1 to 25 of 31 Remote/Hybrid MITRE ATT&CK Jobs in the UK

organisation in key external intelligence-sharing forums, including FS-ISAC, the NCSC’s CiSP and relevant industry partnerships. Use the MITRE ATT&CK framework to identify and analyse attacker tactics, techniques and procedures and strengthen our detection capabilities. Develop the Proactive Threat Hunting Initiative, using … their strong technical expertise with the ability to develop our CTI capability and turn complex intelligence into clear, actionable business insights. MITRE ATT&CK training/certification is essential . Experience developing Priority Intelligence Requirements (PIRs). Strong experience working closely with SOC, Incident Response ...

modern SIEM platform (e.g. Sentinel) including KQL detection rules, workbooks, logging pipelines, and AI-assisted alert triage. Map detection coverage against MITRE ATT&CK tactics and techniques. Identify and close visibility gaps across the cloud estate. Maintain alignment to PCI DSS, SOC2, ISO27001 NIST … Python, PowerShell, or Bash for security automation. Strong grasp of PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. Nice to haveAZ-500, AWS Certified Security – Specialty, or equivalent cloud security certification. Experience integrating ATT&CK ...

rules using KQL. Translate threat intelligence, attacker behaviours and operational requirements into measurable detection use cases. Map detection content to the MITRE ATT&CK framework and help identify gaps in detection coverage. Validate required log sources, schemas and field mappings before developing detection logic. Test … detection engineering principles, false-positive reduction and the detection content lifecycle. Experience developing threat-informed use cases and mapping detections to MITRE ATT&CK tactics and techniques. Ability to assess log source suitability, data quality, parsing and field availability for detection requirements. Experience with ...

maintain threat detection use cases aligned to real-world attack scenarios Build and tune detection logic using industry frameworks such as MITRE ATT&CK Conduct proactive, hypothesis-led threat hunting across client environments Analyse telemetry, threat intelligence and security data to identify suspicious activity Develop … threats and improving security operations. You'll ideally have experience with: Threat Hunting Detection Engineering Security Operations Centres (SOC) SIEM technologies MITRE ATT&CK Framework Threat Intelligence Detection rule creation and tuning Security telemetry analysis Incident detection and investigation Writing detection use cases and playbooks ...

without losing coverage Mapping customer log sources against use cases to identify and close coverage gaps Designing use cases aligned to MITRE ATT&CK Building SOAR automations and automated response workflows Writing incident response playbooks for customers Owning the detection-as-code approach — pipelines, version … Azure Logic Apps, Cortex XSOAR or similar Scripting in Python or PowerShell, and comfort working with APIs Use case design against MITRE ATT&CK Working knowledge of XDR/EDR platforms and Azure telemetry sources Some exposure to NDR tooling such as Vectra ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

improve security telemetry, alert enrichment, investigation workflows and response times. Conduct threat hunting using adversary behaviours, TTPs and frameworks such as MITRE ATT&CK, incorporating findings into security controls and detections. Create and continuously improve incident runbooks, playbooks and detection processes based on findings from … ability to write and develop queries for complex investigations. Understanding of adversary tactics, techniques and procedures (TTPs), offensive security concepts and MITRE ATT&CK principles. Practical knowledge of cloud environments and security controls, with the ability to apply detection and incident response practices across hybrid ...

proactive threat hunting based on attacker behaviour, not vendor alertsTranslating threat intelligence and incident learnings into durable, reusable detectionsMapping detections to MITRE ATT&CK and real-world attack pathsReducing alert fatigue through logic refinement, correlation, and contextual enrichmentAdvising and supporting during high-severity security incidents … plane, SaaS)Familiarity with threat intelligence platforms and frameworks such as PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. Additional InformationBring all of you to workWe create the conditions for high performers to thrive, through real ownership, fewer ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

exercises and risk assessments. Knowledge of threat actor tactics, techniques, and procedures (TTPs). Understanding of common attack frameworks such as MITRE ATT&CK and Cyber Kill Chain. Experience investigating security events and supporting incident response activities. Strong analytical, investigative, and problem-solving skills. Ability ...

including TCP/IP, DNS, firewalls, and proxies. Experience within a SOC, NOC, or 24/7 operational environment. Familiarity with MITRE ATT&CK, CVEs, and vulnerability management. Exposure to cloud security monitoring across Azure, AWS, or Microsoft 365. Desirable Certifications Microsoft SC-200 CompTIA ...

