response on a cloud platform: triage, containment, evidence collection ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands‐on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands‐on SOAR platform configuration Working ...

across both AI-assisted analysis and the discovery and control of AI use in client environments. Map detections and demos to MITRE ATT&CK, and be straight with partners about what the product does not do. Cover the wider SentinelOne portfolio Build working fluency across … quickly. Strong Windows and macOS fundamentals: process behaviour, persistence mechanisms, and what normal looks like on an endpoint. Working fluency in MITRE ATT&CK, and real experience tuning policy and handling false positives at scale and surrounding in AI security to hold the conversation credibly ...

architectures, key components, and common IT/OT protocols. Certifications - Cybersecurity & Infrastructure Security Agency (CISA) Industrial Control Systems (ICS) Training, AttackIQ - MITRE ATT&CK, SANS Global Industrial Cyber Security Professional (GICSP), Certified Information Systems Security Professional (CISSP). Standards, frameworks, and regulatory experience including … Directive, ISA/IEC 62443 Series/ISO 27000 Series, MITRE ATT&CK, NIST Cyber Security Framework (CSF), NCSC CAF, Office for Nuclear Regulation (ONR) Security Assessment Principles, Technical Assessment Guides, and supplementary guidance. Our Culture: Our values stand on a foundation of safety, integrity ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

particular attention to threats targeting privileged access tooling and supply chain attack vectors. Help maintain and evolve detection coverage mapped to MITRE ATT&CK. Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts. AI Integration & Automation Use AI-driven tools for alert triage … Bring 4+ years of experience in a SOC, security operations, or incident response role. Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior. Experience with at least one SIEM platform and familiarity with writing search or detection queries. Familiarity with ...

will build, validate, tune, and optimize detection logic and coverage, leveraging attacker tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK to improve accuracy and reduce false positivesExecute and coordinate security event response activities, including containment, isolation, escalation, and remediation, applying sound … attack paths, including credential theft, privilege escalation, and session/token abuseConsiderable understanding of attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CKRecord of improving operational effectiveness, including reducing alert noise, improving detection coverage, and decreasing mean time to detect and respondGreat analytical, decision-making ...

Microsoft Sentinel, Splunk) and EDR/XDR platforms (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon). Security Frameworks: Solid understanding of MITRE ATT&CK, NIST CSF, NCSC Caf v4.0 and ISO 27001. Communication: Ability to write concise incident reports and speak comfortably with both engineers ...

Microsoft Sentinel, Splunk) and EDR/XDR platforms (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon). Security Frameworks: Solid understanding of MITRE ATT&CK, NIST CSF, NCSC Caf v4.0 and ISO 27001. Communication: Ability to write concise incident reports and speak comfortably with both engineers ...

activities during major cyber security incidents. Experience contributing to the development of monitoring use cases and detection improvements. Applied knowledge of MITRE ATT&CK or equivalent adversary behaviour frameworks. ...

standard business days including weekends and holidays - our MDR service is 24x7x365 (Hours are standard business hours) Desirable Knowledge of MITRE ATT&CK framework Experience with SQL query construction Experience with OSQuery Programming and scripting skills - proficient knowledge of PowerShell Experience with enterprise information security ...

activities during major cyber security incidents. Experience contributing to the development of monitoring use cases and detection improvements. Applied knowledge of MITRE ATT&CK or equivalent adversary behaviour frameworks. ...

activities during major cyber security incidents. Experience contributing to the development of monitoring use cases and detection improvements. Applied knowledge of MITRE ATT&CK or equivalent adversary behaviour frameworks. ...

security principles, including OWASP Top 10, WAF and API security Experience with vulnerability management, patching and security remediation Knowledge of the MITRE ATT&CK Framework and common attack techniques Experience applying security standards such as NCSC guidance, CIS benchmarks or Microsoft Security Baselines Understanding ...

Malware defenses and monitoring experienceKnowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc.Knowledge of Mitre ATT&CK framework preferredWorking knowledge of incident response proceduresExperience with SQL query construction preferredExperience with OSQuery is a plusExperience administering and supporting Windows OS (both workstations ...

HTTP, SMB, LDAP. Operational knowledge of Windows, macOS and Linux. Ability to read and interpret logs from multiple sources. Awareness of MITRE ATT&CK and differentiating legitimate admin activity vs suspicious behaviour. Experience with Microsoft Sentinel, Google SecOps or other SIEM platforms. Experience with Defender ...