476 to 500 of 679 SIEM Jobs in the UK

Operations domain, focused on helping customers improve and automate their SOC functions, tooling, and detection capabilities. Key Responsibilities: Design and deliver detection rulesets across SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real … detection approaches Identify gaps in telemetry, logging and enrichment, and provide recommendations to strengthen detection outcomes Job Requirements: Strong hands-on experience with SIEM engineering, including developing and tuning detection rules, with Microsoft Sentinel preferred Experience writing detection logic using KQL or similar query languages Proven experience designing and implementing ...

Designs, including specification of interfaces between solution components. Support the design and configuration of a range of security tools, such as: Splunk and Sentinel SIEM, Nessus Vulnerability management, Microsoft XDR and other as appropriate Specify infrastructure requirements (RAM, Disk, CPU, Network bandwidth) for security tools. Support the creation and establishment … tools including Jira and Cribl Core Duties Knowledge and experience of design, build, deployment and operation of SOC technology including at least two of SIEM, SOAR, EDR, Vulnerability Management, Threat Intelligence, to identify signs of an intrusion. Experience deploying and configuring applications in a performant manner on cloud and/ ...

Investigating and analysing escalated security alerts from Tier 1 analystsConducting detailed incident investigations to determine scope, impact and root causeMonitoring and analysing activity across SIEM, EDR and other security platformsIdentifying indicators of compromise, suspicious activity and emerging threatsSupporting incident response and containment activitiesPerforming threat hunting activities to proactively identify potential … within a Security Operations Centre (SOC), cyber security operations or incident response environmentExperience investigating and responding to complex security alerts and incidentsStrong knowledge of SIEM platforms and security event analysisExperience with endpoint detection and response (EDR) technologiesA good understanding of incident response processes and methodologiesKnowledge of common attack techniques, tactics ...

posture across the estate — CSPM, container and Kubernetes security, IaC review.Security OperationsOwn threat detection and telemetry fidelity end-to-end — high-fidelity signals into SIEM, log source coverage across endpoint, SaaS, cloud, and network.Own incident management — ensure the incident response plan is defined, tested, and executable, with clear escalation paths … including distributed, multi-region teams.Expert-level knowledge of secure SDL frameworks (OWASP SAMM, NIST SSDF), threat modelling, and security architecture.Deep experience with detection engineering, SIEM/XDR platforms, incident response, and MSSP management.Strong cloud security expertise — AWS required; container and Kubernetes security experience.Track record of translating technical risk into business ...

analysing escalated security alerts from Tier 1 analysts Conducting detailed incident investigations to determine scope, impact and root cause Monitoring and analysing activity across SIEM, EDR and other security platforms Identifying indicators of compromise, suspicious activity and emerging threats Supporting incident response and containment activities Performing threat hunting activities … Security Operations Centre (SOC), cyber security operations or incident response environment Experience investigating and responding to complex security alerts and incidents Strong knowledge of SIEM platforms and security event analysis Experience with endpoint detection and response (EDR) technologies A good understanding of incident response processes and methodologies Knowledge of common ...

with strong monitoring, analysis, and incident triage capabilities within a Security Operations Centre environment. SOC Analyst - Key Responsibilities Monitor and analyse security alerts from SIEM and security tooling platforms Perform triage and investigation of security events and potential incidents Conduct threat hunting and identify indicators of compromise Escalate and coordinate … Analyst - Required Skills and Experience Active DV clearance Experience working within a SOC environment (Level 2 or Level 3 preferred) Strong knowledge of SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or ArcSight Understanding of network protocols, attack techniques, and cyber threat methodologies Experience investigating security incidents across Windows and ...

custom exploits, adversary emulation scenarios, or security automation frameworks for internal testing. Knowledge of cloud-native logging, monitoring, and Security Information and Event Management (SIEM) integration for detecting sophisticated adversary tactics. Understanding of Kubernetes attack surfaces, including container escapes, privilege escalation, and lateral movement techniques. Current and active UK Developed … Vetting (DV) Security Clearance. Responsibilities: Deploy, configure, and manage cloud security platform tools and technologies, including Security Information and Event Management (SIEM), Intrusion Detection/Prevention Systems (IDS/IPS), and Cloud Workload Protection Platforms (CWPP). Develop and implement security monitoring and logging strategies. Investigate and analyse security incidents ...

