26 to 50 of 257 MITRE ATT&CK Jobs in the UK

engineering at enterprise scale. Drive adoption of structured detection engineering methodologies (e.g., detection-as-code, use case tiering, coverage mapping to MITRE ATT&CK). Establish and track KPIs and OKRs for detection engineering programme health, delivery velocity, and SOC impact. Continuously identify and implement … detection validation. Familiarity with detection-as-code practices and platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Elastic SIEM). Working knowledge of MITRE ATT&CK framework and its application to detection coverage mapping and gap analysis. AI & Emerging Threat Domains Experience supporting or managing security programmes ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands‐on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands‐on SOAR platform configuration Working ...

across both AI-assisted analysis and the discovery and control of AI use in client environments. Map detections and demos to MITRE ATT&CK, and be straight with partners about what the product does not do. Cover the wider SentinelOne portfolio Build working fluency across … quickly. Strong Windows and macOS fundamentals: process behaviour, persistence mechanisms, and what normal looks like on an endpoint. Working fluency in MITRE ATT&CK, and real experience tuning policy and handling false positives at scale and surrounding in AI security to hold the conversation credibly ...

build and continuously improve detection content, managed as code and version-controlled, mapping coverage to adversary tactics and techniques using the MITRE ATT&CK framework and prioritising the techniques most relevant to a financial services SaaS provider. Telemetry and visibility – maintain a clear view … detections. Working knowledge of cloud security and native cloud telemetry sources (AWS and/or Azure). Practical use of the MITRE ATT&CK framework to structure detection coverage and gap analysis. Hands-on experience building and operating SOAR playbooks and response automation, orchestrating across ...

engineering and tuning Build, test and maintain high-quality detections across our SIEM, XDR and email security platforms, mapped to the MITRE ATT&CK framework Continuously tune existing detections to reduce false positives and improve fidelity, using a data-driven approach Identify gaps in detection … Python, PowerShell or KQL, with a working understanding of APIs and integration patterns Practical understanding of common attack techniques mapped to MITRE ATT&CK, and how they manifest in telemetry A proactive mindset: the candidate must be able to point to specific examples where they ...

tools and technologies, such as SIEM, IDS/IPS, WAF and vulnerability scanners. Knowledge of common adversarial Tactics, Techniques and Procedures (Mitre Att&ck TTPs). Knowledge of security standards and frameworks (e.g. ISO27001, NIST CSF, AWS FSBP) is beneficial. Relevant security certifications (e.g. GCLD … tools and technologies, such as SIEM, IDS/IPS, WAF and vulnerability scanners. Knowledge of common adversarial Tactics, Techniques and Procedures (Mitre Att&ck TTPs). Knowledge of security standards and frameworks (e.g. ISO27001, NIST CSF, AWS FSBP) is beneficial. Relevant security certifications (e.g. GCLD ...

architectures, key components, and common IT/OT protocols. Certifications - Cybersecurity & Infrastructure Security Agency (CISA) Industrial Control Systems (ICS) Training, AttackIQ - MITRE ATT&CK, SANS Global Industrial Cyber Security Professional (GICSP), Certified Information Systems Security Professional (CISSP). Standards, frameworks, and regulatory experience including … Directive, ISA/IEC 62443 Series/ISO 27000 Series, MITRE ATT&CK, NIST Cyber Security Framework (CSF), NCSC CAF, Office for Nuclear Regulation (ONR) Security Assessment Principles, Technical Assessment Guides, and supplementary guidance. Our Culture: Our values stand on a foundation of safety, integrity ...

against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance … Burp Suite, Nmap) and a track record of building your own when the situation calls for it Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve ...

management and data-residency requirements across cloud, on-premises and third-party services. Develop detection and response architectures covering analytics rules, MITRE ATT&CK-aligned use cases, threat hunting, workbooks, watchlists, automation and SOAR playbooks. Design secure integrations with ITSM, CMDB, threat intelligence, vulnerability management … QRadar, Rapid7 or Elastic. Experience with KQL, Sigma, Logic Apps, PowerShell or other automation and detection‐as‐code approaches. Knowledge of MITRE ATT&CK, NIST SP 800-61, NCSC CAF and recognised security operations maturity models. Experience of ITIL‐aligned service design, service transition ...

scale Detection‐as‐code, CI/CD of detection content, and security content management Strong knowledge of adversary tradecraft and frameworks: MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain Experience leveraging Agentic AI, Microsoft Security Copilot ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

Responsibilities: Threat Detection Use Case Development Design and implement detection logic aligned to specific threat scenarios using frameworks such as MITRE ATT&CK. Develop, test, deploy, and tune detection content throughout its lifecycle. Work closely with Client Lead Analysts to ensure detection contentremainsrelevant and effective for client … Hunting, Detection Engineering, or Cyber Security Operations environment. Experience developing, testing, and tuning threat detection use cases. Good understanding of the MITRE ATT&CK framework and common threat actor tactics, techniques, and procedures (TTPs). Experience conducting proactive threat hunting and analysing security telemetry. Strong ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

particular attention to threats targeting privileged access tooling and supply chain attack vectors. Help maintain and evolve detection coverage mapped to MITRE ATT&CK. Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts. AI Integration & Automation Use AI-driven tools for alert triage … Bring 4+ years of experience in a SOC, security operations, or incident response role. Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior. Experience with at least one SIEM platform and familiarity with writing search or detection queries. Familiarity with ...

