1 to 25 of 53 Permanent MITRE ATT&CK Jobs in the UK excluding London

delivered in a consistent and scalable way. Working directly with customers, you will define detection strategies, design use cases aligned to MITRE ATT&CK, and guide improvements in visibility, coverage and response maturity. You will work closely with platform onboarding and engineering teams, supplementing them … SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real‐world attack techniques Map customer log sources to detection use cases to assess coverage and identify gaps Design ...

delivered in a consistent and scalable way. Working directly with customers, you will define detection strategies, design use cases aligned to MITRE ATT&CK, and guide improvements in visibility, coverage and response maturity. You will work closely with platform onboarding and engineering teams, supplementing them … rulesets across SIEM and XDR platformsDevelop and tune detection logic using KQL or equivalent query languagesDesign detection use cases aligned to MITRE ATT&CK and real-world attack techniquesMap customer log sources to detection use cases to assess coverage and identify gapsDesign and implement SOAR ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

Engineering: Build, tune and maintain detection rules, correlation logic and alerting across SIEM and EDR. Engineer high-fidelity detections mapped to MITRE ATT&CK. Continuously reduce false positives and expand coverage. Automation: Engineer automation for security operations at scale — scripting (Python, Bash, PowerShell) for response orchestration, access … security events, perform root cause analysis, and apply threat intelligence to improve defensive posture. Understand attacker TTPs and operationalise frameworks like MITRE ATT&CK and NIST CSF. Vulnerability Management: Own the vulnerability management programme end to end — scanning, prioritisation, remediation tracking, SLA enforcement and executive ...

dependencies, and error handling Ensure consistency and usability for wider teams Strategic Contribution Support use cases aligned to threat modelling and MITRE ATT&CK Contribute to automation playbooks and response strategies Stay current with tools, frameworks, and emerging threats Collaboration Embed automation into SOC workflows … platforms Proficiency in scripting (e.g., Python, PowerShell) Experience working with APIs, webhooks, and authentication methods Knowledge of threat frameworks (e.g., MITRE ATT&CK) Understanding of cloud security, identity, and event-driven automation Strong communication and analytical skills Security clearance (NPPV and/ ...

will be responsible for producing an executive summary-style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team-player attitude with a willingness to share knowledge ...

Analyse network traffic, endpoint activity, logs and alerts to uncover malicious behaviour. Drive continuous improvement of detection capabilities aligned to the MITRE ATT&CK framework. Enhance SOC processes, tooling, playbooks and operational effectiveness. Mentor and develop analysts, helping build the next generation of cyber security … mentoring analysts in an operational security environment. It would be great if you had: Detection engineering or threat-informed defence experience. MITRE ATT&CK framework knowledge. Python, PowerShell or Bash scripting skills. Malware analysis or reverse engineering exposure. CREST, Blue Team Level 1 or similar ...

maintain threat detection use cases aligned to real-world attack scenarios Build and tune detection logic using industry frameworks such as MITRE ATT&CK Conduct proactive, hypothesis-led threat hunting across client environments Analyse telemetry, threat intelligence and security data to identify suspicious activity Develop … threats and improving security operations. You'll ideally have experience with: Threat Hunting Detection Engineering Security Operations Centres (SOC) SIEM technologies MITRE ATT&CK Framework Threat Intelligence Detection rule creation and tuning Security telemetry analysis Incident detection and investigation Writing detection use cases and playbooks ...

will build, validate, tune, and optimize detection logic and coverage, leveraging attacker tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK to improve accuracy and reduce false positives Execute and coordinate security event response activities, including containment, isolation, escalation, and remediation, applying … paths, including credential theft, privilege escalation, and session/token abuse Considerable understanding of attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CK Record of improving operational effectiveness, including reducing alert noise, improving detection coverage, and decreasing mean time to detect and respond Great ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

cloud environments Perform threat modelling by deconstructing technical solutions, identifying threats and vulnerabilities using recognised methodologies such as STRIDE and MITRE ATT&CK Analyse risks and benefits of design options to support safe architectural decisions, defining security testing requirements and assessing findings Communicate technical security … APIs and containerised microservices Up-to-date knowledge of emerging threats with practical experience applying threat modelling frameworks including STRIDE and MITRE ATT&CK Strong understanding of cybersecurity domains across endpoint, network, cryptography, information management, and IAM in enterprise environments Awareness of industry security standards ...

