1 to 25 of 39 Contract Incident Response Jobs in the UK excluding London

Security Incident Response Engineer (ServiceNow) Contract: 6 Months (Likely Extension)Location: HybridIR35: Outside/LTD – £700PDSC Cleared/BPSSA highly reputable corporation is hiring an experienced ServiceNow Security Incident Response (SIR) Consultant to support the design, implementation and optimisation of a Security Incident Response capability for a Cyber Security Operations Centre (CSOC).This is an excellent opportunity to play a key role in enhancing cyber incident management processes, automating security workflows and integrating ServiceNow Security Operations with wider security tooling. Key Responsibilities ServiceNow SIR Workflow Design & Development Design and configure ...

Incident Response (CSIRT)/SOC Level 3 Analyst - Outside IR35 Location: Crawley (2-3 days onsite) Contract: 6 Months Outside IR35 We are looking for an experienced Incident Response (CSIRT)/SOC Level 3 Analyst to join a high-performing cyber security operations team … initial 6-month contract. This is an excellent opportunity for a senior cyber security professional with strong incident response, threat hunting, and SOC expertise to play a critical role in protecting enterprise IT and operational environments from advanced cyber threats. You will work closely with cyber security operations ...

IR35 Status: Outside IR35 Contract Length: 6 months initially Location: Hybrid - Liverpool Overview I'm supporting an organisation seeking an experienced Incident Response Manager to lead and mature its Incident Response capability across a complex enterprise environment. Responsibilities Own and manage cyber incidents from detection through … resolution. Review, enhance, and develop Incident Response frameworks, runbooks, and playbooks. Ensure alerts from SIEM, EDR, CTI, and SOC services are effectively integrated into Incident Response processes. Lead tabletop exercises and testing activities. Work closely with SOC, Threat Intelligence, Technology, and Business teams. Drive continual improvement ...

Details at a Glance Role: Security Incident Response Engineer Location: Warrington - hybrid, typically 2 days per week on site Contract length: 6 months (with strong potential for extension based on performance and project needs) IR35 status: Out of Scope Rate: 100/hour Clearance: Existing SC preferred … Would Be Doing This role sits at the intersection of cyber operations and ServiceNow engineering. You would be responsible for designing and embedding robust incident response capabilities in the ServiceNow Security Incident Response (SIR) module, closely aligned to NCSC and best-practice frameworks. ServiceNow SIR workflow ...

Blends hands-on incident command and digital forensics with programmatic capability building. Establishes the CSIRT operating model, creates scenario playbooks (ransomware, exfiltration) from scratch, and leads technical containment/recovery during active security events. About the Role My client is a well established business, looking for a hands … CSIRT Lead to establish and run the cyber incident response capability across a complex, multi-site industrial and corporate estate. The role blends hands-on incident command and digital forensics coordination with the programmatic build-out of incident playbooks and operational runbooks from scratch. Key Responsibilities ...

network estate (including Cisco Meraki). The role is hands-on and operational, partnering with IT teams to implement security controls, supportmonitoringand incident response through Sophos MDR, and improve cyber resilience by supporting Disaster Recovery (DR) testing and Business Continuity (BC) readiness. Key Responsibilities Cloud Security (Azure) Implement … whererequiredand ensure changes follow change control. Enable and review network security logging/alerting (e.g., syslog/SIEM integrations where applicable). Monitoring, Detection & Incident Response (Sophos MDR) Act as the internal technical point of contact for Sophos MDR and ensure smooth collaboration with MDR analysts. Maintain coverage ...

Incident Response (CSIRT)/SOC Level 3 Analyst - Outside IR35 Location: Crawley (2-3 days onsite) Contract: 6 Months Outside IR35 We are looking for an experienced Incident Response (CSIRT)/SOC Level 3 Analyst to join a high-performing cyber security operations team ...

Cribl Stream. This is an exciting opportunity to work within a large-scale enterprise environment, helping improve threat detection, security monitoring, automation, and incident response capabilities. Essential Experience Bachelor's degree (minimum qualification). Strong experience administering and developing Splunk Enterprise . Extensive experience with Splunk Enterprise Security … Experience with Cribl Stream , including log ingestion, data routing, transformation, parsing, and data normalisation. Experience working in enterprise Security Operations environments, including threat detection, incident response, and security event analysis. Experience with SOAR platforms, playbook development, and security automation. Good understanding of network security, including Firewalls, proxies, network ...

