1 to 25 of 60 Incident Response Jobs in the North of England

Incident Response Consultant - Mid to Principal - UK Wide UK Remote | Up to £95,000 + benefits | SC Eligible Pref A specialist opportunity for experienced Incident Response professionals looking to work across a varied mix of proactive and reactive Digital Forensics & Incident Response (DFIR) engagements. … This is a hands-on consulting role where you will support organisations through cyber incidents while also helping them improve their readiness, resilience and response capability before incidents occur. Working remotely across the UK, you will join a team delivering high-quality DFIR services including incident investigation, containment ...

Incident Response Consultant - Mid to Principal - UK Wide UK Remote Up to £95,000 + benefits SC Eligible Pref A specialist opportunity for experienced Incident Response professionals looking to work across a varied mix of proactive and reactive Digital Forensics & Incident Response (DFIR) engagements ...

knowledge with clear communication. You will help turn complex cyber security information into practical advice, reports, evidence and improvement actions. You will also support incident response, vulnerability management, assurance activity and the development of cyber security controls, policies and procedures. Main duties of the job This role would … such as Microsoft 365, Azure, Entra ID, Intune and Defender would be helpful. We would also welcome experience of areas such as vulnerability management, incident response, SIEM or Managed Detection and Response services, supplier assurance, cyber security frameworks or NHS information governance requirements. At NTW Solutions ...

Splunk Enterprise Security, Microsoft Sentinel, and SIEM architecture including data models, correlation rules, and administrative functions. Security Operations: Strong analytical skills in threat detection, incident response, and security event analysis with experience in large enterprise environments (10,000+ endpoints). Data Pipeline Management: Hands-on experience with … tools like Cribl, plus understanding of data normalisation and parsing in Splunk Enterprise. SOAR & Automation: Experience with Security Orchestration platforms, playbook development, and automated response workflows for incident management. Network Security Fundamentals: Working knowledge of network architectures, firewalls, proxies, and common attack vectors with troubleshooting expertise. Communication & Documentation ...

environment? This is a fantastic opportunity for someone at the beginning of their cyber security career to gain hands-on experience in security monitoring, incident investigation and incident response, while developing their technical skills alongside experienced security professionals. Responsibilities Monitor and investigate security alerts and incidents. Perform … incident triage and escalate where appropriate. Support incident response and threat intelligence activities. Work closely with senior analysts during security investigations. Contribute to the ongoing improvement of SOC processes and detection capabilities. Requirements Previous experience working within a Security Operations Centre (SOC). Ideally around ...

infrastructure and established a modern, cloud-first security stack, it is an exciting time to join the business as we mature our detection, response, and automation capabilities across a global estate. You will work collaboratively with the business and the wider IT team - Infrastructure, Network, Development, DevOps, and Service … with Palo Alto Cortex XSIAM and XSOAR, Cortex XDR, Microsoft Purview, Mimecast, Abnormal, Nessus, and Microsoft 365. You will participate in security investigations and incident response, responding to events involving malware, data loss, phishing, or network intrusion, and supporting our data protection and vulnerability management activity. You will ...

This position focuses on security monitoring, incident investigation, threat analysis, and operational security improvement. The successful candidate will act as a subject matter expert for cyber security operations, supporting both proactive and reactive security activities while helping to enhance the organisation's overall security maturity. Client Details Our client … analysis and identifying potential threats or areas requiring further investigation. Working closely with external security service providers to ensure effective monitoring, alert management, and incident handling. Supporting cyber incident response activities as a technical security specialist. Analysing security metrics and trends, providing recommendations to improve security controls ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

security services and implementing cloud security best practices, including identity, monitoring, threat detection and data protection. Understanding of Security Operations, including monitoring, alerting, incident response, threat detection, and SIEM platforms such as Microsoft Sentinel or Splunk. Strong understanding of Identity and Access Management (IAM), least-privilege access principles … . Designing and implementing secure AWS architectures that align with security and compliance requirements. Building and maintaining security monitoring, alerting and automated response capabilities across cloud environments. Integrating cloud platforms with security tooling, including SIEM solutions such as Microsoft Sentinel and Splunk. Leveraging AWS security services and promoting security ...

