26 to 50 of 269 MITRE ATT&CK Jobs in the UK

suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed. Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage. Create, test and tune threat-hunting … business impact. Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments. Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour. Experience working within change-controlled environments and following ...

will be responsible for producing an executive summary-style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … under stressful circumstancesOccasionally willing to begin work early and/or stay late when warranted for customer engagementsStrong grasp of the MITRE ATT&CK frameworkEnjoy mentoring and assisting in the development of junior analystsA team-player attitude with a willingness to share knowledgeAbility to work ...

actions, phishing simulation scenarios, and runbook updates. Conduct hypothesis-driven hunts across identity, endpoint, email, network, cloud, and application telemetry using MITRE ATT&CK and document scope, queries, evidence, findings, and follow-up actions. Vulnerability Management Partnership Validate vulnerability findings, assess risk and business exposure … Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments. Familiarity with MITRE ATT&CK and common detection, threat‐hunting, and incident‐response methodologies. Understanding of vulnerability scanning and remediation workflows and the division of responsibility ...

engineering, vulnerability and exposure management, IAM/PAM, Zero Trust, cloud security, and security control mapping. • Security standards: Practical use of MITRE ATT&CK, STIX/TAXII, CVE, CWE, CAPEC, NIST frameworks, CIS Controls, and common threat-intelligence vocabularies. • GenAI and GraphRAG: LLM-based extraction … sources; implement incremental loading, event-time handling, reconciliation, and recovery patterns. • Engineer mappings between enterprise security data and standards such as MITRE ATT&CK and STIX while managing versioning, extensions, and organization-specific concepts. • Design query patterns, graph projections, indexes, constraints, partitioning strategies, retention policies ...

establish scope, root cause, attacker activity and affected assets. Identify indicators of compromise, tactics, techniques and procedures, and map findings to MITRE ATT&CK where appropriate. Support legally or regulatorily sensitive investigations by maintaining evidence integrity, chain of custody and appropriate access controls. Engage specialist … lessons learned. Experience producing incident records, investigation reports, management updates and post‐incident findings. Understanding of attacker behaviours and frameworks including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance. Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint ...

Cloud and Entra ID Protection. Own detection engineering: write and tune KQL analytics rules and hunting queries, map coverage to MITRE ATT&CK, track false‐positive rates, and retire rules that no longer earn their place. Automate response with automation rules and Logic Apps playbooks … rules and Logic Apps playbooks. Strong KQL and detection engineering: you can write, tune and defend an analytics rule mapped to MITRE ATT&CK, and explain why it fires and why it does not. Incident response on a cloud platform: triage, containment, evidence collection ...

implement SOAR workflows to automate detection, response, and security operations processes. Conduct proactive threat hunting using SIEM/EDR data and MITRE ATT&CK‐aligned techniques. Support vulnerability assessment and security scanning activities using relevant tools. Provide input into penetration testing activities and interpret findings … Security (ES). Solid understanding of network protocols, cloud security (AWS/Azure), and threat detection methodologies. Working knowledge of the MITRE ATT&CK framework. Experience building automation or SOAR playbooks for security operations. CrowdStrike certifications (CCFA/CCFR/CCSE – any combination preferred). ...

security platforms Design, develop, test, deploy and tune analytics rules, correlation logic, threat-hunting queries and reusable detection content aligned with MITRE ATT&CK Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables and API-based integrations Develop logging standards … Custom Ingestion Windows Event Forwarding and Collection XPath Filtering Windows Event IDs Sysmon PowerShell Logging Logic Apps REST APIs PowerShell Python MITRE ATT&CK Detection Coverage Analysis Git-Based CI/CD Cribl Soft Skills: Proactive, accountable and delivery-focused approach Strong analytical, troubleshooting ...

