1 to 25 of 87 Remote/Hybrid MITRE ATT&CK Jobs in England

conditions. Adversary Relevance: Assess the actors, motivations, campaigns, and outcomes most relevant to each customer. Threat Behaviour: Use recognised frameworks, including MITRE ATT&CK, to describe adversary behaviour and identify defensive opportunities. Vulnerability Intelligence: Assess vulnerabilities, exploitation evidence, threat relevance, potential impact, and customer exposure. … assessments and proportionate actions. Identify and analyse relevant threat actors, campaigns, malware, and infrastructure. B. Threat Behaviour and Defensive Relevance Use MITRE ATT&CK to connect actor and campaign activity with techniques, defensive coverage, and hunting opportunities. Maintain structured analysis that supports early warning, prioritisation ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

forensic images, and telemetry data. Identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs), and map findings to the MITRE ATT&CK framework. Support sensitive investigations while maintaining evidence integrity and chain-of-custody requirements. Engage internal and external forensic specialists when appropriate. … systems, authentication events, network traffic, and security logs. Ability to create clear investigation reports, management updates, and technical documentation. Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST Incident Response frameworks. Understanding of enterprise networking, identity and access management, cloud security, email security, endpoint ...

security detections, analytics, use cases, investigation methodologies, playbooks, and response procedures, including validating detection coverage against realistic adversary behaviors and the MITRE ATT&CK framework.* Drive automation and orchestration across security operations, using security queries, scripting, and automation to analyze data, accelerate investigations, reduce repetitive … Management, Curiosity, Critical thinking, Problem-solving, Technical Writing, Continuous improvement, Communication, Mentoring/Coaching.* Advanced threat investigation, Threat actor TTP analysis (MITRE ATT&CK), Threat Hunting.**Desirable*** Agentic AI.* Malware analysis.* Digital forensics and evidence preservation.## Rewards & benefitsExplore the rewards and benefits that help ...

ingestion requirements Investigate and resolve telemetry, parsing and alerting issues Support change control, release management and deployment processes Map detections to MITRE ATT&CK techniques and identify visibility gaps Work closely with SOC teams to ensure alerts are actionable and relevant Produce clear technical documentation … Sentinel data connectors, Log Analytics, parsers and security telemetry Strong troubleshooting skills across data ingestion, parsing and alert generation Knowledge of MITRE ATT&CK Understanding of identity, endpoint, network, cloud and infrastructure security monitoring Experience using Git repositories and controlled deployment processes Excellent communication ...

suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed.• Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage.• Create, test and tune threat-hunting … business impact.• Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments.• Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour.• Experience working within change-controlled environments and following ...

suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed. Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage. Create, test and tune threat-hunting … business impact. Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments. Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour. Experience working within change-controlled environments and following ...

will be responsible for producing an executive summary-style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … under stressful circumstancesOccasionally willing to begin work early and/or stay late when warranted for customer engagementsStrong grasp of the MITRE ATT&CK frameworkEnjoy mentoring and assisting in the development of junior analystsA team-player attitude with a willingness to share knowledgeAbility to work ...

actions, phishing simulation scenarios, and runbook updates. Conduct hypothesis-driven hunts across identity, endpoint, email, network, cloud, and application telemetry using MITRE ATT&CK and document scope, queries, evidence, findings, and follow-up actions. Vulnerability Management Partnership Validate vulnerability findings, assess risk and business exposure … Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments. Familiarity with MITRE ATT&CK and common detection, threat‐hunting, and incident‐response methodologies. Understanding of vulnerability scanning and remediation workflows and the division of responsibility ...

Cloud and Entra ID Protection. Own detection engineering: write and tune KQL analytics rules and hunting queries, map coverage to MITRE ATT&CK, track false‐positive rates, and retire rules that no longer earn their place. Automate response with automation rules and Logic Apps playbooks … rules and Logic Apps playbooks. Strong KQL and detection engineering: you can write, tune and defend an analytics rule mapped to MITRE ATT&CK, and explain why it fires and why it does not. Incident response on a cloud platform: triage, containment, evidence collection ...

scale Detection‐as‐code, CI/CD of detection content, and security content management Strong knowledge of adversary tradecraft and frameworks: MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain Experience leveraging Agentic AI, Microsoft Security Copilot ...

