1 to 25 of 225 MITRE ATT&CK Jobs in the UK

SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real-world attack techniques Map customer log sources to detection use cases to assess coverage and identify gaps Design … consultant Lead workshops covering detection engineering, use case design and SOC maturity Guide customers on improving detection coverage and aligning to MITRE ATT&CK Clearly explain detection strategies, gaps and recommendations to both technical and non-technical stakeholders Work closely with platform onboarding and engineering ...

processes to improve the quality and relevance of CTI outputs. Analyse threat actor behaviour and map activity to frameworks such as MITRE ATT&CK to support defensive strategy and risk‐based decision‐making. Brief technical, business, and senior leadership stakeholders on cyber threats, trends, potential … function. Demonstrated experience conducting threat actor analysis, adversary tracking, campaign analysis, IOC/TTP analysis, and intelligence production, including use of MITRE ATT&CK or similar frameworks to structure analysis and communicate adversary behaviour. Strong understanding of the intelligence lifecycle, including requirements, collection, analysis, dissemination ...

reporting processes to improve the quality and relevance of CTI outputs.Analyze threat actor behavior and map activity to frameworks such as MITRE ATT&CK to support defensive strategy and risk-based decision-making.Brief technical, business, and senior leadership stakeholders on cyber threats, trends, potential business … intelligence function.Demonstrated experience conducting threat actor analysis, adversary tracking, campaign analysis, IOC/TTP analysis, and intelligence production, including use of MITRE ATT&CK or similar frameworks to structure analysis and communicate adversary behavior.Strong understanding of the intelligence lifecycle, including requirements, collection, analysis, dissemination ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

technical lead during P1/P2 events. Own Detection & Response Capability through the design, development and optimisation of SIEM detections, maintaining MITRE ATT&CK coverage, improving detection effectiveness, and identifying gaps across ENSEK's security monitoring landscape. Drive Threat‐Informed Security Operations by partnering with … requirements. Key outcomes: Maintain an effective detection and response capability, continuously improving SIEM coverage, reducing false positives, and identifying gaps through MITRE ATT&CK aligned monitoring. Lead the successful resolution of security incidents, ensuring timely containment, clear stakeholder communication, thorough post‐incident reviews, and implementation ...

risk assessment for agentic applications, the model gateway, Accio, Nexus, and any novel or high‐risk AI initiative, applying STRIDE, PASTA, MITRE ATT&CK, and MITRE ATLAS as appropriate. Define and evolve AI security standards, guardrails, governance controls, and secure‐by‐design patterns … specific threats, threat modelling methodologies, adversary frameworks, and risk assessment approaches, including prompt injection, model manipulation, excessive agency, STRIDE, PASTA, MITRE ATT&CK, MITRE ATLAS, and equivalent industry practices. Experience defining and evolving AI security standards, guardrails, governance controls, and secure‐by‐design ...

modern SIEM platform (e.g. Sentinel) including KQL detection rules, workbooks, logging pipelines, and AI-assisted alert triage. Map detection coverage against MITRE ATT&CK tactics and techniques. Identify and close visibility gaps across the cloud estate. Maintain alignment to PCI DSS, SOC2, ISO27001 NIST … Python, PowerShell, or Bash for security automation. Strong grasp of PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. Nice to have AZ-500, AWS Certified Security – Specialty, or equivalent cloud security certification. Experience integrating ATT&CK ...

health for assigned detection areas, including retiring logic that no longer earns its place Detection Coverage - Map detection coverage to the MITRE ATT&CK framework, identify gaps, and propose the telemetry or logic needed to close them Threat Intelligence Integration - Convert threat intelligence reporting into … ability to investigate suspicious activity end to end: read the logs, form a conclusion, and communicate it clearly Familiarity with the MITRE ATT&CK framework and the ability to reason about adversary tradecraft rather than only indicators Solid understanding of operating system internals, networking ...

conduct forensic analysis across endpoints, networks, cloud, and SaaS. Integrate threat intelligence into investigations (e.g., enrich IOCs, map activity to MITRE ATT&CK, identify likely threat actors/TTPs, and assess potential impact). Understand the threat landscape through collaboration with industry peers, FS-ISAC … legal/compliance requirements. Required Qualifications Working knowledge of common cyber attacks, tools, and attacker tradecraft; ability to map activity to MITRE ATT&CK and articulate likely TTPs. Demonstrated experience handling security events in critical environments and applying intelligence to accelerate triage and response. Experience ...