keep the platform reliable, observable, governed and ready for controlled production use. Its emphasis is on platform health, support processes, quality assurance, release readiness, incident response and continual service improvement. The successful candidate will work closely with Architecture, Information Security, Service Delivery, Infrastructure, suppliers and consuming business teams … Manage incidents, problems, and service requests in line with established ITSM processes. Investigate and resolve operational issues, ensuring timely restoration of service. Support major incident response activities where platform services are impacted. Contribute to root cause analysis and implement actions to improve platform stability and reduce issue recurrence. ...

backups Identity and access management, MFA and privileged access Endpoint security, EDR/XDR, vulnerability management and patching Security monitoring and threat management Cybersecurity incident response and recovery Disaster recovery, business continuity and cyber resilience IT and security risk assessments IT suppliers, cybersecurity partners and technology vendors Hardware … switching, DNS, DHCP and VPNs Firewalls, IDS/IPS, EDR/XDR and SIEM Identity and access management Vulnerability management and system hardening Cyber incident response Backup, disaster recovery and business continuity Cloud and SaaS security IT asset management, licensing and procurement Cyber Essentials, ISO 27001, NIST ...

mitigate any risk. You will also be expected to maintain an awareness of the changing threat landscape and industry standards. Proactively work with Incident Response and Engineering to identify tactics and techniques used by threats actors and opportunities to improve the security of our environment. Propose and support … exercises. Ensure all relevant vulnerabilities are correctly triaged, risk assessed, logged and assigned to remediation teams. Support remediation teams with remediation strategies. Assist Incident Response team with the investigation and resolution of Security Incidents when required. Create and maintain operation procedures, configuration and technical documentation to a high ...

Principles of Cyber Security, Level 2) equips you with the practical skills employers are actively seeking. From threat intelligence and security testing to incident response and ethical compliance, you ll gain hands-on experience that prepares you for today s fast-growing cyber security and IT roles. … Understand cyber security principles and core frameworks Threat Intelligence: Develop expertise to identify risks Testing: Conduct cyber security testing, identify vulnerabilities and implement controls Incident Response: Prepare for and respond to cyber security incidents Ethics: Understand legislation and ethical conduct within cyber security Professional Skills: Build professional skills ...

Principles of Cyber Security, Level 2) equips you with the practical skills employers are actively seeking. From threat intelligence and security testing to incident response and ethical compliance, you’ll gain hands-on experience that prepares you for today’s fast-growing cyber security and IT roles. … Understand cyber security principles and core frameworks Threat Intelligence: Develop expertise to identify risks Testing: Conduct cyber security testing, identify vulnerabilities and implement controls Incident Response: Prepare for and respond to cyber security incidents Ethics: Understand legislation and ethical conduct within cyber security Professional Skills: Build professional skills ...

/7 operation with four shift teams working in a standard rotation. They are responsible for utilising the SOC's Security Incident and Event Management (SIEM) toolsets to detect and investigate potential Security and Service Incidents occurring within the monitored networks. These roles require a minimum of SC clearance … using the Protective Monitoring platform and Internet resources to identify cyber-attacks/security incidents. Categorise all suspected incidents in line with the Security Incident policy Recognise potential, successful and unsuccessful intrusion attempts and compromises through reviews and further analysis of relevant event detail and incident summary information. ...

/7 operation with four shift teams working in a standard rotation. They are responsible for utilising the SOC's Security Incident and Event Management (SIEM) toolsets to detect and investigate potential Security and Service Incidents occurring within the monitored networks. These roles require a minimum of SC clearance … using the Protective Monitoring platform and Internet resources to identify cyber-attacks/security incidents. Categorise all suspected incidents in line with the Security Incident policy Recognise potential, successful and unsuccessful intrusion attempts and compromises through reviews and further analysis of relevant event detail and incident summary information. ...

met. Objectives & Key Results Key Responsibilities Shift Leadership and Team Coordination – You run shift operations, ensuring compliance with SLAs and maintaining high-quality incident handling. You set shift agendas, balance workloads, and promptly address any process or staffing issues. You also maintain effective, customer-centric communication with internal teams … including Security Optimisation and Engineering), customers, and their incident response partners Incident Triage and Investigation – You review and prioritise new alerts, taking initial ownership of high-priority or complex incidents, and ensure proper escalation to customers and Senior SOC Analysts. You make sound, data-driven decisions ...