security platforms. Design, develop, test, deploy, and tune analytics rules, correlation logic, threat-hunting queries, and reusable detection content aligned with MITRE ATT&CK. Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables, and API-based integrations. Develop logging standards, onboarding patterns … XPath filtering, Windows Event IDs, Sysmon, and PowerShell logging. Azure Functions, Logic Apps, REST APIs, PowerShell, Python, and security workflow automation. MITRE ATT&CK mapping, threat-informed defence, detection coverage analysis, and use-case lifecycle management. Security engineering across endpoint, identity, cloud, network, and hybrid ...

security platforms. Design, develop, test, deploy, and tune analytics rules, correlation logic, threat-hunting queries, and reusable detection content aligned with MITRE ATT&CK. Engineer and optimise data connectors, ingestion pipelines, Data Collection Rules, custom parsers, custom tables, and API-based integrations. Develop logging standards, onboarding patterns … XPath filtering, Windows Event IDs, Sysmon, and PowerShell logging. Azure Functions, Logic Apps, REST APIs, PowerShell, Python, and security workflow automation. MITRE ATT&CK mapping, threat-informed defence, detection coverage analysis, and use-case lifecycle management. Security engineering across endpoint, identity, cloud, network, and hybrid ...

makers and C-Suite audiences with demonstrable value. Solid understanding of global security frameworks and standards, such as NIST, ISO and MITRE ATT&CK & MITRE FiGHT We strive to offer a meaningful and inclusive application experience for all candidates. Should you require ...

standard — author, tune, and peer‐review detections in KQL, SPL, EQL, or Sigma; manage the false‐positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves. Own the threat‐landscape narrative for your engagement — turn intelligence from … similar environment— including writing and tuning detections in KQL, SPL, EQL, or Sigma, and managing coverage against MITRE ATT&CK Experience designing or improving a log and telemetry pipeline, including application‐level telemetry from cloud‐hosted services (AWS is a strong preference at this grade ...

applications, APIs and mobile platforms. Plan and execute red team and purple team exercises , aligned with frameworks such as MITRE ATT&CK. Identify vulnerabilities, develop proof-of-concept exploits and demonstrate potential security risks. Conduct Active Directory security assessments and exploitation testing. Support phishing simulations, social engineering … PowerShell, Bash or Go . Good understanding of Active Directory, cloud security, container security and web/API vulnerabilities. Knowledge of MITRE ATT&CK and OWASP Top 10 . Experience delivering customer-facing security assessments and presenting technical findings. Certifications such as OSCP, OSEP, OSWE ...

project priorities, timelines, and specialist skills. *Conduct security risk assessments using recognized threat modelling methodologies such as STRIDE, DREAD, and MITRE Att&ck. *Produce high-level and detailed security architecture and design documentation for complex, high-security-impact initiatives. *Define security requirements based on risk assessments, organisational … providing security architecture support within enterprise-scale technology projects. *Strong understanding and practical application of threat modelling techniques, including STRIDE, DREAD, MITRE Att&ck, or similar frameworks. *Experience producing structured, high-quality security designs and technical documentation. *Broad technical knowledge across infrastructure, networking, operating systems ...

decision‐making while driving operational security improvements aligned to recognised standards such as NIST CSF, ISO 27001, DORA, PCI‐DSS, and MITRE ATT&CK. Reporting To: Director/Head of Cyber Security Location: London (Hybrid) Employment Type: Full‐Time Salary: £50,000 – £70,000 (dependent on experience … writing and board‐level presentation capability. Experience leading client engagements and managing stakeholders. Ideally big 4 experience Technical Expertise Familiarity with MITRE ATT&CK and FAIR methodologies. Qualifications MSc in Cyber Security (or equivalent) CEH, CompTIA Security+ (required or equivalent experience) CE Advisor or prepared ...

Incident Containment, Eradication & Recovery Endpoint Detection & Response (EDR) Microsoft Defender XDR CrowdStrike Falcon Threat Hunting & Threat Intelligence Indicators of Compromise (IOCs) MITRE ATT&CK Framework Malware Analysis & Investigation Phishing Investigation & Response Vulnerability Management Additional Technical Knowledge Kusto Query Language (KQL) Windows & Linux Security Network Security ...

remediation processes Develop and mature the Incident Response and Threat hunting capabilities. Implementation of Incident Response frameworks/methodologies such as Kill Chain, MITRE, Threat Modelling, Diamond Model. Development of Threat Intelligence capabilities and integration of such controls with the security monitoring framework. Development of Security monitoring … Cyber Security and Incident Response frameworks such as NIST, Kill Chain, Attack life Cycle, & MITRE). Relevant experience with MITRE Att&Ck alignment with security monitoring use cases. Relevant experience with cloud security assessments aligning it to industry standard benchmarking such as CIS. ...

documentation, analytical, and stakeholder management skills. Desirable Certifications such as SC-200, SC-300, CISSP, GCIH, GCIA, or equivalent. Knowledge of MITRE ATT&CK, NIST Cyber Security Framework, and Zero Trust principles. Experience with PowerShell, Python, or security automation technologies. Experience contributing to cyber service ...

network traffic analysis. Understanding of the incident response lifecycle, including detection, analysis, containment, eradication and recovery. Knowledge of frameworks such as MITRE ATT&CK, Cyber Kill Chain and NIST. Understanding of enterprise networking, identity and access management, cloud security and email security technologies. Excellent communication ...