1 to 25 of 91 MITRE ATT&CK Jobs in London

processes to improve the quality and relevance of CTI outputs. Analyse threat actor behaviour and map activity to frameworks such as MITRE ATT&CK to support defensive strategy and risk‐based decision‐making. Brief technical, business, and senior leadership stakeholders on cyber threats, trends, potential … function. Demonstrated experience conducting threat actor analysis, adversary tracking, campaign analysis, IOC/TTP analysis, and intelligence production, including use of MITRE ATT&CK or similar frameworks to structure analysis and communicate adversary behaviour. Strong understanding of the intelligence lifecycle, including requirements, collection, analysis, dissemination ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

risk assessment for agentic applications, the model gateway, Accio, Nexus, and any novel or high‐risk AI initiative, applying STRIDE, PASTA, MITRE ATT&CK, and MITRE ATLAS as appropriate. Define and evolve AI security standards, guardrails, governance controls, and secure‐by‐design patterns … specific threats, threat modelling methodologies, adversary frameworks, and risk assessment approaches, including prompt injection, model manipulation, excessive agency, STRIDE, PASTA, MITRE ATT&CK, MITRE ATLAS, and equivalent industry practices. Experience defining and evolving AI security standards, guardrails, governance controls, and secure‐by‐design ...

modern SIEM platform (e.g. Sentinel) including KQL detection rules, workbooks, logging pipelines, and AI-assisted alert triage. Map detection coverage against MITRE ATT&CK tactics and techniques. Identify and close visibility gaps across the cloud estate. Maintain alignment to PCI DSS, SOC2, ISO27001 NIST … Python, PowerShell, or Bash for security automation. Strong grasp of PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. Nice to have AZ-500, AWS Certified Security – Specialty, or equivalent cloud security certification. Experience integrating ATT&CK ...

health for assigned detection areas, including retiring logic that no longer earns its place Detection Coverage - Map detection coverage to the MITRE ATT&CK framework, identify gaps, and propose the telemetry or logic needed to close them Threat Intelligence Integration - Convert threat intelligence reporting into … ability to investigate suspicious activity end to end: read the logs, form a conclusion, and communicate it clearly Familiarity with the MITRE ATT&CK framework and the ability to reason about adversary tradecraft rather than only indicators Solid understanding of operating system internals, networking ...

conduct forensic analysis across endpoints, networks, cloud, and SaaS. Integrate threat intelligence into investigations (e.g., enrich IOCs, map activity to MITRE ATT&CK, identify likely threat actors/TTPs, and assess potential impact). Understand the threat landscape through collaboration with industry peers, FS-ISAC … legal/compliance requirements. Required Qualifications Working knowledge of common cyber attacks, tools, and attacker tradecraft; ability to map activity to MITRE ATT&CK and articulate likely TTPs. Demonstrated experience handling security events in critical environments and applying intelligence to accelerate triage and response. Experience ...

forensic images, and telemetry data. Identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs), and map findings to the MITRE ATT&CK framework. Support sensitive investigations while maintaining evidence integrity and chain-of-custody requirements. Engage internal and external forensic specialists when appropriate. … systems, authentication events, network traffic, and security logs. Ability to create clear investigation reports, management updates, and technical documentation. Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST Incident Response frameworks. Understanding of enterprise networking, identity and access management, cloud security, email security, endpoint ...

reduce false positives. Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate. Map detection coverage against the MITRE ATT&CK framework. SOC Operations Monitor and triage security alerts within Splunk SIEM. Investigate security incidents including phishing attacks, credential abuse, malicious process … Strong communication and stakeholder engagement skills. Desirable Skills Experience with Cribl. Knowledge of OCSF schemas and security data normalisation. Familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks. Experience with Sigma, YARA, or IDS signature development. Exposure to Splunk SOAR, Cortex XSOAR, or other automation ...

