1 to 25 of 49 TTP Jobs in England

development practices. Familiarity with security tools and technologies, such as SIEM, IDS/IPS, WAF and vulnerability scanners. Knowledge of common adversarial Tactics, Techniques and Procedures (Mitre Att&ck TTPs). Knowledge of security standards and frameworks (e.g. ISO27001, NIST CSF, AWS FSBP) is beneficial. Relevant security certifications (e.g. GCLD … development practices. Familiarity with security tools and technologies, such as SIEM, IDS/IPS, WAF and vulnerability scanners. Knowledge of common adversarial Tactics, Techniques and Procedures (Mitre Att&ck TTPs). Knowledge of security standards and frameworks (e.g. ISO27001, NIST CSF, AWS FSBP) is beneficial. Relevant security certifications (e.g. GCLD ...

practices. Perform host and network analysis using security logs, packet captures, forensic images, and telemetry data. Identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs), and map findings to the MITRE ATT&CK framework. Support sensitive investigations while maintaining evidence integrity and chain-of-custody requirements. Engage internal … trend analysis, and operational metrics. Support cyber simulations and tabletop exercises to validate response processes and stakeholder readiness. Stay current with emerging threats, attack techniques, vulnerabilities, and industry best practices. Skills and Experience Essential Hands-on experience in Cyber Incident Response, Security Operations (SOC), or Cyber Defence environments. Hands ...

environment. Experience developing, testing, and tuning threat detection use cases. Good understanding of the MITRE ATT&CK framework and common threat actor tactics, techniques, and procedures (TTPs). Experience conducting proactive threat hunting and analysing security telemetry. Strong analytical, investigation, and communication skills. Ability to collaborate effectively with SOC analysts ...

analytical products to assist mitigation practices at a tactical and operational level. Analysis of advanced persistent threats including the tactics, techniques, and procedures (TTPs) of attackers. Conduct analysis at a tactical and or operational level, identifying and using appropriate analytical tools and techniques to interpret gaps, patterns and trends, assess ...

happens, and feed what you learn back into the system Harden against new adversary techniques Work with Threat Intelligence to turn new tactics, techniques, and procedures into concrete hardening work and detection coverage Prioritize infrastructure hardening across cloud, identity, and endpoints based on observed attacker behaviour rather than benchmarks alone ...

and Expertise Essential: Demonstrable experience delivering high-complexity Red Team engagements end-to-end. Deep understanding of the adversary lifecycle and common tactics, techniques, and procedures (TTPs). Familiarity with evasion techniques and bypassing controls such as EDR/EPP, email/web gateways, proxies, etc. Experience in stakeholder engagement ...

and Expertise Essential: Demonstrable experience delivering high-complexity Red Team engagements end-to-end. Deep understanding of the adversary lifecycle and common tactics, techniques, and procedures (TTPs). Familiarity with evasion techniques and bypassing controls such as EDR/EPP, email/web gateways, proxies, etc. Experience in stakeholder engagement ...

and Expertise Essential: Demonstrable experience delivering high-complexity Red Team engagements end-to-end. Deep understanding of the adversary lifecycle and common tactics, techniques, and procedures (TTPs). Familiarity with evasion techniques and bypassing controls such as EDR/EPP, email/web gateways, proxies, etc. Experience in stakeholder engagement ...

Detection Engineering Develop, test, and optimise Splunk SPL correlation searches and alerting logic. Create and maintain detection use cases aligned to attacker tactics, techniques, and procedures (TTPs). Build AWS-focused detections leveraging CloudTrail, GuardDuty, IAM activity, and VPC Flow Logs. Tune and enhance detection content to improve alert accuracy … development. Experience building, tuning, and maintaining SIEM detection rules. AWS security monitoring experience including: CloudTrail GuardDuty IAM VPC Flow Logs Understanding of cyber attack techniques and threat detection methodologies. Knowledge of incident triage, investigation, and escalation processes. Experience working with Windows, Linux, authentication systems, and endpoint security logs. Strong communication ...

continue to evolve in line with emerging threats, customer requirements and industry standards. Research and Innovation Conduct research into emerging threat actor tactics, techniques and procedures (TTPs), offensive security tooling and adversary simulation approaches. Apply this knowledge to continuously improve technical capability and bring new ideas into customer engagements. Operational … capability development, service innovation and technical leadership activities. Research and Innovation Time: We encourage continuous learning and provide opportunities to explore new tooling, attacker techniques, research areas and emerging technologies that can be incorporated into customer engagements and future service offerings. Time to Recharge: Enjoy generous leave with the opportunity ...

continue to evolve in line with emerging threats, customer requirements and industry standards. Research and Innovation Conduct research into emerging threat actor tactics, techniques and procedures (TTPs), offensive security tooling and adversary simulation approaches. Apply this knowledge to continuously improve technical capability and bring new ideas into customer engagements. Operational … capability development, service innovation and technical leadership activities. Research and Innovation Time We encourage continuous learning and provide opportunities to explore new tooling, attacker techniques, research areas and emerging technologies that can be incorporated into customer engagements and future service offerings. What you’ll bring We are looking ...

Detection Engineering Develop, test, and optimise Splunk SPL correlation searches and alerting logic. Create and maintain detection use cases aligned to attacker tactics, techniques, and procedures (TTPs). Build AWS-focused detections leveraging CloudTrail, GuardDuty, IAM activity, and VPC Flow Logs. Tune and enhance detection content to improve alert accuracy … development. Experience building, tuning, and maintaining SIEM detection rules. AWS security monitoring experience including: CloudTrail GuardDuty IAM VPC Flow Logs Understanding of cyber attack techniques and threat detection methodologies. Knowledge of incident triage, investigation, and escalation processes. Experience working with Windows, Linux, authentication systems, and endpoint security logs. Strong communication ...

suspicious network activity. Coordinate containment, eradication and recovery activities with infrastructure, cloud, identity and application teams. Identify indicators of compromise and attacker tactics, techniques and procedures, using frameworks such as MITRE ATT&CK. Perform proactive threat hunting to identify suspicious activity and potential threats that may have bypassed existing security ...