scalability and efficiency of SOC services. Working across SIEM, endpoint, and orchestration platforms (primarily Palo Alto XSOAR), you will reduce analyst workload, accelerate incident response, and enhance decision-making across customer environments. Key Responsibilities Automation Development – Design, build, and maintain scalable automation workflows across detection and response platforms. Integration & Orchestration – Deliver cross-platform automation enabling fast, reliable response actions. Lifecycle Management – Develop, deploy, and continuously optimise automation for performance, resilience, and coverage. Collaboration & Requirements Gathering – Work with SOC and engineering teams to identify automation opportunities. Documentation – Produce clear documentation to support delivery, troubleshooting, and continuous ...

workflows. * Ensure cloud environments align with security, governance, compliance, and software lifecycle standards. * Monitor cloud platforms using SIEM, cloud security, and observability tools. * Support incident, problem, and change management processes. * Work with containerised environments and infrastructure-as-code technologies. Essential Skills & Experience * Strong commercial experience with AWS, Azure … understanding of IAM, RBAC, encryption, cloud governance, and access management. * Experience working with Windows Server and Red Hat Linux environments. * Knowledge of SIEM platforms, incident response, and operational support processes. Desirable Skills * Experience working within regulated or financial services environments. * Relevant cloud certifications (AWS, Microsoft Azure, or Google ...

first security stack already in place, it is an exciting time to join the business and learn your craft as we mature our detection, response, and automation capabilities across a global estate. You will work alongside the wider IT team - Infrastructure, Network, Development, DevOps, and Service Desk - gaining … understanding of how security supports the business. The purpose of this role is to build a working knowledge of security operations, protective monitoring, and incident handling by working closely with, and learning from, the wider InfoSec team. Reporting to the Associate Director - Cyber Security, with day-to-day guidance ...

Engineer Role Overview We are looking for a Senior Cloud Network SRE/Cloud Platform Engineer with strong expertise in GCP/AWS networking, incident management, Kubernetes, and platform reliability engineering . The ideal candidate should be capable of troubleshooting complex cloud networking issues, leading production incident resolution … Peer-to-Peer communication . Support and manage Kubernetes platforms (GKE/EKS) . Build and maintain monitoring, alerting, and observability solutions. Perform incident response, problem management, and Root Cause Analysis (RCA). Automate operational tasks using Python and Shell scripting . Manage Infrastructure as Code (Terraform ...

Head of Information Security & Continuity, the role plays a key part in embedding a strong security culture, managing security risk, and ensuring effective response to cyber incidents. The Information Security Manager works closely with Technology, Risk, Compliance, and business teams to ensure that security controls are proportionate, effective … appropriate controlsMaintain and track remediation of vulnerabilities and audit findingsMonitor the threat landscape and coordinate responses to emerging risks and vulnerabilitiesLead the investigation and response to information security incidents, ensuring lessons learned and improvements are implementedSupport internal and external audits, including ISO 27001 certification and surveillance activitiesManage third-party ...

practice implementation Work closely with development teams to identify and remediate security vulnerabilities Develop monitoring, logging and compliance controls across cloud platforms Support security incident response and vulnerability remediation activities Promote DevSecOps best practices and contribute to a strong security culture Skills & Experience Commercial experience in a DevSecOps ...

driven automation and blameless postmortems. Champion AI‐enabled operations using AWS Bedrock/SageMaker and Model Context Protocol (MCP) for log analysis, anomaly detection, incident triage, and workflow orchestration; establish adoption guardrails. Define and enforce cloud guardrails and security controls (SCPs/IAM boundaries, OPA policies, tagging, centralized logging … core infrastructure fundamentals (networking, storage, DNS) and APM/telemetry tooling. What Would Make You Stand Out: Practical experience with agentic AI for operations—incident triage, runbooks, and change management—with clear guardrails, auditability, and human-in-the-loop controls. Supporting AI/ML workloads at scale: SageMaker endpoints ...