particular attention to threats targeting privileged access tooling and supply chain attack vectors. Help maintain and evolve detection coverage mapped to MITRE ATT&CK. Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts. AI Integration & Automation Use AI-driven tools for alert triage … Bring 4+ years of experience in a SOC, security operations, or incident response role. Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior. Experience with at least one SIEM platform and familiarity with writing search or detection queries. Familiarity with ...

security platforms. Design, develop, test, deploy, and tune analytics rules, correlation logic, threat-hunting queries, and reusable detection content aligned with MITRE ATT&CK. Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables, and API-based integrations. Develop logging standards, onboarding patterns … XPath filtering, Windows Event IDs, Sysmon, and PowerShell logging. Azure Functions, Logic Apps, REST APIs, PowerShell, Python, and security workflow automation. MITRE ATT&CK mapping, threat-informed defence, detection coverage analysis, and use-case lifecycle management. Security engineering across endpoint, identity, cloud, network, and hybrid ...

makers and C-Suite audiences with demonstrable value. Solid understanding of global security frameworks and standards, such as NIST, ISO and MITRE ATT&CK & MITRE FiGHT We strive to offer a meaningful and inclusive application experience for all candidates. Should you require ...

detection engineering backlog, building, tuning and retiring detections across Microsoft Sentinel and Defender, mapped to a coverage model such as MITRE ATT&CK. You’ll turn threat intelligence into detection logic and hunting activity, and drive our automation and SOAR maturity by building Logic App playbooks that … SOAR and automation content (for example Sentinel Logic Apps), including monitoring for silent failure A strong grasp of attack patterns and MITRE ATT&CK, and how to turn them into a detection coverage model Experience directing a managed or outsourced SOC or MDR provider, setting ...

project priorities, timelines, and specialist skills. *Conduct security risk assessments using recognized threat modelling methodologies such as STRIDE, DREAD, and MITRE Att&ck. *Produce high-level and detailed security architecture and design documentation for complex, high-security-impact initiatives. *Define security requirements based on risk assessments, organisational … providing security architecture support within enterprise-scale technology projects. *Strong understanding and practical application of threat modelling techniques, including STRIDE, DREAD, MITRE Att&ck, or similar frameworks. *Experience producing structured, high-quality security designs and technical documentation. *Broad technical knowledge across infrastructure, networking, operating systems ...

decision‐making while driving operational security improvements aligned to recognised standards such as NIST CSF, ISO 27001, DORA, PCI‐DSS, and MITRE ATT&CK. Reporting To: Director/Head of Cyber Security Location: London (Hybrid) Employment Type: Full‐Time Salary: £50,000 – £70,000 (dependent on experience … writing and board‐level presentation capability. Experience leading client engagements and managing stakeholders. Ideally big 4 experience Technical Expertise Familiarity with MITRE ATT&CK and FAIR methodologies. Qualifications MSc in Cyber Security (or equivalent) CEH, CompTIA Security+ (required or equivalent experience) CE Advisor or prepared ...

remediation processes Develop and mature the Incident Response and Threat hunting capabilities. Implementation of Incident Response frameworks/methodologies such as Kill Chain, MITRE, Threat Modelling, Diamond Model. Development of Threat Intelligence capabilities and integration of such controls with the security monitoring framework. Development of Security monitoring … Cyber Security and Incident Response frameworks such as NIST, Kill Chain, Attack life Cycle, & MITRE). Relevant experience with MITRE Att&Ck alignment with security monitoring use cases. Relevant experience with cloud security assessments aligning it to industry standard benchmarking such as CIS. ...

findings to both technical and non-technical stakeholders. A solid understanding of incident response methodologies, digital forensics and frameworks such as MITRE ATT&CK and NIST. Exposure to Microsoft security technologies, threat hunting, scripting (PowerShell, Python or KQL) or forensic tooling would be advantageous. ...

core network protocols including DNS, HTTP, SMB and LDAP, together with operational knowledge of Windows, macOS and Linux. Working knowledge of MITRE ATT&CK and experience applying it during investigations or detection development. Clear written and verbal communication skills, with the ability to provide accurate ...

physical security. Deep knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain. Strong operational capability, with the ability to lead SOC service delivery and coordinate security incident response across ...

physical security. Deep knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain. Strong operational capability, with the ability to lead SOC service delivery and coordinate security incident response across ...

physical security. Deep knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain. Strong operational capability, with the ability to lead SOC service delivery and coordinate security incident response across ...