IR35 Status: Outside IR35 Contract Length: 6 months initially Location: Hybrid - Liverpool Overview I'm supporting an organisation seeking an experienced Incident Response Manager to lead and mature its Incident Response capability across a complex enterprise environment click apply for full job details ...

major project by reviewing a large volume of applications and ensuring they meet security standards before deployment. Whilst there is some exposure to Cyber Incident Response activities, this is very much a hands-on security assessment role where you'll be expected to work independently and manage … management tools such as Qualys (or similar) to assess security risks. Support ongoing cybersecurity project delivery within a high-profile programme. Assist with Cyber Incident Response activities where required, including security monitoring and investigation. What we're looking for We're looking for someone ...

Splunk Enterprise Security, Microsoft Sentinel, and SIEM architecture including data models, correlation rules, and administrative functions. Security Operations: Strong analytical skills in threat detection, incident response, and security event analysis with experience in large enterprise environments (10,000+ endpoints). Data Pipeline Management: Hands-on experience with … tools like Cribl, plus understanding of data normalisation and parsing in Splunk Enterprise. SOAR & Automation: Experience with Security Orchestration platforms, playbook development, and automated response workflows for incident management. Network Security Fundamentals: Working knowledge of network architectures, firewalls, proxies, and common attack vectors with troubleshooting expertise. Communication & Documentation ...

Splunk Enterprise Security, Microsoft Sentinel, and SIEM architecture including data models, correlation rules, and administrative functions. Security Operations: Strong analytical skills in threat detection, incident response, and security event analysis with experience in large enterprise environments (10,000+ endpoints). Data Pipeline Management: Hands-on experience with … tools like Cribl, plus understanding of data normalisation and parsing in Splunk Enterprise. SOAR & Automation: Experience with Security Orchestration platforms, playbook development, and automated response workflows for incident management. Network Security Fundamentals: Working knowledge of network architectures, firewalls, proxies, and common attack vectors with troubleshooting expertise. Communication & Documentation ...

point for complex issues impacting business-critical services. Execute technical recovery actions during incidents to restore service as quickly as possible. Participate in Major Incident and High-Priority Incident response activities. Technical Troubleshooting Diagnose and resolve application, infrastructure, integration, database, and data-related issues across supported products … architecture, business processes, and operational dependencies. Problem Management & Continuous Improvement Conduct root cause analysis (RCA) and contribute to Problem Management processes. Participate in post-incident reviews and recommend long-term preventative solutions. Drive continuous service improvement through automation, process optimisation, tooling enhancements, and reduction of recurring incidents. Monitor service ...

Outside IR35) Contract: 6-month rolling contract Location: Liverpool (Hybrid) Keywords: Information Security, Cyber Security, ISO27001, NIST, Risk, Governance, Vulnerability Management, Incident Response, Outside IR35 A leading organisation within the transport and logistics sector is looking for an Information Security Analyst to join its Group IT function … bring Previous experience in an Information Security, Cyber Security or IT Security Analyst role. Strong understanding of security principles including risk management, vulnerability management, incident response and access control. Knowledge of security frameworks such as ISO 27001, NIST or Cyber Essentials . Experience with common security technologies such ...

alerts within a live SOC environment. Analyse security incidents to determine scope, impact, and priority, ensuring appropriate escalation and response. Manage end-to-end incident response activities from detection through to resolution. Support the development and enhancement of SIEM use cases, detection rules, analytics, and playbooks. Conduct real … cloud environments, and enterprise IT infrastructure. Experience creating and tuning detection use cases, analytics, and playbooks. Knowledge of Information Security principles, threat detection, and incident response practices. Familiarity with Microsoft technologies, Linux systems, and security tooling. Understanding of security frameworks and data protection principles including GDPR ...

documentation and support the delivery of Group policy and frameworks To advise and support the SOC and Vulnerability Management teams on flow management policy, incident response plans and playbooks Work in collaboration with CSC DEx in other Natcos (International Group Companies France, Italy, Germany, Spain etc) Skillset/… functions and operating models. Knowledge of Vulnerability management principles Risk management and risk treatment process Audit preparation and evidence gathering Awareness of Incident response processes. Security Policy development and implementation Audit preparation and evidence gathering Stakeholder management Security awareness of modern cyber threats and defensive practices JSPs ...

least privilege implementation. Assist with penetration testing and remediation activities. Support security compliance with financial services regulatory requirements. Collaborate with Security Operations and Incident Response teams during security events. Support security assurance for third-party integrations and supplier solutions. Contribute to DevSecOps tooling and automated security testing. Promote … Security Policy-as-Code (OPA) DevSecOps Secure Software Development Lifecycle (SSDLC) Threat Modelling Vulnerability Management Security Monitoring and SIEM Security Compliance and Governance Incident Response ...

