26 to 50 of 187 MITRE ATT&CK Jobs in the UK

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

proactive threat hunting based on attacker behaviour, not vendor alertsTranslating threat intelligence and incident learnings into durable, reusable detectionsMapping detections to MITRE ATT&CK and real-world attack pathsReducing alert fatigue through logic refinement, correlation, and contextual enrichmentAdvising and supporting during high-severity security incidents … plane, SaaS)Familiarity with threat intelligence platforms and frameworks such as PCI DSS, NIST CSF, SOC 2, ISO27001, CIS Benchmarks, and MITRE ATT&CK for Cloud. Additional InformationBring all of you to workWe create the conditions for high performers to thrive, through real ownership, fewer ...

build and continuously improve detection content, managed as code and version-controlled, mapping coverage to adversary tactics and techniques using the MITRE ATT&CK framework and prioritising the techniques most relevant to a financial services SaaS provider. Telemetry and visibility – maintain a clear view … detections. Working knowledge of cloud security and native cloud telemetry sources (AWS and/or Azure). Practical use of the MITRE ATT&CK framework to structure detection coverage and gap analysis. Hands-on experience building and operating SOAR playbooks and response automation, orchestrating across ...

engineering and tuning Build, test and maintain high-quality detections across our SIEM, XDR and email security platforms, mapped to the MITRE ATT&CK framework Continuously tune existing detections to reduce false positives and improve fidelity, using a data-driven approach Identify gaps in detection … Python, PowerShell or KQL, with a working understanding of APIs and integration patterns Practical understanding of common attack techniques mapped to MITRE ATT&CK, and how they manifest in telemetry A proactive mindset: the candidate must be able to point to specific examples where they ...

endpoint, identity, cloud and Office to spot emerging patterns and support investigations Map threats, TTPs and campaigns to frameworks such as MITRE ATT&CK Work closely with the wider SOC to feed findings into triage, detections and remediation, and build towards producing threat and vulnerability … threat landscape Exposure to vulnerability and threat tooling, ideally Tenable and Microsoft Defender or similar Solid working knowledge of CVEs, CVSS, MITRE ATT&CK and the common types of threats and data breaches Genuinely keen to move into threat and vulnerability work and develop into ...

effective risk management across a range of environmentsAssessing cyber vulnerabilities and organisational security maturity using recognised frameworks such as NIST, MITRE ATT&CK and UK Government guidance to provide actionable recommendationsContributing innovative cyber security solutions, methodologies and bid responses that deliver value to customers … evaluating cyber security solutions, architectures and emerging approaches, including Zero Trust, while applying frameworks and standards such as NIST, ISO27001 and MITRE ATT&CK within complex environmentsExtensive experience in a range of different areas/activitiesPrevious experience leading customer engagement and business development activities, creating ...

effective risk management across a range of environments Assessing cyber vulnerabilities and organisational security maturity using recognised frameworks such as NIST, MITRE ATT&CK and UK Government guidance to provide actionable recommendations Contributing innovative cyber security solutions, methodologies and bid responses that deliver value … evaluating cyber security solutions, architectures and emerging approaches, including Zero Trust, while applying frameworks and standards such as NIST, ISO27001 and MITRE ATT&CK within complex environments Extensive experience in a range of different areas/activities Previous experience leading customer engagement and business development ...

effective risk management across a range of environmentsAssessing cyber vulnerabilities and organisational security maturity using recognised frameworks such as NIST, MITRE ATT&CK and UK Government guidance to provide actionable recommendationsContributing innovative cyber security solutions, methodologies and bid responses that deliver value to customers … operational performance, including regulatory and compliance requirementsPrevious experience applying and evaluating cyber security frameworks, standards and approaches such as NIST, ISO27001, MITRE ATT&CK and Zero Trust principlesPrevious experience contributing to business development activities, including solution development, bid writing and winning new opportunities within government ...

