24 of 24 Remote/Hybrid MITRE ATT&CK Jobs in the South East

SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real-world attack techniques Map customer log sources to detection use cases to assess coverage and identify gaps Design … consultant Lead workshops covering detection engineering, use case design and SOC maturity Guide customers on improving detection coverage and aligning to MITRE ATT&CK Clearly explain detection strategies, gaps and recommendations to both technical and non-technical stakeholders Work closely with platform onboarding and engineering ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

will be responsible for producing an executive summary‐style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances``` Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team‐player attitude with a willingness to share knowledge ...

Cloud and Entra ID Protection. Own detection engineering: write and tune KQL analytics rules and hunting queries, map coverage to MITRE ATT&CK, track false‐positive rates, and retire rules that no longer earn their place. Automate response with automation rules and Logic Apps playbooks … rules and Logic Apps playbooks. Strong KQL and detection engineering: you can write, tune and defend an analytics rule mapped to MITRE ATT&CK, and explain why it fires and why it does not. Incident response on a cloud platform: triage, containment, evidence collection ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands‐on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands‐on SOAR platform configuration Working ...

architectures, key components, and common IT/OT protocols. Certifications - Cybersecurity & Infrastructure Security Agency (CISA) Industrial Control Systems (ICS) Training, AttackIQ - MITRE ATT&CK, SANS Global Industrial Cyber Security Professional (GICSP), Certified Information Systems Security Professional (CISSP). Standards, frameworks, and regulatory experience including … Directive, ISA/IEC 62443 Series/ISO 27000 Series, MITRE ATT&CK, NIST Cyber Security Framework (CSF), NCSC CAF, Office for Nuclear Regulation (ONR) Security Assessment Principles, Technical Assessment Guides, and supplementary guidance. Our Culture: Our values stand on a foundation of safety, integrity ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

standard business days including weekends and holidays - our MDR service is 24x7x365 (Hours are standard business hours) Desirable Knowledge of MITRE ATT&CK framework Experience with SQL query construction Experience with OSQuery Programming and scripting skills - proficient knowledge of PowerShell Experience with enterprise information security ...

Malware defenses and monitoring experienceKnowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc.Knowledge of Mitre ATT&CK framework preferredWorking knowledge of incident response proceduresExperience with SQL query construction preferredExperience with OSQuery is a plusExperience administering and supporting Windows OS (both workstations ...

HTTP, SMB, LDAP. Operational knowledge of Windows, macOS and Linux. Ability to read and interpret logs from multiple sources. Awareness of MITRE ATT&CK and differentiating legitimate admin activity vs suspicious behaviour. Experience with Microsoft Sentinel, Google SecOps or other SIEM platforms. Experience with Defender ...

physical security. Deep knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain. Strong operational capability, with the ability to lead SOC service delivery and coordinate security incident response across ...

physical security. Deep knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain. Strong operational capability, with the ability to lead SOC service delivery and coordinate security incident response across ...

solutions. Experience analysing logs, alerts, security telemetry and security incident data. Strong understanding of attacker tactics, techniques and procedures, including the MITRE ATT&CK framework. Qualifications for the Senior Cyber Threat Detection and Response Analyst Essential: Relevant cyber security experience supported by industry-recognised cyber ...

Malware defenses and monitoring experienceThreat hunting experience preferredKnowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc.Knowledge of Mitre ATT&CK framework preferredWorking knowledge of incident response proceduresExperience with SQL query construction preferredExperience with OSQuery is a plusExperience administering and supporting Windows ...

within Cyber Security Operations, Threat Intelligence or Incident Response environments. Strong understanding of the Threat Intelligence Lifecycle, Cyber Kill Chain and MITRE ATT&CK Framework. Experience analysing security events, threat intelligence data and cyber threat trends. Strong research, analytical and critical thinking skills. Experience producing ...

Advanced KQL; PowerShell and/or Python automation. Entra ID, Conditional Access, Intune and Microsoft 365 security. Cloud and networking knowledge; MITRE ATT&CK, NIST and SANS frameworks. CISSP desirable. Benefits 25 days holiday, holiday trading, volunteer day, pension, life assurance, employee assistance, mentoring ...

rotation Desired: Hands-on experience with EDR, SIEM, and forensic collection tools Familiarity with OSQuery, SQL, or KQL Knowledge of MITRE ATT&CK and incident response frameworks Industry certifications such as GCIH, GCED, CompTIA Security+, or equivalent Experience contributing to playbooks, detection tuning, or service ...

threat landscape. Desirable skills and experience Experience working with vulnerability management tooling. Experience in the use of security frameworks, such as Mitre ATT&CK and the Cyber Kill Chain. Formal accreditation in Information Security such as a related degree, ISC2 CISSP, Certified Ethical Hacker, CompTIA ...

similar query languages used to investigate security events. Threat hunting and the use of threat intelligence within investigations. Familiarity with MITRE ATT&CK and common attacker techniques. Improving detection rules, investigation playbooks or response workflows. Relevant certifications, such as Microsoft SC-200, CompTIA Security+ ...

5+ years in cybersecurity with leadership experience, strong SOC background, and expertise in intrusion analysis, forensics, and malware handling. Proficiency with MITRE ATT&CK, OSQuery, SQL, Windows and Linux is expected. #J-18808-Ljbffr ...

clear client-facing updates. Candidates should have 5+ years in a SOC, strong endpoint/security skills, and familiarity with the MITRE ATT&CK framework, SIEMs, and OSQuery. #J-18808-Ljbffr ...

basic malware analysis Basic understanding of at least one of the following: OSQuery, SQL, and KQL Knowledge of frameworks such as MITRE Attack and Cyber Kill Chain Ability to work some weekends and holidays Experience with Windows and Linux command and script interpreters Desired: Cyber security certifications (GCIH ...

basic malware analysisBasic understanding of at least one of the following: OSQuery, SQL, and KQLKnowledge of frameworks such as MITRE Attack and Cyber Kill ChainAbility to work some weekends and holidaysExperience with Windows and Linux command and script interpretersDesired:Cyber security certifications (GCIH, CompTIA Sec+, eJPT, etc.)Experience ...

experience; IDS, IPS, EDR, and basic malware analysisUnderstanding of at least one of the following: OSQuery, SQL, and KQLExperience applying frameworks such as MITRE Attack and Cyber Kill ChainAbility to work some weekends and holidaysKnowledge of Windows and Linux command and script interpretersDesired:Advanced cyber security certifications (GCFE ...