601 to 625 of 771 SIEM Jobs in the UK

security capabilities, including: Microsoft Defender (Endpoint, Identity, Office 365, Cloud Apps) Microsoft Entra ID (P2), Conditional Access and identity protection Microsoft Sentinel (SIEM integration) Microsoft Purview Strong experience designing and implementing Microsoft Purview capabilities, including DLP, Information Protection, Insider Risk and eDiscovery Strong understanding of Zero Trust architecture principles, particularly … identity-driven security models Experience deploying and operating Defender and SIEM capabilities, integrated within a wider security ecosystem Experience conducting security design reviews and translating policy into practical controls Experience performing risk assessments aligned to recognised methodologies Strong understanding of cloud security concepts across IaaS, PaaS and SaaS, particularly within ...

assets from threats and risks by monitoring, detecting, analysing, and responding to security incidents. Key Responsibilities Oversee the day to day running of our SIEM solution (Chronicle) working closely with Infrastructure, Networks, DevOps and our outsourced Security Operations Centre (SOC) team. Define and facilitate the creation of new rules … fine-tuning existing rules within SIEM. Investigate SIEM alerts and other security incidents through to completion. Work within the Information Security Team to provide a dynamic monitoring and incident response capability. Monitor and analyse security events identifying trends, attacks, and potential threats. Identify and raise problems. Communicate & raise problems. Monitoring ...

Senior Security Operations Engineer (SOC Engineer L3) to join their security function. This is a highly technical role focused on SOC engineering, detection engineering, SIEM/SOAR, security automation and AI-driven security operations . You’ll design and improve security monitoring, detection, response and automation capabilities across a large … enterprise environment, with a particular focus on AI and agentic technologies . Key Responsibilities Design and optimise security monitoring, SIEM and detection capabilities . Onboard and manage security logs, including ingestion, parsing, normalisation and enrichment . Develop and tune detection rules, correlation searches and threat detection use cases . Build ...

incident response capability, contributing significantly to the company's overall security posture and resilience. KEY RESPONSIBILITIES: Oversee the day to day running of our SIEM solution (Chronicle), working closely with Infrastructure, Networks, DevOps and our outsourced Security Operations Centre (SOC) team. Define and facilitate the creation of new rules … fine-tuning existing rules within SIEM. Investigate SIEM alerts and other security incidents through to completion. Work within the Information Security Team to provide a dynamic monitoring and incident response capability. Monitor and analyse security events, identifying trends, attacks, and potential threats. Identify and raise problems, communicating and escalating these ...

and security data models. Serve as a technical escalation point for high‐severity security incidents, facilitating rapid investigation, containment, and remediation using EDR and SIEM tools. Develop and implement SOAR workflows to automate detection, response, and security operations processes. Conduct proactive threat hunting using SIEM/EDR data and MITRE … needed. Requirements Minimum of 5+ years’ experience in Cyber Security Engineering or SOC Tier 3 role. Strong hands‐on experience with endpoint security and SIEM platforms in enterprise environments. Experience supporting or working alongside managed SOC providers. At least 2 years’ experience in vulnerability assessment tools (desirable). Exposure ...

Security Engineer to join a high-profile cyber security programme supporting critical public sector environments. This role sits at the intersection of Security Operations, SIEM engineering, and cloud-based data engineering, offering the opportunity to work on large-scale security monitoring platforms and cloud-native security solutions. The Role … role in designing, optimising, and maintaining security telemetry pipelines while supporting SOC operations and detection engineering activities. You'll work with cloud-native technologies, SIEM platforms, and security data tooling to improve visibility, detection capability, and operational resilience across complex environments. Key Responsibilities Manage and optimise security log ingestion pipelines ...

Security Engineer to join a high-profile cyber security programme supporting critical public sector environments. This role sits at the intersection of Security Operations, SIEM engineering, and cloud-based data engineering, offering the opportunity to work on large-scale security monitoring platforms and cloud-native security solutions. The Role … role in designing, optimising, and maintaining security telemetry pipelines while supporting SOC operations and detection engineering activities. You'll work with cloud-native technologies, SIEM platforms, and security data tooling to improve visibility, detection capability, and operational resilience across complex environments. Key Responsibilities Manage and optimise security log ingestion pipelines ...

including HLDs, LLDs, architecture patterns and data-flow diagrams. Lead the refresh and evergreening of security technologies, including IAM, PAM, firewalls, EDR/XDR, SIEM, vulnerability management and cloud security. Evaluate new technologies through PoCs/PoVs and make clear, evidence-based recommendations. Design and review cloud, identity, network, perimeter … ability to influence both technical and senior stakeholders. CISSP (or equivalent) and TOGAF and/or SABSA. Desirable: Zero Trust, DevSecOps, MITRE ATT&CK, SIEM, PAM, Kubernetes/container security, PKI and security automation experience. We believe strong connections and community are key to our success. Our work model prioritizes ...

