1 to 25 of 29 MITRE ATT&CK Jobs in the UK excluding London

organisation in key external intelligence-sharing forums, including FS-ISAC, the NCSC’s CiSP and relevant industry partnerships. Use the MITRE ATT&CK framework to identify and analyse attacker tactics, techniques and procedures and strengthen our detection capabilities. Develop the Proactive Threat Hunting Initiative, using … their strong technical expertise with the ability to develop our CTI capability and turn complex intelligence into clear, actionable business insights. MITRE ATT&CK training/certification is essential . Experience developing Priority Intelligence Requirements (PIRs). Strong experience working closely with SOC, Incident Response ...

with threat intelligence teams to enhance detection logic. Threat Modelling & Use Case Development Lead threat modelling exercises using frameworks such as MITRE ATT&CK, STRIDE, and Cyber Kill Chain. Translate threat models into actionable detection use cases and SIEM rules. Prioritise detection engineering based … Python or PowerShell for automation. Deep understanding of threat detection, incident response, and the cyber kill chain. Familiarity with frameworks including MITRE ATT&CK, NIST, and CIS. Strong communication, analytical, and presentation skills. Solid understanding of network traffic flows, vulnerability management, and penetration testing principles. ...

dependencies, and error handling Ensure consistency and usability for wider teams Strategic Contribution Support use cases aligned to threat modelling and MITRE ATT&CK Contribute to automation playbooks and response strategies Stay current with tools, frameworks, and emerging threats Collaboration Embed automation into SOC workflows … platforms Proficiency in scripting (e.g., Python, PowerShell) Experience working with APIs, webhooks, and authentication methods Knowledge of threat frameworks (e.g., MITRE ATT&CK) Understanding of cloud security, identity, and event-driven automation Strong communication and analytical skills Security clearance (NPPV and/ ...

rules using KQL. Translate threat intelligence, attacker behaviours and operational requirements into measurable detection use cases. Map detection content to the MITRE ATT&CK framework and help identify gaps in detection coverage. Validate required log sources, schemas and field mappings before developing detection logic. Test … detection engineering principles, false-positive reduction and the detection content lifecycle. Experience developing threat-informed use cases and mapping detections to MITRE ATT&CK tactics and techniques. Ability to assess log source suitability, data quality, parsing and field availability for detection requirements. Experience with ...

maintain threat detection use cases aligned to real-world attack scenarios Build and tune detection logic using industry frameworks such as MITRE ATT&CK Conduct proactive, hypothesis-led threat hunting across client environments Analyse telemetry, threat intelligence and security data to identify suspicious activity Develop … threats and improving security operations. You'll ideally have experience with: Threat Hunting Detection Engineering Security Operations Centres (SOC) SIEM technologies MITRE ATT&CK Framework Threat Intelligence Detection rule creation and tuning Security telemetry analysis Incident detection and investigation Writing detection use cases and playbooks ...

without losing coverage Mapping customer log sources against use cases to identify and close coverage gaps Designing use cases aligned to MITRE ATT&CK Building SOAR automations and automated response workflows Writing incident response playbooks for customers Owning the detection-as-code approach — pipelines, version … Azure Logic Apps, Cortex XSOAR or similar Scripting in Python or PowerShell, and comfort working with APIs Use case design against MITRE ATT&CK Working knowledge of XDR/EDR platforms and Azure telemetry sources Some exposure to NDR tooling such as Vectra ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

improve security telemetry, alert enrichment, investigation workflows and response times. Conduct threat hunting using adversary behaviours, TTPs and frameworks such as MITRE ATT&CK, incorporating findings into security controls and detections. Create and continuously improve incident runbooks, playbooks and detection processes based on findings from … ability to write and develop queries for complex investigations. Understanding of adversary tactics, techniques and procedures (TTPs), offensive security concepts and MITRE ATT&CK principles. Practical knowledge of cloud environments and security controls, with the ability to apply detection and incident response practices across hybrid ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

monitoring capabilities. Reduce false positives and improve detection coverage using threat intelligence and incident learnings. Investigate threats using frameworks such as MITRE ATT&CK. Work closely with internal IT, engineering and security teams, alongside external security providers. Maintain and improve security playbooks, procedures, documentation and response processes. … environments . Knowledge of Windows environments, with working knowledge of Linux/Unix. Understanding of threat intelligence, IOCs, TTPs and the MITRE ATT&CK framework . Experience improving detection logic, alert quality and security controls. Strong stakeholder communication and incident management skills. Knowledge of frameworks ...

