1 to 25 of 63 Incident Response Jobs in Central London

Cyber Response & Recovery Manager (Remediation) This role requires current SC or DV clearance, or eligibility and willingness to obtain clearance. About the role The Cyber Response & Recovery Manager role will sit within the Cyber Response Services team in KPMG’s Cyber Advisory practice. Your specific focus will … compromise, Active Directory compromise, cloud compromise and advanced network intrusions. In these situations, clients look to KPMG not only to investigate and contain the incident, but also to help them recover securely, rebuild critical services, reduce the risk of reinfection and improve their long-term resilience. This ...

tasks specialized at threat hunting, SIEM/SOAR, Network Security and other operational security tasks such as performance and availability monitoring, log monitoring, security incident detection and response, security event reporting, and content maintenance (tuning). What we are looking for Key Responsibilities: Serves as a senior member … optimization of enterprise security platforms, overseeing lifecycle management including break-fix, patching, version upgrades, and integration with broader security ecosystems. Directs complex security incident response efforts across multiple vectorsendpoint protection, EDR, malware analysis, network and computer forensicsensuring rapid containment and root cause analysis. Designs and executes advanced vulnerability ...

report into the Senior Engineering Manager for SRE and Observability and work as an individual contributor, partnering closely with development squads, platform engineers, and incident response teams. The Bengaluru team is deeply integrated into IG's global engineering community, with real ownership and scope to shape how observability … adoption across the organisation, providing guidance and practical support to help engineering teams embed reliability targets into their day-to-day ways of working. Incident response – Join the support rota and incident response, using observability tooling to accelerate diagnosis and reduce mean time to resolution. Lead ...

Incident Response Engineer, UK Security Operations, Hampshire Google London, UK Mid Experience driving progress, solving problems, and mentoring more junior team members; deeper expertise and applied knowledge within relevant area. Must be a British citizen to meet compliance and security clearance requirements. Office location will be a satellite … more programming languages. Active, or the ability to obtain, a Developed Vetting (DV) UK security clearance. Preferred qualifications: Security+ or similar Cyber Security/Incident Response related certifications. Experience responding to security incidents on Kubernetes. Experience analyzing, triaging, and remediating common information security incidents. Understanding of common attacker ...

proportionate controls are in place. Provide informed input into security testing scope (e.g. Penetration testing, configuration reviews) and review remediation activity with suppliers. Support incident response and operational infosec activities as required, providing cover and acting as an all-round contributor in a small team. Maintain awareness … experience in an information security role with significant exposure to grc, alongside working knowledge of broader cyber security disciplines (e.g. Supplier assurance, security testing, incident response, security operations). Experience of iso 27001 isms implementation and management, and certification process (working with external and internal auditors). Strong ...

Google Public Sector's UK Security Operations team seeks an experienced Incident Response Engineer to join our Hampshire-based on-site team. You will monitor, detect, and respond to security incidents across critical environments, delivering private cloud security for high-assurance customers. In this mid-level role … will operate 24/7, collaborate with product teams, and help mature incident response capabilities, threat hunting, and SOC dashboards while adhering to DV clearance requirements #J-18808-Ljbffr ...

accountable for developing and implementing cyber claims strategy, best practice and capability across those offices, ensuring a consistent and effective approach to service delivery, incident response and client support. What you’ll do Lead the development and implementation of international cyber claims strategy across jurisdictions outside … required, acting as a referral point to support and supplement local expertise. Establish and embed best practice approaches to cyber claims handling, both initial response and coverage, across global offices. Build and oversee local cyber claims capability in key international markets to ensure consistency of service provision and standards ...

monthly reporting. Deliver secure configuration and compliance reporting across the estate, supporting a measurable uplift in security maturity against NIST CSF. Security Operations and Incident Response: Act as the second cyber escalation point within the 24/7 security operating model, providing technical investigation, containment and response as part of the cyber on-call rota and supporting post-incident reviews. Onboard and manage the day-to-day relationship with the outsourced SOC/MDR provider, establishing operational handover processes and driving improvement in detection and response performance (MTTD/MTTR). Provide security input ...