Principles of Cyber Security, Level 2) equips you with the practical skills employers are actively seeking. From threat intelligence and security testing to incident response and ethical compliance, you’ll gain hands-on experience that prepares you for today’s fast-growing cyber security and IT roles. … Understand cyber security principles and core frameworks Threat Intelligence: Develop expertise to identify risks Testing: Conduct cyber security testing, identify vulnerabilities and implement controls Incident Response: Prepare for and respond to cyber security incidents Ethics: Understand legislation and ethical conduct within cyber security Professional Skills: Build professional skills ...

with technical awareness , placing you at the centre of a live Security Operations Centre where you'll maintain situational awareness across multiple domains, coordinate incident response, and ensure effective operational decision-making. You'll act as the operational lead within a fast-paced control room environment, working closely … domains. Monitor live environments and assess alerts and incidents in Real Time. Perform initial triage and validation of alerts, reducing noise and ensuring accurate incident classification. Manage incident prioritisation and escalation in accordance with operational procedures. Coordinate response activities across SOC, NOC, Infrastructure and Security teams. Support ...

with technical awareness , placing you at the centre of a live Security Operations Centre where you'll maintain situational awareness across multiple domains, coordinate incident response, and ensure effective operational decision-making. You'll act as the operational lead within a fast-paced control room environment, working closely … domains. Monitor live environments and assess alerts and incidents in real time. Perform initial triage and validation of alerts, reducing noise and ensuring accurate incident classification. Manage incident prioritisation and escalation in accordance with operational procedures. Coordinate response activities across SOC, NOC, Infrastructure and Security teams. Support ...

workflows. * Ensure cloud environments align with security, governance, compliance, and software lifecycle standards. * Monitor cloud platforms using SIEM, cloud security, and observability tools. * Support incident, problem, and change management processes. * Work with containerised environments and infrastructure-as-code technologies. Essential Skills & Experience * Strong commercial experience with AWS, Azure … understanding of IAM, RBAC, encryption, cloud governance, and access management. * Experience working with Windows Server and Red Hat Linux environments. * Knowledge of SIEM platforms, incident response, and operational support processes. Desirable Skills * Experience working within regulated or financial services environments. * Relevant cloud certifications (AWS, Microsoft Azure, or Google ...

make sure security is built into day-to-day operations, projects and technology change. The team monitors for threats and weaknesses, investigates incidents, leads response and recovery when issues arise, and helps strengthen resilience through planning, training, awareness and continual improvement. It also supports compliance with recognised frameworks, works … improvements. Monitor, triage and investigate security alerts/reports. Analyse security event data, including end-user reports, to identify incidents and support effective response and remediation. Identify, assess and prioritise security risks (current and emerging), evaluating impact and likelihood. Investigate, monitor, and audit system practices to ensure services ...

offices on a hybrid basis. Cyber Security Specialist: Duties Adequate Implementation of security controls - XDR Escalation pint for security tickets raised in ITSM and Incident Management Portals Implementation/Operation of InfoSec processes, Threat Hunting, detection, monitoring and incident response Delivery of cyber security projects, implementation …/Testing cyber security technologies Support with controls, IAM, patch management and security event monitoring Identify cyber threats, hunting and exposure Involved in InfoSec incident management process - preparation, containment, analysis and response Implementation of new cyber security tooling and threat-informed systems Cyber Security Specialist: Experience Implementing security ...

maintain automated build and deployment pipelines Ensure repeatable, reliable, and secure deployment processes aligned with best practices Contribute to SRE practices including monitoring, incident response, latency management, and service reliability improvements Support observability initiatives by integrating monitoring, logging, and alerting tools Troubleshoot platform issues across Red Hat, Kubernetes ...

with security, governance and regulatory requirements. Optimise platform performance, scalability and cost efficiency. Develop tooling and self-service capabilities that improve engineering productivity. Support incident response, troubleshooting and root cause analysis activities. Produce and maintain platform standards, documentation and operational runbooks. Collaborate with engineering, architecture and security teams ...