3 of 3 Remote/Hybrid SIEM Jobs in Reading

Privileged Access Management (PAM) Experience implementing SAST, DAST, SCA, container scanning and secrets management Strong scripting skills with PowerShell, Python or Bash Experience with SIEM, SOAR, logging and observability platforms Good understanding of security frameworks including NIST, ISO 27001, NCSC and Cyber Essentials Plus CISSP, CCSP, Security+ ...

Investigate identity and cloud-based compromise (e.g. anomalous sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python … Logic Apps, APIs or a SOAR platform Correlate evidence across SIEM, endpoint, identity and cloud platforms (Sentinel, Defender XDR, CrowdStrike, Entra ID, Microsoft 365, AWS) to scope the full blast radius of an incident Run hypothesis-led threat hunts, not just reactive alert triage Mentor junior analysts and help drive ...

visits roughly every couple of weeks. No on-call rota. No clearance requirement. What you'll be doing Designing and building detection rulesets across SIEM and XDR platforms Writing and tuning detection logic in KQL, cutting false positives without losing coverage Mapping customer log sources against use cases to identify … code approach — pipelines, version control, deployment Running workshops, coverage assessments and use case catalogues as customer deliverables What we're looking for Hands-on SIEM engineering experience, ideally Microsoft Sentinel Confident KQL — this is the core of the role SOAR playbook design in Azure Logic Apps, Cortex XSOAR or similar ...