1 to 25 of 98 Permanent MITRE ATT&CK Jobs in the UK excluding London

conditions. Adversary Relevance: Assess the actors, motivations, campaigns, and outcomes most relevant to each customer. Threat Behaviour: Use recognised frameworks, including MITRE ATT&CK, to describe adversary behaviour and identify defensive opportunities. Vulnerability Intelligence: Assess vulnerabilities, exploitation evidence, threat relevance, potential impact, and customer exposure. … assessments and proportionate actions. Identify and analyse relevant threat actors, campaigns, malware, and infrastructure. B. Threat Behaviour and Defensive Relevance Use MITRE ATT&CK to connect actor and campaign activity with techniques, defensive coverage, and hunting opportunities. Maintain structured analysis that supports early warning, prioritisation ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

reduce false positives. Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate. Map detection coverage against the MITRE ATT&CK framework. SOC Operations Monitor and triage security alerts within Splunk SIEM. Investigate security incidents including phishing attacks, credential abuse, malicious process … Strong communication and stakeholder engagement skills. Desirable Skills Experience with Cribl. Knowledge of OCSF schemas and security data normalisation. Familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks. Experience with Sigma, YARA, or IDS signature development. Exposure to Splunk SOAR, Cortex XSOAR, or other automation ...

security detections, analytics, use cases, investigation methodologies, playbooks, and response procedures, including validating detection coverage against realistic adversary behaviors and the MITRE ATT&CK framework.* Drive automation and orchestration across security operations, using security queries, scripting, and automation to analyze data, accelerate investigations, reduce repetitive … Management, Curiosity, Critical thinking, Problem-solving, Technical Writing, Continuous improvement, Communication, Mentoring/Coaching.* Advanced threat investigation, Threat actor TTP analysis (MITRE ATT&CK), Threat Hunting.**Desirable*** Agentic AI.* Malware analysis.* Digital forensics and evidence preservation.## Rewards & benefitsExplore the rewards and benefits that help ...

ingestion requirements Investigate and resolve telemetry, parsing and alerting issues Support change control, release management and deployment processes Map detections to MITRE ATT&CK techniques and identify visibility gaps Work closely with SOC teams to ensure alerts are actionable and relevant Produce clear technical documentation … Sentinel data connectors, Log Analytics, parsers and security telemetry Strong troubleshooting skills across data ingestion, parsing and alert generation Knowledge of MITRE ATT&CK Understanding of identity, endpoint, network, cloud and infrastructure security monitoring Experience using Git repositories and controlled deployment processes Excellent communication ...

suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed.• Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage.• Create, test and tune threat-hunting … business impact.• Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments.• Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour.• Experience working within change-controlled environments and following ...

suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed. Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage. Create, test and tune threat-hunting … business impact. Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments. Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour. Experience working within change-controlled environments and following ...

actions, phishing simulation scenarios, and runbook updates. Conduct hypothesis-driven hunts across identity, endpoint, email, network, cloud, and application telemetry using MITRE ATT&CK and document scope, queries, evidence, findings, and follow-up actions. Vulnerability Management Partnership Validate vulnerability findings, assess risk and business exposure … Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments. Familiarity with MITRE ATT&CK and common detection, threat‐hunting, and incident‐response methodologies. Understanding of vulnerability scanning and remediation workflows and the division of responsibility ...

Cloud and Entra ID Protection. Own detection engineering: write and tune KQL analytics rules and hunting queries, map coverage to MITRE ATT&CK, track false‐positive rates, and retire rules that no longer earn their place. Automate response with automation rules and Logic Apps playbooks … rules and Logic Apps playbooks. Strong KQL and detection engineering: you can write, tune and defend an analytics rule mapped to MITRE ATT&CK, and explain why it fires and why it does not. Incident response on a cloud platform: triage, containment, evidence collection ...

across both AI-assisted analysis and the discovery and control of AI use in client environments. Map detections and demos to MITRE ATT&CK, and be straight with partners about what the product does not do. Cover the wider SentinelOne portfolio Build working fluency across … quickly. Strong Windows and macOS fundamentals: process behaviour, persistence mechanisms, and what normal looks like on an endpoint. Working fluency in MITRE ATT&CK, and real experience tuning policy and handling false positives at scale and surrounding in AI security to hold the conversation credibly ...