response and security operations Conduct advanced threat hunting and investigations using KQL and Defender Advanced Hunting Align detection logic with the MITRE ATT&CK framework, threat intelligence and emerging attacker behaviour Lead platform configuration, upgrades, policy development, health monitoring and performance improvements Provide technical leadership … knowledge of threat hunting, incident investigation and detection engineering methodologies Proficiency in KQL, Microsoft Sentinel and enterprise security analytics Understanding of MITRE ATT&CK, attacker tactics, techniques and procedures Experience with Detection-as-Code, CI/CD practices, technical documentation and platform governance Leadership ...

cause analysis for Defender XDR and Sentinel incidents Developing and tuning detections and KQL queries, and running threat hunts mapped to MITRE ATT&CK Hardening our Microsoft environment across Entra ID, Intune, Defender for Endpoint and Azure, and owning the vulnerability management lifecycle Administering … concise written communication, from incident reports to management-ready metrics It would be a bonus if you also have: KQL and MITRE ATT&CK knowledge Microsoft SC-200, SC-100 or AZ-500 certification Experience in financial services or another regulated environment, and familiarity with ...

Bash or PowerShell) would also be beneficialExperience with security datasets, data analysis or statistical techniques, and familiarity with frameworks such as MITRE ATT&CK, would be beneficialExperience with, or knowledge of, the company’s products and technologies would be a bonusResponsibilities for Security Researcher …/Threat Researcher/Threat Intelligence/Detection Engineering/Threat Hunting/Incident Response/SOC/Malware Analysis/MITRE ATT&CK/Generative AI/Agentic AI/Network Security/Cloud Security/Endpoint Security/Email Security/Python/ ...

across both AI-assisted analysis and the discovery and control of AI use in client environments. Map detections and demos to MITRE ATT&CK, and be straight with partners about what the product does not do. Cover the wider SentinelOne portfolio Build working fluency across … quickly. Strong Windows and macOS fundamentals: process behaviour, persistence mechanisms, and what normal looks like on an endpoint. Working fluency in MITRE ATT&CK, and real experience tuning policy and handling false positives at scale and surrounding in AI security to hold the conversation credibly ...

cloud, identity and vulnerability management. Introduce useful automation, including enrichment, case creation, triage and response playbooks. Use methods such as MITRE ATT&CK and NIST to improve detection and incident readiness. Ensure vulnerabilities and exposures are prioritised, assigned clear risk owners and tracked through treatment … response orchestration. Sound judgement on investigations, evidence handling and risk‐based vulnerability prioritisation, with familiarity with relevant frameworks such as MITRE ATT&CK, NIST, Cyber Essentials and ISO 27001. The ability to lead analysts, make decisions under pressure and explain technical risks clearly to senior ...

cloud, identity and vulnerability management. Introduce useful automation, including enrichment, case creation, triage and response playbooks. Use methods such as MITRE ATT&CK and NIST to improve detection and incident readiness. Ensure vulnerabilities and exposures are prioritised, assigned clear risk owners and tracked through treatment … workflows or response orchestration.Sound judgement on investigations, evidence handling and risk-based vulnerability prioritisation, with familiarity with relevant frameworks such as MITRE ATT&CK, NIST, Cyber Essentials and ISO 27001. The ability to lead analysts, make decisions under pressure and explain technical risks clearly ...

detections using a Detection as Code methodology — working with version control, peer review, and automated testing pipelines. Map detections to the MITRE ATT&CK framework and contribute to improving coverage, precision, and resilience against evasion. AI-Augmented Security Operations: Help explore and apply … work with developers to remediate security findings. Security Frameworks & Standards: Working knowledge of relevant security frameworks (e.g. NIST CSF, CIS Benchmarks, MITRE ATT&CK) and compliance standards such as SOC 2 or ISO 27001. Communication & Collaboration: Strong ability to articulate technical security risks and recommendations ...

against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance … Burp Suite, Nmap) and a track record of building your own when the situation calls for it Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve ...

