1 to 25 of 199 Permanent MITRE ATT&CK Jobs in England

conditions. Adversary Relevance: Assess the actors, motivations, campaigns, and outcomes most relevant to each customer. Threat Behaviour: Use recognised frameworks, including MITRE ATT&CK, to describe adversary behaviour and identify defensive opportunities. Vulnerability Intelligence: Assess vulnerabilities, exploitation evidence, threat relevance, potential impact, and customer exposure. … assessments and proportionate actions. Identify and analyse relevant threat actors, campaigns, malware, and infrastructure. B. Threat Behaviour and Defensive Relevance Use MITRE ATT&CK to connect actor and campaign activity with techniques, defensive coverage, and hunting opportunities. Maintain structured analysis that supports early warning, prioritisation ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

modern SIEM platform (e.g. Sentinel) including KQL detection rules, workbooks, logging pipelines, and AI-assisted alert triage. Map detection coverage against MITRE ATT&CK tactics and techniques. Identify and close visibility gaps across the cloud estate. Maintain alignment to PCI DSS, SOC2, ISO27001 NIST … Python, PowerShell, or Bash for security automation. Strong grasp of PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. Nice to have AZ-500, AWS Certified Security – Specialty, or equivalent cloud security certification. Experience integrating ATT&CK ...

detection-as-code approach, making detections and automations consistent, scalable, and repeatable. Work directly with customers to define detection strategies, design MITRE ATT&CK-aligned use cases, and close gaps in visibility, coverage, and response maturity. Partner with onboarding and engineering teams as the detection … playbook delivery using Logic Apps, Cortex XSOAR, or similar. Python, PowerShell, or similar scripting, plus API-driven automation and integration. MITRE ATT&CK-aligned use case design, coverage assessment, and log-source mapping to the attack lifecycle. XDR/EDR experience: Microsoft Defender, CrowdStrike, Cortex ...

with internal teams and vendors to ensure reliable, high-quality telemetry Detection Engineering Design and implement detection use cases aligned to MITRE ATT&CK and threat intelligence Build and tune correlation rules, anomaly detections, dashboards, and alerting workflows Continuously refine detections to reduce false positives … Solid understanding of networking, Windows/Linux systems, cloud platforms (Azure, AWS, GCP), identity systems, and endpoint security tools Knowledge of MITRE ATT&CK , cyber kill chain, and threat hunting techniques Requirements Degree (Level 4+) in a computing-related subject or equivalent experience Background across ...

forensic images, and telemetry data. Identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs), and map findings to the MITRE ATT&CK framework. Support sensitive investigations while maintaining evidence integrity and chain-of-custody requirements. Engage internal and external forensic specialists when appropriate. … systems, authentication events, network traffic, and security logs. Ability to create clear investigation reports, management updates, and technical documentation. Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST Incident Response frameworks. Understanding of enterprise networking, identity and access management, cloud security, email security, endpoint ...

reduce false positives. Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate. Map detection coverage against the MITRE ATT&CK framework. SOC Operations Monitor and triage security alerts within Splunk SIEM. Investigate security incidents including phishing attacks, credential abuse, malicious process … Strong communication and stakeholder engagement skills. Desirable Skills Experience with Cribl. Knowledge of OCSF schemas and security data normalisation. Familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks. Experience with Sigma, YARA, or IDS signature development. Exposure to Splunk SOAR, Cortex XSOAR, or other automation ...

reduce false positives. Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate. Map detection coverage against the MITRE ATT&CK framework. SOC Operations Monitor and triage security alerts within Splunk SIEM. Investigate security incidents including phishing attacks, credential abuse, malicious process … Strong communication and stakeholder engagement skills. Desirable Skills Experience with Cribl. Knowledge of OCSF schemas and security data normalisation. Familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks. Experience with Sigma, YARA, or IDS signature development. Exposure to Splunk SOAR, Cortex XSOAR, or other automation ...

reduce false positives. Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate. Map detection coverage against the MITRE ATT&CK framework. SOC Operations Monitor and triage security alerts within Splunk SIEM. Investigate security incidents including phishing attacks, credential abuse, malicious process … Strong communication and stakeholder engagement skills. Desirable Skills Experience with Cribl. Knowledge of OCSF schemas and security data normalisation. Familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks. Experience with Sigma, YARA, or IDS signature development. Exposure to Splunk SOAR, Cortex XSOAR, or other automation ...

playbooks, runbooks, and standard operating procedures. Stay current with the evolving threat landscape, attacker TTPs (mapped to frameworks such as MITRE ATT&CK), and industry best practices. Required Qualifications, Capabilities, and Skills Demonstrable experience in a SOC, incident response, or security analyst role (typically 2+ … across SIEM, EDR/XDR, and network security tooling. Working knowledge of common attack techniques, the cyber kill chain, and the MITRE ATT&CK framework. Strong understanding of core networking concepts (TCP/IP, DNS, HTTP/S, proxies, firewalls) and operating system internals (Windows ...