understanding of the unique challenges associated with OT and IT systems. Knowledge of threat-led detection engineering, adversary frameworks such as MITRE ATT&CK and ICS ATT&CK, and cyber threat modelling methodologies will be highly valued.You will be comfortable engaging with ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

will build, validate, tune, and optimize detection logic and coverage, leveraging attacker tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK to improve accuracy and reduce false positivesExecute and coordinate security event response activities, including containment, isolation, escalation, and remediation, applying sound … attack paths, including credential theft, privilege escalation, and session/token abuseConsiderable understanding of attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CKRecord of improving operational effectiveness, including reducing alert noise, improving detection coverage, and decreasing mean time to detect and respondGreat analytical, decision-making ...

standard - author, tune, and peer-review detections in KQL, SPL, EQL, or Sigma; manage the false-positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves. Own the threat-landscape narrative for your engagement - turn intelligence from … similar environment - including writing and tuning detections in KQL, SPL, EQL, or Sigma, and managing coverage against MITRE ATT&CK Experience designing or improving a log and telemetry pipeline, including application-level telemetry from cloud-hosted services (AWS is a strong preference at this grade ...

vulnerability management and security remediation Experience working with recognised security frameworks including: NIST ISO 27001 CIS Controls Cyber Essentials Knowledge of MITRE ATT&CK, Cyber Kill Chain and modern threat intelligence methodologies Excellent analytical, troubleshooting and stakeholder management skills Technical Environment Experience with several ...

including TCP/IP, DNS, firewalls, and proxies. Experience within a SOC, NOC, or 24/7 operational environment. Familiarity with MITRE ATT&CK, CVEs, and vulnerability management. Exposure to cloud security monitoring across Azure, AWS, or Microsoft 365. Desirable Certifications Microsoft SC-200 CompTIA ...

Security Information and Event Management (SIEM) platforms Security Orchestration, Automation and Response (SOAR) solutions Threat intelligence and threat modelling frameworks, including MITRE ATT&CK and Cyber Kill Chain Network security, operating systems and security technologies Microsoft security technologies, including Microsoft Defender and Purview Data Loss ...

Cloud Security Microsoft Defender Suite Kubernetes security concepts Identity and Access Management (IAM) Privileged Access Management Microsoft Entra ID (Azure AD) MITRE ATT&CK Framework Threat Intelligence Incident Response Threat Hunting SIEM Technologies Security Monitoring Security Operations (SOC) Cloud Networking Fundamentals What You'll Bring ...

similar security certifications. Experience with Red Team tooling such as Burp Suite, Metasploit, Wireshark, Nessus, Nmap or Hashcat. Knowledge of MITRE ATT&CK and adversary emulation frameworks. Experience securing Windows, Linux or Mainframe environments. AWS or Azure security experience. Why Join HMLR: This ...

with log source onboarding and normalisation Strong analytical and troubleshooting skills with the ability to investigate complex security events. Understanding of MITRE ATT&CK and modern cyber threat techniques. Experience working with Security Operations and engineering stakeholders. Excellent technical documentation and communication skills. Bachelor ...

Splunk SIEM, to enable the detection of threats across diverse platforms (e.g. cloud, endpoints, and networks)· Use frameworks like MITRE ATT&CK to map detection rules and maximise threat coverage· Use analytical platforms to query high volume datasets to identify trends and spot unusual behaviours ...

Sentinel Familiarity with Microsoft Defender tools (Endpoint & O365) Exposure to Azure cloud logging and Kubernetes environments Knowledge of attacker TTPs and MITRE ATT&CK frameworks Proactive, collaborative, and innovative mindset Desirable/Nice-to-Have: Experience with Python , Terraform , or CI/CD pipelines Familiarity ...

technologies, including IDS/IPS, EDR, ATP, malware protection, and monitoring platforms. Experience with threat hunting methodologies and familiarity with the MITRE ATT&CK framework preferred. Working knowledge of incident response processes, adversary tactics and techniques, and cyber threat intelligence. Strong technical expertise in Windows ...

knowledge of Zero Trust architecture and the application of recognised security frameworks such as NIST CSF, ISO 27001, PCI DSS, DORA, MITRE ATT&CK and CSA guidance. Demonstrable experience operating within a Partner delivery model, including customer‐facing consultancy, reference architectures, repeatable deployment patterns ...