management and data-residency requirements across cloud, on-premises and third-party services. Develop detection and response architectures covering analytics rules, MITRE ATT&CK-aligned use cases, threat hunting, workbooks, watchlists, automation and SOAR playbooks. Design secure integrations with ITSM, CMDB, threat intelligence, vulnerability management … QRadar, Rapid7 or Elastic. Experience with KQL, Sigma, Logic Apps, PowerShell or other automation and detection‐as‐code approaches. Knowledge of MITRE ATT&CK, NIST SP 800-61, NCSC CAF and recognised security operations maturity models. Experience of ITIL‐aligned service design, service transition ...

scale Detection‐as‐code, CI/CD of detection content, and security content management Strong knowledge of adversary tradecraft and frameworks: MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain Experience leveraging Agentic AI, Microsoft Security Copilot ...

risk exposure to senior leadership, governance forums, and risk committees Ensure alignment with recognised frameworks and standards including NIST AI RMF, MITRE ATT&CK, MITRE ATLAS, OWASP LLM Top 10, ISO 27001, the EU AI Act, and evolving UK regulatory requirements What ...

security controls (e.g. EDR, MFA, segmentation, privileged access, logging and detection) against known attacker tactics, techniques and procedures, mapped to MITRE ATT&CK. Interpreting and challenging the results of client penetration tests, red team exercises and vulnerability assessments, assessing scope, quality, remediation status and residual risk. Assessing … Endpoint and EDR evasion techniques OT/ICS security testing Familiarity with one or more of the following frameworks and methodologies: MITRE ATT&CK CBEST, TIBER-EU and/or STAR-FS threat intelligence‐led testing frameworks CHECK and CREST testing standards NIST ...

security platforms. Design, develop, test, deploy, and tune analytics rules, correlation logic, threat-hunting queries, and reusable detection content aligned with MITRE ATT&CK. Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables, and API-based integrations. Develop logging standards, onboarding patterns … XPath filtering, Windows Event IDs, Sysmon, and PowerShell logging. Azure Functions, Logic Apps, REST APIs, PowerShell, Python, and security workflow automation. MITRE ATT&CK mapping, threat-informed defence, detection coverage analysis, and use-case lifecycle management. Security engineering across endpoint, identity, cloud, network, and hybrid ...

Leadership.* Capability Development and Maturity: Accountable for continuous improvement of cyber defence maturity aligned to NIST CSF and recognised frameworks (e.g. MITRE ATT&CK)* Leadership and People: Accountable for building and leading a high-performing, threat led cyber defence team with clear accountability and skills … professional organisation (e.g. BCS, ISACA, IAPP).* Strong understanding of threat actor tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK.* Able to communicate effectively at all levels with very good written and oral skills.* Highly organized and capable of managing multiple concurrent tasks ...

Leadership. Capability Development and Maturity: Accountable for continuous improvement of cyber defence maturity aligned to NIST CSF and recognised frameworks (e.g. MITRE ATT&CK). Leadership and People: Accountable for building and leading a high-performing, threat‐led cyber defence team with clear accountability … professional organisation (e.g. BCS, ISACA, IAPP). Strong understanding of threat actor tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK. Able to communicate effectively at all levels with very good written and oral skills. Highly organized and capable of managing multiple concurrent tasks ...

makers and C-Suite audiences with demonstrable value. Solid understanding of global security frameworks and standards, such as NIST, ISO and MITRE ATT&CK & MITRE FiGHT We strive to offer a meaningful and inclusive application experience for all candidates. Should you require ...

standard — author, tune, and peer‐review detections in KQL, SPL, EQL, or Sigma; manage the false‐positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves. Own the threat‐landscape narrative for your engagement — turn intelligence from … similar environment— including writing and tuning detections in KQL, SPL, EQL, or Sigma, and managing coverage against MITRE ATT&CK Experience designing or improving a log and telemetry pipeline, including application‐level telemetry from cloud‐hosted services (AWS is a strong preference at this grade ...