Lead forensic investigations across host, network and cloud environments to identify root cause, scope and impact of cyber incidents. Analyse threat actor activity, attack techniques, malware and potential data exposure. Produce high‐quality forensic reports, attack timelines and actionable recommendations for clients. Deploy and utilise incident response tooling to collect … network and application forensics. Experience investigating complex cyber incidents from initial response through to reporting and remediation. Strong understanding of threat actor tactics, techniques and procedures (TTPs). Hands‐on experience with forensic and incident response tooling. Familiarity with malware investigation and compromised system analysis. Knowledge of enterprise infrastructure, including ...

activities, tasks, and resulting artifacts mandated by governing DoD and Air Force policies (i.e., Risk Management Framework (RMF). Recommending policies and procedures to ensure the reliability of and accessibility to information systems and to prevent and defend against unauthorized access to systems, networks, and data. Conducting risk and vulnerability … NIST RMF processes, policies, and DoD directives Expert ability to create and revise standard operating procedures (SOPs), work instructions (WI), and Tactics, Techniques, and Procedures (TTPs) Expert ability to create presentations and present policies, guidance, and procedures to varied audiences including senior leadership levels A demonstrated expertise in RMF process ...

Exposure to security platforms and technologies such as SIEM, EDR/XDR, identity systems, or cloud environments Foundational understanding of common attacker tactics, techniques, and procedures (TTPs), with familiarity of frameworks such as MITRE ATT&CK Analytical and problem-solving skills, with the ability to follow structured investigation processes and ...

security posture. Your responsibilities will include: Identifying and exploiting vulnerabilities in infrastructure, applications, and operational processes Developing realistic attack scenarios, leveraging tactics, techniques, and procedures (TTPs) from real‐world adversaries Bypassing defensive measures such as firewalls, EDRs, IDS/IPS, and other security tools to compromise target systems Essential experience … Cyber Specialist: Good understanding of national security expectations and personal security behaviours Knowledge of Windows security telemetry and associated evasion techniques (Kernel Callbacks, Minifilter drivers, ETW Ti, etc.) Proficient understanding of Kernel and User‐mode implant technology Expertise in covert communication techniques for evading detection Experience testing cloud environments ...

and ensure seamless integration across functions. You will drive innovation and lead R&D projects that push the limits of offensive security, replicating adversary tactics at scale to uncover vulnerabilities and provide actionable insights. Sounds perfect to me, what specifics are you looking for? Ideal Experience We’re looking … early‐stage B2B startup focusing on enterprise clients. Experience in building and deploying offensive security solutions, with a deep understanding of adversary tactics, techniques, and procedures (TTPs). Proven experience in architecting and scaling cloud‐based solutions to support intensive data processing and real‐time threat analysis. Written clean, maintainable ...

team exercises that simulate real-world attack scenarios to evaluate people, processes, and technology controls. Research and emulate emerging threat actor tactics, techniques, and procedures (TTPs) to ensure testing remains aligned to current threats. Develop and customise scripts, tooling, and exploits to support offensive security engagements. Assess the security ...

threat intelligence, incident response, cloud security, adversary simulation, offensive security, mobile/platform security, digital forensics, trust and safetyDeep expertise in attacker tactics, techniques, and procedures with demonstrated ability to advance the state of the artProficiency in coding with experience in languages such as Python or RustTrack record of architecting ...

Plan and execute red team engagements and adversary simulations against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with … building these systems to harden them Leverage AI-assisted tooling to accelerate reconnaissance, vulnerability discovery, and exploit development, and evaluate new AI-powered offensive techniques as they emerge Help define and mature DRW’s offensive security methodology, standards, and tooling, and mentor other engineers on the security team What ...

performance and value Skills/Must Have Proven experience running hands-on security operations in a complex environment Strong understanding of attacker tactics, techniques and procedures, and how to defend against them Experience owning and working directly within a security tooling stack (configuration, tuning, integrations) Broad, fundamentals-led understanding across ...

closely engaged in day‐to‐day analysis. WHAT THIS ROLE WILL DO Conduct hands‐on cyber threat intelligence analysis focused on threat actors, campaigns, tactics, techniques, procedures, infrastructure, malware, phishing activity, ransomware, and the cybercrime ecosystems targeting live entertainment, ticketing, and e‐commerce. Produce tactical, operational, and strategic intelligence products … intelligence experience in a dedicated CTI, cyber intelligence, or threat intelligence function. Demonstrated experience conducting threat actor analysis, adversary tracking, campaign analysis, IOC/TTP analysis, and intelligence production, including use of MITRE ATT&CK or similar frameworks to structure analysis and communicate adversary behaviour. Strong understanding of the intelligence ...

confidence scoring, temporal modeling, and graph enrichment capabilities. Model assets, applications, users, service accounts, privileges, vulnerabilities, misconfigurations, controls, alerts, incidents, indicators, threat actors, campaigns, tactics, techniques, and procedures. Implement graph analytics for attack paths, blast radius, privilege escalation, lateral movement, toxic combinations, identity exposure, control gaps, and vulnerability prioritization. Build ...

risk‐based recommendations, and knowing when to seek input or elevate. Familiarisation with common Incident Response frameworks such as NIST. Strong appreciation of attacker tactics, techniques and procedures. Occasional flexibility may be needed for urgent incidents; we aim to plan work sustainably. Knowledgeand hands onexperience withCyber Securitytools, such as Vulnerability ...