playbooks, runbooks, and standard operating procedures. Stay current with the evolving threat landscape, attacker TTPs (mapped to frameworks such as MITRE ATT&CK), and industry best practices. Required Qualifications, Capabilities, and SkillsDemonstrable experience in a SOC, incident response, or security analyst role (typically 2+ years … across SIEM, EDR/XDR, and network security tooling. Working knowledge of common attack techniques, the cyber kill chain, and the MITRE ATT&CK framework. Strong understanding of core networking concepts (TCP/IP, DNS, proxies, firewalls) and operating system internals (Windows, Linux).Experience investigating ...

playbooks, runbooks, and standard operating procedures. Stay current with the evolving threat landscape, attacker TTPs (mapped to frameworks such as MITRE ATT&CK), and industry best practices. Required Qualifications, Capabilities, and Skills Demonstrable experience in a SOC, incident response, or security analyst role (typically 2+ … across SIEM, EDR/XDR, and network security tooling. Working knowledge of common attack techniques, the cyber kill chain, and the MITRE ATT&CK framework. Strong understanding of core networking concepts (TCP/IP, DNS, HTTP/S, proxies, firewalls) and operating system internals (Windows ...

images and security telemetry to establish scope, root cause and attacker activity. Identify IOCs, attacker behaviours, TTPs and map findings to MITRE ATT&CK where appropriate. Develop and execute threat hunts and contribute to detection rule, monitoring and logging improvements. Maintain incident records, investigation timelines … investigating Windows and Linux systems, authentication activity, security logs and network traffic. Strong understanding of the incident response lifecycle. Knowledge of MITRE ATT&CK, Cyber Kill Chain and NIST. Good understanding of enterprise networking, IAM, cloud, email and endpoint security. Experience with digital forensics ...

platforms. Creating and optimising detection logic using KQL and other query languages. Developing detection use cases aligned with the MITRE ATT&CK framework and current threat techniques. Assessing customer telemetry and identifying opportunities to improve visibility and detection coverage. Building SOAR automations, integrations and response … platforms such as Microsoft Logic Apps, Cortex XSOAR or equivalent. Python, PowerShell or other scripting languages for automation and API integration. MITRE ATT&CK and threat-informed detection engineering. XDR/EDR technologies including Microsoft Defender, CrowdStrike, Cortex XDR or SentinelOne. Azure security monitoring ...

implement SOAR workflows to automate detection, response, and security operations processes. Conduct proactive threat hunting using SIEM/EDR data and MITRE ATT&CK‐aligned techniques. Support vulnerability assessment and security scanning activities using relevant tools. Provide input into penetration testing activities and interpret findings … Security (ES). Solid understanding of network protocols, cloud security (AWS/Azure), and threat detection methodologies. Working knowledge of the MITRE ATT&CK framework. Experience building automation or SOAR playbooks for security operations. CrowdStrike certifications (CCFA/CCFR/CCSE – any combination preferred). ...

exfiltration, and more). Leverage CloudTrail, GuardDuty, and SIEM integrations to maintain visibility across the AWS estate. Align detection logic with MITRE ATT&CK for Cloud. Vulnerability & Configuration Management: Own vulnerability management for cloud workloads - prioritizing findings from cloud configuration assessments, and runtime protection tools. … multi‐cloud exposure is a plus. In‐depth knowledge of information security principles and cybersecurity frameworks relevant to cloud environments: MITRE ATT&CK for Cloud, CIS Benchmarks, AWS Well‐Architected Security Pillar, NIST CSF, SOC 2, ISO 27001. Willingness and ability to participate ...

proactive threat hunting based on attacker behaviour, not vendor alertsTranslating threat intelligence and incident learnings into durable, reusable detectionsMapping detections to MITRE ATT&CK and real-world attack pathsReducing alert fatigue through logic refinement, correlation, and contextual enrichmentAdvising and supporting during high-severity security incidents … plane, SaaS)Familiarity with threat intelligence platforms and frameworks such as PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. Additional InformationBring all of you to workWe create the conditions for high performers to thrive, through real ownership, fewer ...

build and continuously improve detection content, managed as code and version-controlled, mapping coverage to adversary tactics and techniques using the MITRE ATT&CK framework and prioritising the techniques most relevant to a financial services SaaS provider. Telemetry and visibility – maintain a clear view … detections. Working knowledge of cloud security and native cloud telemetry sources (AWS and/or Azure). Practical use of the MITRE ATT&CK framework to structure detection coverage and gap analysis. Hands-on experience building and operating SOAR playbooks and response automation, orchestrating across ...