particular attention to threats targeting privileged access tooling and supply chain attack vectors. Help maintain and evolve detection coverage mapped to MITRE ATT&CK. Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts. AI Integration & Automation Use AI-driven tools for alert triage … Bring 4+ years of experience in a SOC, security operations, or incident response role. Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior. Experience with at least one SIEM platform and familiarity with writing search or detection queries. Familiarity with ...

will build, validate, tune, and optimize detection logic and coverage, leveraging attacker tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK to improve accuracy and reduce false positivesExecute and coordinate security event response activities, including containment, isolation, escalation, and remediation, applying sound … attack paths, including credential theft, privilege escalation, and session/token abuseConsiderable understanding of attacker tactics, techniques, and procedures (TTPs), including MITRE ATT&CKRecord of improving operational effectiveness, including reducing alert noise, improving detection coverage, and decreasing mean time to detect and respondGreat analytical, decision-making ...

Incident Containment, Eradication & Recovery Endpoint Detection & Response (EDR) Microsoft Defender XDR CrowdStrike Falcon Threat Hunting & Threat Intelligence Indicators of Compromise (IOCs) MITRE ATT&CK Framework Malware Analysis & Investigation Phishing Investigation & Response Vulnerability Management Additional Technical Knowledge Kusto Query Language (KQL) Windows & Linux Security Network Security ...

Adversarial Testing and Vulnerability Disclosure Programmes. Understanding of Cyber Threat Intelligence, phishing, social engineering and insider risk management. Good understanding of MITRE ATT&CK and NIST Cybersecurity Frameworks. Strong analytical and problem-solving skills, with the ability to investigate technical security issues and recommend appropriate ...

security monitoring. Experience working within Operational Technology (OT), Critical National Infrastructure, utilities or energy environments. Understanding of security frameworks including NIST, MITRE ATT&CK and Cyber Essentials. Experience supporting SIEM migration or transformation programmes. Current Security Check (SC) clearance or eligibility to obtain clearance. ...

Microsoft Sentinel, Splunk) and EDR/XDR platforms (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon). Security Frameworks: Solid understanding of MITRE ATT&CK, NIST CSF, NCSC Caf v4.0 and ISO 27001. Communication: Ability to write concise incident reports and speak comfortably with both engineers ...

core network protocols including DNS, HTTP, SMB and LDAP, together with operational knowledge of Windows, macOS and Linux. Working knowledge of MITRE ATT&CK and experience applying it during investigations or detection development. Clear written and verbal communication skills, with the ability to provide accurate ...

security principles, including OWASP Top 10, WAF and API security Experience with vulnerability management, patching and security remediation Knowledge of the MITRE ATT&CK Framework and common attack techniques Experience applying security standards such as NCSC guidance, CIS benchmarks or Microsoft Security Baselines Understanding ...

complex security data within Sentinel and Defender portals, identifying patterns, prioritising threats, and presenting actionable recommendations. An understanding of attack vectors, MITRE ATT&CK framework, and adversary behaviours , with the ability to distinguish between normal and abnormal activity. Excellent communication skills, with experience in customer ...

least 3 years in a SOC leadership role. Strong knowledge of SIEM, SOAR and EDR Familiarity with threat intelligence frameworks (e.g MITRE ATT&CK, STIX/TAXII). Proven incident response and crisis management experience. Proven experience in managing SOC teams. Relevant certifications (e.g., CISSP ...

/IPS, SIEM, EDR/XDR, IAM, and OT security solutions. Familiarity with cyber risk frameworks (NIST, CIS, ISO 27001, MITRE ATT&CK). Industry certifications such as CISSP, CISM, GICSP, CEH, or equivalent (preferred). A proactive, analytical mindset with the ability to work ...

security principles and cloud security architecture Experience with Microsoft Entra ID, Conditional Access and identity security Understanding of security frameworks including MITRE ATT&CK, NIST or ISO 27001 Experience with security automation and Infrastructure as Code technologies such as Terraform, Bicep or Azure DevOps Desirable ...

physical security. Deep knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain. Strong operational capability, with the ability to lead SOC service delivery and coordinate security incident response across ...

physical security. Deep knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain. Strong operational capability, with the ability to lead SOC service delivery and coordinate security incident response across ...