1 to 25 of 68 Remote/Hybrid MITRE ATT&CK Jobs in England

delivered in a consistent and scalable way. Working directly with customers, you will define detection strategies, design use cases aligned to MITRE ATT&CK, and guide improvements in visibility, coverage and response maturity. You will work closely with platform onboarding and engineering teams, supplementing them … SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real‐world attack techniques Map customer log sources to detection use cases to assess coverage and identify gaps Design ...

Operations Centre (SOC) activities, expanding log coverage, and building high-quality detections in our SIEM. You will use frameworks such as MITRE ATT&CK and MITRE D3FEND to assess threat scenarios, prioritize detection engineering work, and strengthen both preventative and detective controls. What … operations, including monitoring, triage, investigation, and response to security alerts. Assess the company threat landscape using MITRE ATT&CK and MITRE D3FEND to identify detection and mitigation opportunities. Connect and maintain log sources into our SIEM to ensure relevant coverage across corporate ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

Months £110k plus bens - UK REMOTE Senior SOAR Engineer | Splunk SOAR | Splunk Enterprise Security | Cyber Security | Security Automation | Python | MITRE ATT&CK | NIST An opportunity has arisen for an experienced Senior SOAR Engineer to join a high-performing Cyber Security Engineering team responsible for designing … experience in Python or Java, Perl, R or C++ Deep understanding of security incident response processes Knowledge of security frameworks including MITRE ATT&CK and NIST Strong knowledge of Windows, Linux/UNIX and database technologies What's on Offer? Salary ...

maintain modern SIEM platform (e.g. Sentinel) including KQL detection rules, workbooks, logging pipelines, and AI-assisted alert triage.Map detection coverage against MITRE ATT&CK tactics and techniques. Identify and close visibility gaps across the cloud estate.Maintain alignment to PCI DSS, SOC2, ISO27001 NIST … proficiency in Python, PowerShell, or Bash for security automation.Strong grasp of PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud.Nice to haveAZ-500, AWS Certified Security – Specialty, or equivalent cloud security certification.Experience integrating ATT&CK Navigator ...

Create high-fidelity detections using operational threat intelligence, incident learnings and purple team findings. Measure and improve detection coverage using the MITRE ATT&CK framework. Continuously reduce false positives while improving visibility into emerging attacker techniques.SOAR & Automation EngineeringDesign and maintain SOAR playbooks that automate alert … similar languages. Experience working within cloud environments (AWS preferred; Azure or GCP experience also valued). Solid understanding of the MITRE ATT&CK framework. Experience supporting security incident response. Comfortable working with Git, APIs and engineering workflows. Excellent communication skills with both Security and Engineering ...

will be responsible for producing an executive summary-style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team-player attitude with a willingness to share knowledge ...

maintain threat detection use cases aligned to real-world attack scenarios Build and tune detection logic using industry frameworks such as MITRE ATT&CK Conduct proactive, hypothesis-led threat hunting across client environments Analyse telemetry, threat intelligence and security data to identify suspicious activity Develop … threats and improving security operations. You'll ideally have experience with: Threat Hunting Detection Engineering Security Operations Centres (SOC) SIEM technologies MITRE ATT&CK Framework Threat Intelligence Detection rule creation and tuning Security telemetry analysis Incident detection and investigation Writing detection use cases and playbooks ...

assessments. SupportSOC operations with threat context and priority setting. Identifyand monitor Indicators of Compromise (IOCs) and Tactics, Techniques &Procedures (TTPs) using MITRE ATT&CK framework. Collaborateon play-book development and threat detection use cases. Performattribution and malware behavioural analysis to inform decision-making. Leadthreat actor … e.g., MISP, Anomali, ThreatConnect) Strongknowledge of malware families, TTPs, and IOC tracking Experienceusing SIEM, SOAR, and endpoint detection tools Workingknowledge of MITRE ATT&CK, Cyber Kill Chain, and Diamond Model Abilityto produce high-quality, executive-ready threat reports Desired Skills Certificationssuch as GCTI, GREM, GCIA ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

proactive threat hunting based on attacker behaviour, not vendor alertsTranslating threat intelligence and incident learnings into durable, reusable detectionsMapping detections to MITRE ATT&CK and real-world attack pathsReducing alert fatigue through logic refinement, correlation, and contextual enrichmentAdvising and supporting during high-severity security incidents … plane, SaaS)Familiarity with threat intelligence platforms and frameworks such as PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud.Additional InformationBring all of you to workWe create the conditions for high performers to thrive, through real ownership, fewer blockers ...

build and continuously improve detection content, managed as code and version-controlled, mapping coverage to adversary tactics and techniques using the MITRE ATT&CK framework and prioritising the techniques most relevant to a financial services SaaS provider. Telemetry and visibility – maintain a clear view … detections. Working knowledge of cloud security and native cloud telemetry sources (AWS and/or Azure). Practical use of the MITRE ATT&CK framework to structure detection coverage and gap analysis. Hands-on experience building and operating SOAR playbooks and response automation, orchestrating across ...