including HLDs, LLDs, architecture patterns and data-flow diagrams. Lead the refresh and evergreening of security technologies, including IAM, PAM, firewalls, EDR/XDR, SIEM, vulnerability management and cloud security. Evaluate new technologies through PoCs/PoVs and make clear, evidence-based recommendations. Design and review cloud, identity, network, perimeter … ability to influence both technical and senior stakeholders. CISSP (or equivalent) and TOGAF and/or SABSA. Desirable: Zero Trust, DevSecOps, MITRE ATT&CK, SIEM, PAM, Kubernetes/container security, PKI and security automation experience. We believe strong connections and community are key to our success. Our work model prioritizes ...

including HLDs, LLDs, architecture patterns and data-flow diagrams. Lead the refresh and evergreening of security technologies, including IAM, PAM, firewalls, EDR/XDR, SIEM, vulnerability management and cloud security. Evaluate new technologies through PoCs/PoVs and make clear, evidence-based recommendations. Design and review cloud, identity, network, perimeter … ability to influence both technical and senior stakeholders. CISSP (or equivalent) and TOGAF and/or SABSA. Desirable: Zero Trust, DevSecOps, MITRE ATT&CK, SIEM, PAM, Kubernetes/container security, PKI and security automation experience. We believe strong connections and community are key to our success. Our work model prioritizes ...

including HLDs, LLDs, architecture patterns and data-flow diagrams. Lead the refresh and evergreening of security technologies, including IAM, PAM, firewalls, EDR/XDR, SIEM, vulnerability management and cloud security. Evaluate new technologies through PoCs/PoVs and make clear, evidence-based recommendations. Design and review cloud, identity, network, perimeter … ability to influence both technical and senior stakeholders. CISSP (or equivalent) and TOGAF and/or SABSA. Desirable Zero Trust, DevSecOps, MITRE ATT&CK, SIEM, PAM, Kubernetes/container security, PKI and security automation experience. At DXC Technology, we believe strong connections and community are key to our success. ...

and security maturity improvements. Get exposure to AI security: Work around Copilot, AI agents, Purview, and data security compliance. Broad technical remit: Microsoft security, SIEM, incident response, cloud/SaaS security, identity, and network security. Room to grow: The team is investing in capability, and strong performers may have scope … management, remediation planning, reporting, and automation. Security incident triage, investigation, and response. Microsoft Defender, Entra ID/Active Directory, Conditional Access, and related controls. SIEM query building and KQL. Ransomware resilience, including backup and network segmentation. Cyber Essentials Plus and wider security maturity initiatives. AI, Copilot, Purview, and data security ...

Around 2-3+ years of commercial cyber security experience Hands on experience within Microsoft security environments Experience with Microsoft Sentinel or other SIEM/SOC technologies Knowledge of XDR/EDR, vulnerability management and incident response Good understanding of Identity & Access Management, ideally including Entra … have a genuine say in how the organisation develops its cyber security capability. If you have experience across Microsoft security, Azure, Sentinel, SOC/SIEM or Identity & Access Management and are looking for the next step in your career, we would like to hear from you. Are you interested ...

evidence is preserved and lessons learned are translated into improvements across security controls and response capabilities. Key Responsibilities Monitor and investigate security alerts across SIEM, EDR/XDR, identity, email, cloud and network security platforms. Triage incidents, assess severity and business impact, and coordinate appropriate escalation and response activities. Investigate … processes. Skills & Experience Required Proven experience in cyber security incident response, security operations or a SOC environment. Hands‐on experience investigating security incidents using SIEM and EDR/XDR technologies. Strong understanding of Windows and Linux security artefacts, authentication logs, network traffic and packet analysis. Understanding of enterprise networking, identity ...

and secure SD‐WAN. Threat and Exposure Management, including EDR, EPP, XDR, CTEM, vulnerability management and OT security. Security Operations and Governance, including SOAR, SIEM, MDR, GRC and third‐party risk management. KEY RESPONSIBILITIES Capability leadership and governance Lead the Cyber Security Technical Pre‐Sales capability and provide … ability to challenge constructively. (ESSENTIAL) Awareness of security frameworks and regulations relevant to the UK and EU markets. (ESSENTIAL) Understanding of security operating models, SIEM, SOC and managed security concepts. (DESIRABLE) Ability to manage competing priorities and make sound decisions with incomplete information. (ESSENTIAL) CORE COMPETENCIES AND SKILLS Technical leadership ...

facing consultancy role where you'll work with a wide range of organisations to design, develop and optimise detection and response capabilities across leading SIEM, XDR and SOAR technologies. You'll combine deep technical expertise with strong consulting skills, helping customers improve their security maturity through practical, scalable solutions. What … doing You'll play a key role in delivering detection engineering engagements, including: Designing and implementing high-quality detection rules across SIEM and XDR platforms. Creating and optimising detection logic using KQL and other query languages. Developing detection use cases aligned with the MITRE ATT&CK framework and current threat ...