custom exploits, adversary emulation scenarios, or security automation frameworks for internal testing. Knowledge of cloud-native logging, monitoring, and Security Information and Event Management (SIEM) integration for detecting sophisticated adversary tactics. Understanding of Kubernetes attack surfaces, including container escapes, privilege escalation, and lateral movement techniques. Current and active UK Developed … Vetting (DV) Security Clearance. Responsibilities: Deploy, configure, and manage cloud security platform tools and technologies, including Security Information and Event Management (SIEM), Intrusion Detection/Prevention Systems (IDS/IPS), and Cloud Workload Protection Platforms (CWPP). Develop and implement security monitoring and logging strategies. Investigate and analyse security incidents ...

custom exploits, adversary emulation scenarios, or security automation frameworks for internal testing. Knowledge of cloud-native logging, monitoring, and Security Information and Event Management (SIEM) integration for detecting sophisticated adversary tactics. Understanding of Kubernetes attack surfaces, including container escapes, privilege escalation, and lateral movement techniques. Current and active UK Developed … Vetting (DV) Security Clearance. Responsibilities: Deploy, configure, and manage cloud security platform tools and technologies, including Security Information and Event Management (SIEM), Intrusion Detection/Prevention Systems (IDS/IPS), and Cloud Workload Protection Platforms (CWPP). Develop and implement security monitoring and logging strategies. Investigate and analyse security incidents ...

collaborate globally, supporting audit, regulatory, and risk initiatives, with a focus on cloud computing and emerging technologies.Job Responsibilities:Design, scale, and manage the enterprise SIEM architecture to provide centralized visibility and high-fidelity threat detection across all corporate and cloud infrastructure.Develop and influence advanced SIEM correlation rules, custom data parsers … control testing, remediation quality, and traceability/auditability in line with resiliency expectations.Required Qualifications, Capabilities, and Skills:Hands-on experience advising and influencing enterprise SIEM platforms (e.g., Microsoft Sentinel, Splunk, Chronicle/SecOps). Must be proficient in writing/reviewing advanced detection logic (KQL, SPL, or YARA rules).Deep ...

globally, supporting audit, regulatory, and risk initiatives, with a focus on cloud computing and emerging technologies. Job Responsibilities: Design, scale, and manage the enterprise SIEM architecture to provide centralized visibility and high-fidelity threat detection across all corporate and cloud infrastructure. Develop and influence advanced SIEM correlation rules, custom data … testing, remediation quality, and traceability/auditability in line with resiliency expectations. Required Qualifications, Capabilities, and Skills: Hands-on experience advising and influencing enterprise SIEM platforms (e.g., Microsoft Sentinel, Splunk, Chronicle/SecOps). Must be proficient in writing/reviewing advanced detection logic (KQL, SPL, or YARA rules).Deep ...

globally, supporting audit, regulatory, and risk initiatives, with a focus on cloud computing and emerging technologies. Job Responsibilities: Design, scale, and manage the enterprise SIEM architecture to provide centralized visibility and high-fidelity threat detection across all corporate and cloud infrastructure. Develop and influence advanced SIEM correlation rules, custom data … testing, remediation quality, and traceability/auditability in line with resiliency expectations. Required Qualifications, Capabilities, and Skills: Hands-on experience advising and influencing enterprise SIEM platforms (e.g., Microsoft Sentinel, Splunk, Chronicle/SecOps). Must be proficient in writing/reviewing advanced detection logic (KQL, SPL, or YARA rules). ...