forensic images, and telemetry data. Identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs), and map findings to the MITRE ATT&CK framework. Support sensitive investigations while maintaining evidence integrity and chain-of-custody requirements. Engage internal and external forensic specialists when appropriate. … systems, authentication events, network traffic, and security logs. Ability to create clear investigation reports, management updates, and technical documentation. Knowledge of MITRE ATT&CK, Cyber Kill Chain, and NIST Incident Response frameworks. Understanding of enterprise networking, identity and access management, cloud security, email security, endpoint ...

reduce false positives. Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate. Map detection coverage against the MITRE ATT&CK framework. SOC Operations Monitor and triage security alerts within Splunk SIEM. Investigate security incidents including phishing attacks, credential abuse, malicious process … Strong communication and stakeholder engagement skills. Desirable Skills Experience with Cribl. Knowledge of OCSF schemas and security data normalisation. Familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks. Experience with Sigma, YARA, or IDS signature development. Exposure to Splunk SOAR, Cortex XSOAR, or other automation ...

playbooks, runbooks, and standard operating procedures. Stay current with the evolving threat landscape, attacker TTPs (mapped to frameworks such as MITRE ATT&CK), and industry best practices. Required Qualifications, Capabilities, and SkillsDemonstrable experience in a SOC, incident response, or security analyst role (typically 2+ years … across SIEM, EDR/XDR, and network security tooling. Working knowledge of common attack techniques, the cyber kill chain, and the MITRE ATT&CK framework. Strong understanding of core networking concepts (TCP/IP, DNS, proxies, firewalls) and operating system internals (Windows, Linux).Experience investigating ...

playbooks, runbooks, and standard operating procedures. Stay current with the evolving threat landscape, attacker TTPs (mapped to frameworks such as MITRE ATT&CK), and industry best practices. Required Qualifications, Capabilities, and Skills Demonstrable experience in a SOC, incident response, or security analyst role (typically 2+ … across SIEM, EDR/XDR, and network security tooling. Working knowledge of common attack techniques, the cyber kill chain, and the MITRE ATT&CK framework. Strong understanding of core networking concepts (TCP/IP, DNS, HTTP/S, proxies, firewalls) and operating system internals (Windows ...

images and security telemetry to establish scope, root cause and attacker activity. Identify IOCs, attacker behaviours, TTPs and map findings to MITRE ATT&CK where appropriate. Develop and execute threat hunts and contribute to detection rule, monitoring and logging improvements. Maintain incident records, investigation timelines … investigating Windows and Linux systems, authentication activity, security logs and network traffic. Strong understanding of the incident response lifecycle. Knowledge of MITRE ATT&CK, Cyber Kill Chain and NIST. Good understanding of enterprise networking, IAM, cloud, email and endpoint security. Experience with digital forensics ...

will be responsible for producing an executive summary‐style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances``` Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team‐player attitude with a willingness to share knowledge ...

SIEM administration or platform support. Key Responsibilities Design, develop and maintain threat-led detection rules aligned with MITRE ATT&CK and organisational threat models. Translate threat intelligence, threat hunting insights, red/purple team findings and incident investigations into effective detection use cases. Develop behavioural … Experience Strong hands-on experience in SOC Detection Engineering, including detection rule development, validation, tuning and lifecycle management. Excellent knowledge of MITRE ATT&CK, attacker TTPs, behavioural analytics and threat-led detection methodologies. Experience translating cyber threat intelligence, threat modelling and threat hunting findings into ...

platforms. Creating and optimising detection logic using KQL and other query languages. Developing detection use cases aligned with the MITRE ATT&CK framework and current threat techniques. Assessing customer telemetry and identifying opportunities to improve visibility and detection coverage. Building SOAR automations, integrations and response … platforms such as Microsoft Logic Apps, Cortex XSOAR or equivalent. Python, PowerShell or other scripting languages for automation and API integration. MITRE ATT&CK and threat-informed detection engineering. XDR/EDR technologies including Microsoft Defender, CrowdStrike, Cortex XDR or SentinelOne. Azure security monitoring ...