GCIA, GNFA, CISSP, CISM, or equivalent experience in incident response and security operations. Experience with threat hunting, purple teaming, and using MITRE ATT&CK to structure detections, gaps analysis, and defensive improvements. Experience with security operations in cloud platforms and common tools (e.g., Microsoft Defender ...

similar security certifications. Experience with Red Team tooling such as Burp Suite, Metasploit, Wireshark, Nessus, Nmap or Hashcat. Knowledge of MITRE ATT&CK and adversary emulation frameworks. Experience securing Windows, Linux or Mainframe environments. AWS or Azure security experience. Why Join HMLR: This ...

investigating security alerts using SIEM, EDR and security monitoring tools A strong understanding of Modern cyber threats, attacker techniques and the MITRE ATT&CK framework Experience analysing security events across endpoint, network, identity and cloud platforms Knowledge of incident response and risk-based incident prioritisation ...

Security initiatives within complex environments. Understanding of Security Architecture Design and secure-by-design principles. Familiarity with cyber frameworks such as MITRE ATT&CK, NIST, or Cyber Kill Chain. Experience producing intelligence reports and presenting findings to stakeholders. Strong analytical and problem-solving abilities. Excellent ...

response, security monitoring, and threat hunting activities. Excellent understanding of network protocols, cyber attack methodologies, security monitoring techniques, and the MITRE ATT&CK Framework . Good knowledge of cloud security principles across Microsoft Azure and/or AWS environments. Strong analytical, troubleshooting, communication, and stakeholder ...

response, security monitoring, and threat hunting activities. Excellent understanding of network protocols, cyber attack methodologies, security monitoring techniques, and the MITRE ATT&CK Framework . Good knowledge of cloud security principles across Microsoft Azure and/or AWS environments. Strong analytical, troubleshooting, communication, and stakeholder ...

detection-as-code where possible. Reduce false positives and improve detection quality and coverage. Map detections to threat behaviours (e.g. MITRE ATT&CK). Validate detections through testing, incidents, and simulations. Log & Telemetry Management Onboard and maintain log sources across cloud, identity, endpoint, network ...

point-in-time exercise. Lead risk assessments and threat-modelling sessions , selecting methodologies (ISO 27005, NIST RMF, STRIDE, MITRE ATT&CK) that are proportionate to system criticality, and ensuring findings feed into programme governance decisions rather than sitting in security documentation alone. Communicate security findings ...

Phishing & Business Email Compromise Malware & Ransomware Account Compromise Privilege Escalation Insider Threats DLP & Data Exfiltration Alerts Suspicious Authentication Activity Knowledge of: MITRE ATT&CK, Cyber Kill Chain, NIST CSF, and security event classification. If you're a skilled SOC Analyst with strong QRadar experience ...

Identity Defender for Office 365 Microsoft Entra ID Intune Azure security architecture Logic Apps/Sentinel playbooks PowerShell or Python MITRE ATT&CK Microsoft Security architecture and tenant assessments Previous experience working directly for Microsoft , or within a leading Microsoft Security Partner, MSSP or specialist ...

sponsorship available for this role. Desirable Experience working within Defence, MOD or other high-assurance environments. Understanding of frameworks such as MITRE ATT&CK, CAF or NIST. Experience designing or maintaining infrastructure used to support offensive security operations. Experience developing tools, automation or bespoke offensive ...

CRISC, OSCP, CREST, GIAC/SANS, SABSA and vendor specific certification. Knowledge of tools or technologies: Practical and demonstrable knowledge of MITRE ATT&CK, NIST CSF, ISO 27001, CIS Controls, threat-led penetration testing, vulnerability management, cloud security, IAM, SIEM/SOAR, EDR, application security ...

pairing practices that spread security knowledge across the team Tooling and practice familiarity Familiarity with structured threat modelling approaches - STRIDE, MITRE ATT&CK, attack trees - and experience embedding these into agile delivery ceremonies Experience integrating SAST, SCA, dependency scanning, and container security tooling into ...