Deploy, configure, and manage cloud security platform tools and technologies, including Security Information and Event Management (SIEM), Intrusion Detection/Prevention Systems (IDS/IPS), and Cloud Workload Protection Platforms (CWPP).Develop and implement security monitoring and logging strategies.Investigate and analyse security incidents, including identifying root causes, determining the scope … developing custom exploits, adversary emulation scenarios, or security automation frameworks for internal testing.Knowledge of cloud-native logging, monitoring, and Security Information and Event Management (SIEM) integration for detecting sophisticated adversary tactics.Understanding of Kubernetes attack surfaces, including container escapes, privilege escalation, and lateral movement techniques.Current and active UK Developed Vetting ...

authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. 3. SIEM Experience Hands‐on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use‐case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. 4. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third‐party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. 5. Identity & Access ...

authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. 3. SIEM Experience Hands-on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use-case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. 4. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third-party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. 5. Identity & Access ...

authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. 3. SIEM Experience Hands-on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use-case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. 4. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third-party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. 5. Identity & Access ...

authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. 3. SIEM Experience Hands-on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use-case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. 4. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third-party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. 5. Identity & Access ...

authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. 3. SIEM Experience Hands-on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use-case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. 4. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third-party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. 5. Identity & Access ...

authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. 3. SIEM Experience Hands-on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use-case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. 4. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third-party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. 5. Identity & Access ...

authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. 3. SIEM Experience Hands-on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use-case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. 4. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third-party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. 5. Identity & Access ...

authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. 3. SIEM Experience Hands-on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use-case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. 4. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third-party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. 5. Identity & Access ...

/authorization models, secrets management and secure SDLC practices. Ability to work with development teams to improve application security posture and shift security left. SIEM Experience Hands-on experience with SIEM platforms for log onboarding, correlation rule creation, alert triage, dashboarding and use-case tuning. Ability to improve visibility, reduce … noise, and align SIEM content to relevant threats and business risks. Organisation/General Security Broad understanding of enterprise security domains including policy, governance, risk, compliance, awareness, third-party risk and operational security. Experience translating business and regulatory requirements into practical security controls and improvement plans. Identity & Access Management ...

similar)Cyber Security Network Control Incident Investigation with the assistance of group cyber security experts – Tier 1, Tier 2 to 3 preferred, using LogRhythm SIEM a bonusHost End Point Protection (Symantec)Host IPSPreferred Skills and KnowledgeVulnerability Management (Scanning for Vulnerabilities and classifying the risk, CIS Benchmark Scanning and compliance) – Using … and disadvantagesSecurity Zone Design and considerationsNetwork and Security Architecture Design and ConsiderationsUnderstanding of Information Security (Confidentiality, Integrity, Availability), MITRE ATT&CK, NIST, ISO 27001, SIEM use cases for key controls etcRisk Management in Cyber Security, SSL Blind spots, what causes them and how to mitigateMalware/Ransomware and ...

systems. As well as contributing to user awareness and training throughout Swissport.Your activitiesMonitor, investigate, and respond to security alerts, including those from the SOC, SIEM, and EDR platforms.Manage and fine-tune email security gateways, reviewing quarantined messages and adjusting rules to reduce false positives.Support the organisation’s vulnerability management process … campaigns and compliance follow-ups.Review and manage web access requests to ensure appropriate filtering and compliance.Help ensure logging coverage and data integrity for the SIEM by verifying that key systems are forwarding logs.Assist in investigations involving potentially compromised accounts or endpoint devices.Contribute to documentation and process development for consistent, repeatable ...

well as contributing to user awareness and training throughout Swissport. Your activitiesMonitor, investigate, and respond to security alerts, including those from the SOC, SIEM, and EDR platforms. Manage and fine-tune email security gateways, reviewing quarantined messages and adjusting rules to reduce false positives. Support the organisation's vulnerability management … compliance follow-ups. Review and manage web access requests to ensure appropriate filtering and compliance. Help ensure logging coverage and data integrity for the SIEM by verifying that key systems are forwarding logs. Assist in investigations involving potentially compromised accounts or endpoint devices. Contribute to documentation and process development ...