engineering, vulnerability and exposure management, IAM/PAM, Zero Trust, cloud security, and security control mapping. Security standards: Practical use of MITRE ATT&CK, STIX/TAXII, CVE, CWE, CAPEC, NIST frameworks, CIS Controls, and common threat-intelligence vocabularies. GenAI and GraphRAG: LLM-based extraction … sources; implement incremental loading, event-time handling, reconciliation, and recovery patterns. Engineer mappings between enterprise security data and standards such as MITRE ATT&CK and STIX while managing versioning, extensions, and organization-specific concepts. Design query patterns, graph projections, indexes, constraints, partitioning strategies, retention policies ...

escalation playbooks; suggest improvements based on recurring issues or inefficiencies. Threat Awareness: Maintain awareness of current cyber threats, attacker techniques (MITRE ATT&CK), and industry trends relevant to the organisations threat landscape. About You: As an experienced SOC Analyst, your skills and experience may include … systems. Working knowledge of SIEM platforms (e.g. Microsoft sentinel, Splunk, Elastic, QRadar). Awareness of security frameworks and methodologies (NIST CSF, MITRE ATT&CK, ISO27001). #J-18808-Ljbffr ...

implement SOAR workflows to automate detection, response, and security operations processes. Conduct proactive threat hunting using SIEM/EDR data and MITRE ATT&CK‐aligned techniques. Support vulnerability assessment and security scanning activities using relevant tools. Provide input into penetration testing activities and interpret findings … Security (ES). Solid understanding of network protocols, cloud security (AWS/Azure), and threat detection methodologies. Working knowledge of the MITRE ATT&CK framework. Experience building automation or SOAR playbooks for security operations. CrowdStrike certifications (CCFA/CCFR/CCSE – any combination preferred). ...

threat detection platforms. Create and optimise detection logic using technologies such as Splunk and endpoint security solutions. Map detections against the MITRE ATT&CK framework to ensure comprehensive threat coverage. Continuously improve detection quality by analysing alert fidelity, false positives, and operational effectiveness. Validate detections … following: Splunk and SPL YARA rule development EDR detection engineering SIEM content development and tuning Experience mapping detections to the MITRE ATT&CK framework. Strong understanding of modern security principles including Zero Trust, identity-first security, secrets management, and network segmentation. Desirable Experience Experience with ...

Cloud and Entra ID Protection. Own detection engineering: write and tune KQL analytics rules and hunting queries, map coverage to MITRE ATT&CK, track false‐positive rates, and retire rules that no longer earn their place. Automate response with automation rules and Logic Apps playbooks … rules and Logic Apps playbooks. Strong KQL and detection engineering: you can write, tune and defend an analytics rule mapped to MITRE ATT&CK, and explain why it fires and why it does not. Incident response on a cloud platform: triage, containment, evidence collection ...

improve security telemetry, alert enrichment, investigation workflows and response times. Conduct threat hunting using adversary behaviours, TTPs and frameworks such as MITRE ATT&CK, incorporating findings into security controls and detections. Create and continuously improve incident runbooks, playbooks and detection processes based on findings from … ability to write and develop queries for complex investigations. Understanding of adversary tactics, techniques and procedures (TTPs), offensive security concepts and MITRE ATT&CK principles. Practical knowledge of cloud environments and security controls, with the ability to apply detection and incident response practices across hybrid ...

exfiltration, and more). Leverage CloudTrail, GuardDuty, and SIEM integrations to maintain visibility across the AWS estate. Align detection logic with MITRE ATT&CK for Cloud. Vulnerability & Configuration Management: Own vulnerability management for cloud workloads - prioritizing findings from cloud configuration assessments, and runtime protection tools. … multi‐cloud exposure is a plus. In‐depth knowledge of information security principles and cybersecurity frameworks relevant to cloud environments: MITRE ATT&CK for Cloud, CIS Benchmarks, AWS Well‐Architected Security Pillar, NIST CSF, SOC 2, ISO 27001. Willingness and ability to participate ...