tools and technologies, such as SIEM, IDS/IPS, WAF and vulnerability scanners. Knowledge of common adversarial Tactics, Techniques and Procedures (Mitre Att&ck TTPs). Knowledge of security standards and frameworks (e.g. ISO27001, NIST CSF, AWS FSBP) is beneficial. Relevant security certifications (e.g. GCLD … tools and technologies, such as SIEM, IDS/IPS, WAF and vulnerability scanners. Knowledge of common adversarial Tactics, Techniques and Procedures (Mitre Att&ck TTPs). Knowledge of security standards and frameworks (e.g. ISO27001, NIST CSF, AWS FSBP) is beneficial. Relevant security certifications (e.g. GCLD ...

against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance … Burp Suite, Nmap) and a track record of building your own when the situation calls for it Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve ...

management and data-residency requirements across cloud, on-premises and third-party services. Develop detection and response architectures covering analytics rules, MITRE ATT&CK-aligned use cases, threat hunting, workbooks, watchlists, automation and SOAR playbooks. Design secure integrations with ITSM, CMDB, threat intelligence, vulnerability management … QRadar, Rapid7 or Elastic. Experience with KQL, Sigma, Logic Apps, PowerShell or other automation and detection‐as‐code approaches. Knowledge of MITRE ATT&CK, NIST SP 800-61, NCSC CAF and recognised security operations maturity models. Experience of ITIL‐aligned service design, service transition ...

scale Detection‐as‐code, CI/CD of detection content, and security content management Strong knowledge of adversary tradecraft and frameworks: MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain Experience leveraging Agentic AI, Microsoft Security Copilot ...

hunting at scaleDetection-as-code, CI/CD of detection content, and security content managementStrong knowledge of adversary tradecraft and frameworks: MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chainExperience leveraging Agentic AI, Microsoft Security Copilot ...

potential. Key Responsibilities: Threat Detection Use Case DevelopmentDesign and implement detection logic aligned to specific threat scenarios using frameworks such as MITRE ATT&CK. Develop, test, deploy, and tune detection content throughout its lifecycle. Work closely with Client Lead Analysts to ensure detection content remains relevant … Hunting, Detection Engineering, or Cyber Security Operations environment. Experience developing, testing, and tuning threat detection use cases. Good understanding of the MITRE ATT&CK framework and common threat actor tactics, techniques, and procedures (TTPs). Experience conducting proactive threat hunting and analysing security telemetry. Strong ...

security platforms. Design, develop, test, deploy, and tune analytics rules, correlation logic, threat-hunting queries, and reusable detection content aligned with MITRE ATT&CK. Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables, and API-based integrations. Develop logging standards, onboarding patterns … XPath filtering, Windows Event IDs, Sysmon, and PowerShell logging. Azure Functions, Logic Apps, REST APIs, PowerShell, Python, and security workflow automation. MITRE ATT&CK mapping, threat-informed defence, detection coverage analysis, and use-case lifecycle management. Security engineering across endpoint, identity, cloud, network, and hybrid ...

decision‐making while driving operational security improvements aligned to recognised standards such as NIST CSF, ISO 27001, DORA, PCI‐DSS, and MITRE ATT&CK. Reporting To: Director/Head of Cyber Security Location: London (Hybrid) Employment Type: Full‐Time Salary: £50,000 – £70,000 (dependent on experience … writing and board‐level presentation capability. Experience leading client engagements and managing stakeholders. Ideally big 4 experience Technical Expertise Familiarity with MITRE ATT&CK and FAIR methodologies. Qualifications MSc in Cyber Security (or equivalent) CEH, CompTIA Security+ (required or equivalent experience) CE Advisor or prepared ...

against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CKConduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidanceDesign and build custom … BloodHound, Burp Suite, Nmap) and a track record of building your own when the situation calls for itWorking knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improveA track ...