Analyse logs from endpoints, networks, cloud services and security tools to detect suspicious behaviour Escalate incidents where appropriate and work closely with engineering and incident response teams Develop and improve SIEM detection rules and alert tuning to reduce false positives Produce clear incident reports and maintain accurate … documentation Participate in the on-call rota and support major incident response when required Contribute to the continuous improvement of SOC processes, tooling and operational procedures Skills & Experience Experience working withi n a 24/7 Security Operations Centre ( SOC) or equivalent cyber security environment Strong hands ...

optimise controls across Azure, M365, and infrastructure environments Lead hardening initiatives across IAM, PAM, AD, and network security Drive security automation and DevSecOps practices Incident Response & Threat Detection Lead real‐time response to security incidents Oversee SIEM/SOAR integration, alerting, and playbooks Conduct investigations using … Looking For 7 years in cybersecurity, with 3–4 years in a lead/principal capacity Experience spanning security engineering, SOC/incident response Strong expertise across: SIEM (Sentinel, Splunk, LogRhythm), EDR/XDR (Defender, CrowdStrike, SentinelOne), IAM/PAM/identity security, Vulnerability tooling (Tenable, Pentera, etc. ...

controls across CoinShares’ cloud-first environment. This role is responsible for engineering and architectural oversight, working in partnership with the Analyst’s monitoring and response activities. You will play a key role in strengthening CoinShares’ security posture in a highly regulated financial environment, ensuring scalable, resilient, and secure cloud … maintain security controls across AWS environments. Configure, manage, and optimise AWS GuardDuty, including alert tuning, findings triage workflows, and integrations with SIEM and incident response processes. Lead cloud security monitoring, detection engineering, and preventative control design. Work closely with the Cyber Security Analyst on incident response ...

apply. The Role - As SOC Operations Manager, you'll lead the day-to-day operation of the Security Operations Centre, ensuring security monitoring, incident response and cyber defence capabilities are operating effectively. You'll be responsible for developing the SOC function, leading analysts and engineers, improving operational maturity … excellence and stakeholder management. Responsibilities - Lead and develop a high-performing SOC team, providing coaching, mentoring and technical leadership. Oversee the detection, investigation and response to cyber security incidents. Drive continual improvement across SOC processes, playbooks and operational procedures. Monitor and improve key SOC performance metrics including MTTD, MTTR ...

responsible for leading both our Cloud Platform and Enterprise Service orgs: Leading and developing two engineering teams — Cloud Platform (cloud infrastructure, observability, SRE, incident response) and Enterprise Services (IT support, IAM, Okta, Slack and core SaaS) — setting technical direction, hiring and performance standards across both. Delivering the reliability … performance and cost-efficiency of the cloud platform underpinning production services, including SLOs, on‐call and incident response practices, and post‐incident learning, in line with the broader infrastructure strategy. Executing the roadmap for enterprise services and identity, treating internal IT as an engineering discipline — automation‐first ...

security alerts, incidents, and anomalous behaviour across Semble's environment. Develop and mature threat intelligence capabilities, including vulnerability management, penetration testing coordination, and incident response processes. Maintain and improve security tooling, logging, and detection capabilities with an automation‐first mindset. Contribute to incident response runbooks … application‐layer and AI‐related incidents, and support blameless post‐incident reviews to embed learning back into the SDLC. Identify and address security gaps proactively, improving the overall security posture. Compliance, Certification and Audit Readiness Own or co‐own delivery of compliance programmes, including ISO 27001, Cyber Essentials+ ...

primarily remote role with occasional on-site visits to London. You will be working within a security operations function, supporting the monitoring, detection and response to security threats across the organisation's estate. You will bring solid hands-on experience across SIEM and log management tooling, working independently … following: Hands-on experience with Splunk in a SOC environment Cribl experience for log management and data pipeline optimisation Security monitoring, threat detection and incident response Working within a security operations centre at a mid-senior level SC clearance held or ability to pass Interested? Please apply below. ...

vulnerabilities and compromises, utilizing advanced tools and techniques to detect anomalies and contribute to the development of strategies for security investigation, threat mitigation, and incident response Collaborate with cross-functional teams to ensure a coordinated approach to blockchain and enterprise security, sharing insights, and promoting best practices across … Degree in Computer Science, Cybersecurity, Data Science, or related disciplines 5+ years of experience in cybersecurity operations, with a focus on threat detection, incident response, and security infrastructure management Demonstrated expertise in multiple security domains, including network security, malware analysis, threat hunting, and security architecture and design, with ...

vulnerabilities and compromises, utilizing advanced tools and techniques to detect anomalies and contribute to the development of strategies for security investigation, threat mitigation, and incident response Produce actionable threat intelligence products including IOC development, exploit analysis reports, and threat actor tracking to inform detection engineering and security operations … Computer Science, Cybersecurity, Data Science, or related disciplines 5+ years of experience in cybersecurity threat intelligence or operations, with a focus on threat detection, incident response, and security infrastructure management Demonstrated expertise in multiple security domains, including network security, malware analysis, threat hunting, threat intelligence production, and security ...