implementatie en het beheer van specifieke security-oplossingen. Je bent de kartrekker voor onder andere het opzetten van ons nieuwe SOC, Microsoft Sentinel (SIEM) voor actieve threat detection en het beheren van Microsoft Defender for Cloud voor vulnerability management. Je analyseert en volgt security-incidenten op, en bent de drijvende … kracht achter de (versnelde) implementatie van een Security Operations Center (SOC). Ontwikkelen en onderhouden van detectieregels en playbooks (met SOAR/SIEM-tools); Samenwerken met collega’s om incidenten snel en effectief te mitigeren; Continu verbeteren van onze monitoring- en responsprocessen; Rapporteren van bevindingen en adviseren over structurele verbeteringen ...

concepts, CONOPS and high/low-level architecture designs • Working directly with senior client and government stakeholders • Designing and integrating security technologies including SIEM, SOAR, EDR, Threat Intelligence and Vulnerability Management • Assessing existing SOC capabilities and developing security maturity • Designing scalable, resilient on-prem and cloud security architectures • Supporting accreditation … deployment and operation They're looking for: • Strong experience in SOC architecture and security operations • Hands-on architectural experience across at least two of SIEM, SOAR, EDR, Vulnerability Management or Threat Intelligence • Strong understanding of security operations, threat detection and incident response • Experience designing both on-prem and cloud security ...

Incident Response Lead for major cyber security events, coordinating technical investigations, containment and remediation activities. Lead advanced threat hunting and digital forensic investigations using SIEM, EDR, network telemetry and threat intelligence sources. Work closely with global CSOC teams to improve cyber defence capabilities, operational processes and detection methodologies. Provide clear … . Proven success leading teams, projects or operational cyber security functions. Strong incident response, cyber threat hunting and digital forensics expertise. Experience using commercial SIEM, EDR and network analysis platforms. Strong understanding of network protocols and traffic analysis across the OSI model. Experience working with cyber threat intelligence methodologies and ...

looking for people who want to build something. What You’ll Do Alert Triage & Monitoring Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments. Investigate alerts to determine scope, severity, and whether escalation is warranted. Leverage AI-assisted triage and enrichment tools … lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication. Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure. Execute established ...

Months Initially Rate: Competitive IR35: Outside IR35 Start Date: ASAP Duties and Responsibilities: Incident Detection, Triage and Response: Monitor and analyse alerts from SIEM, EDR/XDR, identity, email, cloud, network and other security controls to identify suspicious or malicious activity. Triage alerts, validate incidents, determine severity and business impact … expectations. Practical experience in cyber incident response, security monitoring or a Security Operations Centre environment. Hands‐on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies. Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures. Working knowledge of incident ...

demos, and solution walkthroughs for enterprise security teams across the UK and Europe Run structured technical discovery to understand customer security posture, existing tooling (SIEM, EDR, SOAR, identity), and integration needs Design and validate customer-specific solutions that meet technical, security, compliance, and business requirements Serve as the primary technical … and CISOs in complex enterprise sales cycles Strong understanding of modern security architecture: identity, endpoint, network, and cloud (AWS, Azure, GCP) Strong knowledge of SIEM, EDR/XDR, SOAR, and common log sources (CloudTrail, Okta, endpoint telemetry, etc.) Familiarity with detection frameworks (MITRE ATT&CK) and threat modeling Comfort with ...

class looks like. What you’ll be doing: Own and improve the threat detection lifecycle across a complex cloud estate Build and enhance SIEM detection rules, use cases and monitoring Automate manual detection and remediation processes Develop threat intelligence and threat-hunting capabilities Improve security monitoring across AWS, GCP and … and help upskill others across the security function What we’re looking for: Experience building detections rather than purely responding to SOC alerts Strong SIEM experience – Microsoft Sentinel, Splunk or similar Cloud security experience across AWS, GCP and/or Azure KQL, SPL or similar querying experience Python scripting/ ...

Platform Engineer – Monitoring, Observability & SIEM (MONSO) For our SPEAR Technology (Security, Platform Engineering, Automation and Runtime) division in London we are looking to hire a: Platform Engineer – Monitoring, Observability & SIEM (MONSO) Like solving puzzles with an inquisitive mind? Think outside the box and challenge the status quo? Prefer simplicity over … other teams to do more themselves—such as empower-ing our SOC/CyberSec team to develop (including AI-assisted workflows), test, and deploy SIEM use cases independently via CI/CD. The platform spans Splunk Enterprise on-prem (running on Kubernetes), Splunk Observability Cloud, and SolarWinds , with future expansion ...

many of the listed technologies (from Gartner MQ-leading vendors) and services as possible. Managed Detection & Response (MDR) Services Security Information and Event Management (SIEM) Extended Detection & Response (XDR) Network Security (NGFW/…/IPS/WAF/SASE/SSE/NAC) Privileged Access Management (PAM)/MFA/SSO DLP/Information Protection Security Information & Event Management (SIEM) Security Orchestration, Automation, and Response (SOAR) Incident Response (IR) Cloud Access Security Broker (CASB) Vulnerability Management (VM) Dynamic Application Security Testing (DAST) Cyber ...