Microsoft Sentinel, Splunk, QRadar, ArcSight, Exabeam, and LogRhythm . Ensure accurate mapping of detection content to recognised threat frameworks, including MITRE ATT&CK . Identify detection gaps, duplicate content and optimisation opportunities through detection engineering, threat hunting, and alert tuning activities. Support standardisation of monitoring … teams. Strong understanding of attacker tactics, techniques and procedures (TTPs). Experience mapping detections to recognised threat frameworks such as MITRE ATT&CK . Experience using KQL, SPL, SQL , or similar query languages for investigation, threat hunting, and alert validation. Ability to define escalation criteria ...

security detections, analytics, use cases, investigation methodologies, playbooks, and response procedures, including validating detection coverage against realistic adversary behaviors and the MITRE ATT&CK framework.* Drive automation and orchestration across security operations, using security queries, scripting, and automation to analyze data, accelerate investigations, reduce repetitive … Management, Curiosity, Critical thinking, Problem-solving, Technical Writing, Continuous improvement, Communication, Mentoring/Coaching.* Advanced threat investigation, Threat actor TTP analysis (MITRE ATT&CK), Threat Hunting.**Desirable*** Agentic AI.* Malware analysis.* Digital forensics and evidence preservation.## Rewards & benefitsExplore the rewards and benefits that help ...

ingestion requirements Investigate and resolve telemetry, parsing and alerting issues Support change control, release management and deployment processes Map detections to MITRE ATT&CK techniques and identify visibility gaps Work closely with SOC teams to ensure alerts are actionable and relevant Produce clear technical documentation … Sentinel data connectors, Log Analytics, parsers and security telemetry Strong troubleshooting skills across data ingestion, parsing and alert generation Knowledge of MITRE ATT&CK Understanding of identity, endpoint, network, cloud and infrastructure security monitoring Experience using Git repositories and controlled deployment processes Excellent communication ...

suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed.• Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage.• Create, test and tune threat-hunting … business impact.• Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments.• Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour.• Experience working within change-controlled environments and following ...

cyber incident response and business continuity/disaster recovery arrangements for major security events. Use threat intelligence and frameworks such as MITRE ATT&CK to understand emerging threats, assess exposure, and strengthen defensive controls. Build a positive security culture through engaging awareness training and proportionate … least‐privilege principles. Writing organisational security policies and contributing to an ISMS. Using Wazuh or other SIEM platforms, EDR tools, and MITRE ATT&CK for threat modelling or detection improvement. Implementing application control or allow‐listing using AppLocker or similar technologies. Automating repeatable tasks using ...

suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed. Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage. Create, test and tune threat-hunting … business impact. Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments. Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour. Experience working within change-controlled environments and following ...

will be responsible for producing an executive summary-style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … under stressful circumstancesOccasionally willing to begin work early and/or stay late when warranted for customer engagementsStrong grasp of the MITRE ATT&CK frameworkEnjoy mentoring and assisting in the development of junior analystsA team-player attitude with a willingness to share knowledgeAbility to work ...

actions, phishing simulation scenarios, and runbook updates. Conduct hypothesis-driven hunts across identity, endpoint, email, network, cloud, and application telemetry using MITRE ATT&CK and document scope, queries, evidence, findings, and follow-up actions. Vulnerability Management Partnership Validate vulnerability findings, assess risk and business exposure … Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments. Familiarity with MITRE ATT&CK and common detection, threat‐hunting, and incident‐response methodologies. Understanding of vulnerability scanning and remediation workflows and the division of responsibility ...

establish scope, root cause, attacker activity and affected assets. Identify indicators of compromise, tactics, techniques and procedures, and map findings to MITRE ATT&CK where appropriate. Support legally or regulatorily sensitive investigations by maintaining evidence integrity, chain of custody and appropriate access controls. Engage specialist … lessons learned. Experience producing incident records, investigation reports, management updates and post‐incident findings. Understanding of attacker behaviours and frameworks including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance. Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint ...

Cloud and Entra ID Protection. Own detection engineering: write and tune KQL analytics rules and hunting queries, map coverage to MITRE ATT&CK, track false‐positive rates, and retire rules that no longer earn their place. Automate response with automation rules and Logic Apps playbooks … rules and Logic Apps playbooks. Strong KQL and detection engineering: you can write, tune and defend an analytics rule mapped to MITRE ATT&CK, and explain why it fires and why it does not. Incident response on a cloud platform: triage, containment, evidence collection ...

implement SOAR workflows to automate detection, response, and security operations processes. Conduct proactive threat hunting using SIEM/EDR data and MITRE ATT&CK‐aligned techniques. Support vulnerability assessment and security scanning activities using relevant tools. Provide input into penetration testing activities and interpret findings … Security (ES). Solid understanding of network protocols, cloud security (AWS/Azure), and threat detection methodologies. Working knowledge of the MITRE ATT&CK framework. Experience building automation or SOAR playbooks for security operations. CrowdStrike certifications (CCFA/CCFR/CCSE – any combination preferred). ...

security platforms Design, develop, test, deploy and tune analytics rules, correlation logic, threat-hunting queries and reusable detection content aligned with MITRE ATT&CK Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations Develop logging standards … Custom Ingestion Windows Event Forwarding and Collection XPath Filtering Windows Event IDs Sysmon PowerShell Logging Logic Apps REST APIs PowerShell Python MITRE ATT&CK Detection Coverage Analysis Git-Based CI/CD Cribl Soft Skills: Proactive, accountable and delivery-focused approach Strong analytical, troubleshooting ...

cause analysis for Defender XDR and Sentinel incidents Developing and tuning detections and KQL queries, and running threat hunts mapped to MITRE ATT&CK Hardening our Microsoft environment across Entra ID, Intune, Defender for Endpoint and Azure, and owning the vulnerability management lifecycle Administering … concise written communication, from incident reports to management-ready metrics It would be a bonus if you also have: KQL and MITRE ATT&CK knowledge Microsoft SC-200, SC-100 or AZ-500 certification Experience in financial services or another regulated environment, and familiarity with ...