security architecture and secure design reviews. Perform application security risk assessments and define security requirements. Lead Threat Modelling workshops using STRIDE, MITRE ATT&CK or similar methodologies. Embed Secure SDLC principles into engineering teams. Integrate security tooling into CI/CD pipelines and DevSecOps processes. … OWASP Top 10 Secure Coding Secure Design Reviews API Security REST APIs Microservices Security Application Security Risk Assessments Threat Modelling STRIDE MITRE ATT&CK Security Architecture Risk Assessments DevSecOps CI/CD Security GitHub Actions GitLab Jenkins Azure DevOps Security Automation Shift Left Security Security ...

cloud environments Perform threat modelling by deconstructing technical solutions, identifying threats and vulnerabilities using recognised methodologies such as STRIDE and MITRE ATT&CK Analyse risks and benefits of design options to support safe architectural decisions, defining security testing requirements and assessing findings Communicate technical security … APIs and containerised microservices Up-to-date knowledge of emerging threats with practical experience applying threat modelling frameworks including STRIDE and MITRE ATT&CK Strong understanding of cybersecurity domains across endpoint, network, cryptography, information management, and IAM in enterprise environments Awareness of industry security standards ...

hunting at scaleDetection-as-code, CI/CD of detection content, and security content managementStrong knowledge of adversary tradecraft and frameworks:MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chainExperience leveraging Agentic AI, Microsoft Security Copilot ...

scale Detection-as-code, CI/CD of detection content, and security content management Strong knowledge of adversary tradecraft and frameworks: MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain Experience leveraging Agentic AI, Microsoft Security Copilot ...

standard - author, tune, and peer-review detections in KQL, SPL, EQL, or Sigma; manage the false-positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves. Own the threat-landscape narrative for your engagement - turn intelligence from … similar environment - including writing and tuning detections in KQL, SPL, EQL, or Sigma, and managing coverage against MITRE ATT&CK Experience designing or improving a log and telemetry pipeline, including application-level telemetry from cloud-hosted services (AWS is a strong preference at this grade ...

vulnerability management and security remediation Experience working with recognised security frameworks including: NIST ISO 27001 CIS Controls Cyber Essentials Knowledge of MITRE ATT&CK, Cyber Kill Chain and modern threat intelligence methodologies Excellent analytical, troubleshooting and stakeholder management skills Technical Environment Experience with several ...

including TCP/IP, DNS, firewalls, and proxies. Experience within a SOC, NOC, or 24/7 operational environment. Familiarity with MITRE ATT&CK, CVEs, and vulnerability management. Exposure to cloud security monitoring across Azure, AWS, or Microsoft 365. Desirable Certifications Microsoft SC-200 CompTIA ...

exercises and risk assessments. Knowledge of threat actor tactics, techniques, and procedures (TTPs). Understanding of common attack frameworks such as MITRE ATT&CK and Cyber Kill Chain. Experience investigating security events and supporting incident response activities. Strong analytical, investigative, and problem-solving skills. Ability ...

Security Information and Event Management (SIEM) platforms Security Orchestration, Automation and Response (SOAR) solutions Threat intelligence and threat modelling frameworks, including MITRE ATT&CK and Cyber Kill Chain Network security, operating systems and security technologies Microsoft security technologies, including Microsoft Defender and Purview Data Loss ...

Security initiatives within complex environments. Understanding of Security Architecture Design and secure-by-design principles. Familiarity with cyber frameworks such as MITRE ATT&CK, NIST, or Cyber Kill Chain. Experience producing intelligence reports and presenting findings to stakeholders. Strong analytical and problem-solving abilities. Excellent ...

supporting Platform Security initiatives within complex environments.Understanding of Security Architecture Design and secure-by-design principles.Familiarity with cyber frameworks such as MITRE ATT&CK, NIST, or Cyber Kill Chain.Experience producing intelligence reports and presenting findings to stakeholders.Strong analytical and problem-solving abilities.Excellent written and verbal ...

response, security monitoring, and threat hunting activities. Excellent understanding of network protocols, cyber attack methodologies, security monitoring techniques, and the MITRE ATT&CK Framework . Good knowledge of cloud security principles across Microsoft Azure and/or AWS environments. Strong analytical, troubleshooting, communication, and stakeholder ...

response, security monitoring, and threat hunting activities. Excellent understanding of network protocols, cyber attack methodologies, security monitoring techniques, and the MITRE ATT&CK Framework . Good knowledge of cloud security principles across Microsoft Azure and/or AWS environments. Strong analytical, troubleshooting, communication, and stakeholder ...