mitigation activities Oversee security architecture to ensure alignment with wider technology strategy Drive continuous improvement through security assessments, testing, and reporting Ensure effective incident detection, response, and recovery capabilities Lead vulnerability management and remediation across all technology environments Oversee third‐party security testing, including penetration testing and phishing … delivering cyber security strategies Strong understanding of security frameworks such as ISO 27001, NIST, Cyber Essentials Expertise in risk management, vulnerability assessment, and incident response Experience with enterprise security tools (e.g. SIEM, IDS, firewalls, encryption technologies) Knowledge of cloud and hybrid security environments Ability to communicate complex technical ...

with technical awareness , placing you at the centre of a live Security Operations Centre where you'll maintain situational awareness across multiple domains, coordinate incident response, and ensure effective operational decision-making. You'll act as the operational lead within a fast-paced control room environment, working closely … domains. Monitor live environments and assess alerts and incidents in real time. Perform initial triage and validation of alerts, reducing noise and ensuring accurate incident classification. Manage incident prioritisation and escalation in accordance with operational procedures. Coordinate response activities across SOC, NOC, Infrastructure and Security teams. Support ...

testing capabilities. The successful candidate will play a critical role in maintaining operational readiness across the organisation by coordinating crisis management activities, supporting major incident response efforts, managing scenario testing programmes, and driving remediation and continuous improvement initiatives. The role will work closely with business, technology, cyber security … operation of the crisis management framework and act as a key coordinator during significant disruption events, helping ensure effective response, communication, governance and recovery activities across the enterprise. What you'll bring: Proven experience within operational resilience, crisis management, business continuity, incident management, operational risk or a related ...

This is a unique hybrid position that combines operational leadership with technical awareness . You'll take ownership of the live operational picture, coordinating incident response across cyber, network, infrastructure and physical security teams while ensuring informed, timely decision-making. This role is ideal for someone who thrives … fast-paced control room environment and can confidently lead operational response without needing to be a deep technical specialist. Key Responsibilities Maintain a single operational view across cyber, network, service and physical security domains. Monitor live operational environments and assess alerts and incidents in real time. Perform initial triage ...

trade flow, and post-trade issues. Lead the ‘follow the sun’ support model coordination, working closely with global teams in APAC and US. Drive incident management practices, trend identification, and post-mortem analysis. Collaborate with development teams to influence platform improvements based on support insights. Occasional weekend work will … with the resilience to handle high-pressures production incidents Desired Experience with Site Reliability Engineering (SRE) practices, including monitoring, incident response, and post-mortem analysis Proven experience applying AI or machine-learning models to optimise workflows, identify patterns, and drive intelligent automation solutions Hands-on experience with containerization ...

Anomaly Detection (NAD), and cloud security technologies. Oversee vulnerability management and coordinate remediation efforts across global systems. Design and operate SOAR workflows to automate response playbooks and improve operational efficiency. Support the operational management of Secure Email Gateways (SEG), Secure Web Gateways (SWG), Firewalls, and CASB. Monitor third-party … vendor SLAs and participate in service performance reviews. Maintain accurate operational documentation, security playbooks, and incident reports. What We Are Looking For Essential Experience & Skills: 4–6 years of experience within cyber security operations (SOC, security tooling, incident response). Strong hands-on experience with Microsoft Entra ...

order routing, trade flow, and post-trade issuesLead the 'follow the sun' support model coordination, working closely with global teams in APAC and USDrive incident management practices, trend identification, and post-mortem analysis. Collaborate with development teams to influence platform improvements based on support insightsOccasional weekend work will … hoursPositive approach to the day-to-day, with the resilience to handle high-pressure production incidentsDesiredExperience with Site Reliability Engineering (SRE) practices, including monitoring, incident response, and post-mortem analysisProven experience applying AI or machine-learning models to optimise workflows, identify patterns, and drive intelligent automation solutionsHands ...

baselines Support vulnerability management - scanning, patching coordination, remediation tracking Build and maintain detection rules, alerts, and automation (SOAR) in partnership with the SOC Support incident response - containment, investigation, and remediation of confirmed threats Automate security processes via scripting (Python, PowerShell, Terraform/IaC) Work with architects to implement ...