capabilities. Key Responsibilities Review and optimise Microsoft Defender alerting, monitoring, and detection coverage. Conduct gap analysis against security best practices and MITRE ATT&CK. Design and implement Microsoft Purview DLP policies across M365 workloads. Develop sensitivity labels, classification frameworks, and information protection controls. Deliver GDPR-aligned retention … Labels, Auto-Labelling, and Data Classification. Retention Labels, Retention Policies, and Data Lifecycle Management. Detection engineering, alert tuning, incident management, and MITRE ATT&CK mapping. Microsoft 365 Security & Compliance architecture. Strong understanding of GDPR and data governance principles. Experience delivering security and compliance projects ...

including TCP/IP, DNS, firewalls, and proxies. Experience within a SOC, NOC, or 24/7 operational environment. Familiarity with MITRE ATT&CK, CVEs, and vulnerability management. Exposure to cloud security monitoring across Azure, AWS, or Microsoft 365. Desirable Certifications Microsoft SC-200 CompTIA ...

similar security certifications. Experience with Red Team tooling such as Burp Suite, Metasploit, Wireshark, Nessus, Nmap or Hashcat. Knowledge of MITRE ATT&CK and adversary emulation frameworks. Experience securing Windows, Linux or Mainframe environments. AWS or Azure security experience. Why Join HMLR: This ...

vulnerabilities are caught before they ship, not after. Support threat modelling and design reviews with engineering teams, using structured methods (STRIDE, MITRE ATT&CK) to identify risks early and influence architecture decisions directly. Build and maintain security tooling and automation from policy-as-code ...

point-in-time exercise. Lead risk assessments and threat-modelling sessions , selecting methodologies (ISO 27005, NIST RMF, STRIDE, MITRE ATT&CK) that are proportionate to system criticality, and ensuring findings feed into programme governance decisions rather than sitting in security documentation alone. Communicate security findings ...

Phishing & Business Email Compromise Malware & Ransomware Account Compromise Privilege Escalation Insider Threats DLP & Data Exfiltration Alerts Suspicious Authentication Activity Knowledge of: MITRE ATT&CK, Cyber Kill Chain, NIST CSF, and security event classification. If you're a skilled SOC Analyst with strong QRadar experience ...

automation skills (Python, Bash or similar). Experience configuring SIEM platforms. Understanding of security frameworks and threat frameworks such as MITRE ATT&CK . Desirable Experience with Microsoft Defender. Experience with additional SIEM or observability platforms. DevSecOps and CI/CD pipeline security experience. Security ...

possess: Strong experience with Microsoft-centric environments (M365, Azure, Intune, security baselines). Knowledge of compliance frameworks (NCSC guidance, Cyber Essentials), MITRE ATT&CK, encryption, IAM and secure configuration principles. The ability to manage operational workload while progressing ongoing improvement initiatives. Strong communication and stakeholder ...

concepts to validate network-based alerts and anomalies Cybersecurity Frameworks - Deeply understand and be able to articulate the elements of the MITRE ATT&CK framework, and Cyber Kill Chain; know how adversary tactics and techniques translate into observable indicators SIEM and Security Tools - Know ...

sponsorship available for this role. Desirable Experience working within Defence, MOD or other high-assurance environments. Understanding of frameworks such as MITRE ATT&CK, CAF or NIST. Experience designing or maintaining infrastructure used to support offensive security operations. Experience developing tools, automation or bespoke offensive ...

pairing practices that spread security knowledge across the team Tooling and practice familiarity Familiarity with structured threat modelling approaches - STRIDE, MITRE ATT&CK, attack trees - and experience embedding these into agile delivery ceremonies Experience integrating SAST, SCA, dependency scanning, and container security tooling into ...

hunting Investigating and responding to security incidents Engineering and improving SIEM environments Building and tuning detection rules Developing detection coverage around MITRE ATT&CK Supporting and maintaining client security platforms Scripting and automating SOC processes Helping develop and mature the UK SOC capability What ...

/CD principles within secure environments Strong written reporting and technical documentation skills Understanding of threat frameworks such as MITRE ATT&CK Desirable criteria Experience working within Defence, National Security or protectively marked environments Experience with Active Directory, Windows Services, Scheduled Tasks and IIS SIEM ...