effective risk management across a range of environments Assessing cyber vulnerabilities and organisational security maturity using recognised frameworks such as NIST, MITRE ATT&CK and UK Government guidance to provide actionable recommendations Contributing innovative cyber security solutions, methodologies and bid responses that deliver value … performance, including regulatory and compliance requirements Previous experience applying and evaluating cyber security frameworks, standards and approaches such as NIST, ISO27001, MITRE ATT&CK and Zero Trust principles Previous experience contributing to business development activities, including solution development, bid writing and winning new opportunities within ...

risks into practical engineering requirements. Drive a threat-led approach to security , using threat modelling, attacker behaviour and frameworks such as MITRE ATT&CK to inform architecture decisions and prioritise controls. Shape security across the complete software delivery lifecycle, including secure SDLC, application security, vulnerability … security . Fluent English and comfortable collaborating across international teams and time zones. Experience with product security, SaaS/software environments, MITRE ATT&CK, infrastructure or network engineering would be valuable, but isn’t essential. Relevant security certifications such as CISSP, CCSP, CSSLP, GIAC ...

management and data-residency requirements across cloud, on-premises and third-party services. Develop detection and response architectures covering analytics rules, MITRE ATT&CK-aligned use cases, threat hunting, workbooks, watchlists, automation and SOAR playbooks. Design secure integrations with ITSM, CMDB, threat intelligence, vulnerability management … QRadar, Rapid7 or Elastic. Experience with KQL, Sigma, Logic Apps, PowerShell or other automation and detection‐as‐code approaches. Knowledge of MITRE ATT&CK, NIST SP 800-61, NCSC CAF and recognised security operations maturity models. Experience of ITIL‐aligned service design, service transition ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

standard — author, tune, and peer‐review detections in KQL, SPL, EQL, or Sigma; manage the false‐positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves. Own the threat‐landscape narrative for your engagement — turn intelligence from … similar environment— including writing and tuning detections in KQL, SPL, EQL, or Sigma, and managing coverage against MITRE ATT&CK Experience designing or improving a log and telemetry pipeline, including application‐level telemetry from cloud‐hosted services (AWS is a strong preference at this grade ...

team. Key Responsibilities Conduct Threat Modelling using established and documented methodologies. Apply techniques including STRIDE, PASTA, Attack Trees and MITRE ATT&CK to identify and assess threats. Identify vulnerabilities using frameworks such as CWE and OWASP . Define, document and maintain appropriate security controls … Security . Strong experience in several of the following is required: Threat Modelling – essential , including STRIDE, PASTA, Attack Trees, tooling and MITRE ATT&CK. Professional experience working within a Cyber Security/Information Security role – essential . Identifying vulnerabilities using CWE and OWASP . Security principles covering ...

team. Key Responsibilities Conduct Threat Modelling using established and documented methodologies. Apply techniques including STRIDE, PASTA, Attack Trees and MITRE ATT&CK to identify and assess threats. Identify vulnerabilities using frameworks such as CWE and OWASP . Define, document and maintain appropriate security controls … Security . Strong experience in several of the following is required: Threat Modelling - essential , including STRIDE, PASTA, Attack Trees, tooling and MITRE ATT&CK. Professional experience working within a Cyber Security/Information Security role - essential . Identifying vulnerabilities using CWE and OWASP . Security principles covering ...

decision‐making while driving operational security improvements aligned to recognised standards such as NIST CSF, ISO 27001, DORA, PCI‐DSS, and MITRE ATT&CK. Reporting To: Director/Head of Cyber Security Location: London (Hybrid) Employment Type: Full‐Time Salary: £50,000 – £70,000 (dependent on experience … writing and board‐level presentation capability. Experience leading client engagements and managing stakeholders. Ideally big 4 experience Technical Expertise Familiarity with MITRE ATT&CK and FAIR methodologies. Qualifications MSc in Cyber Security (or equivalent) CEH, CompTIA Security+ (required or equivalent experience) CE Advisor or prepared ...

intelligence-to-defense loop: convert prioritized adversary intelligence into detection requirements, control coverage decisions, and changes to the defensive architecture. Govern ATT&CK-aligned detection coverage on measured efficacy, and stand up continuous validation through adversary emulation and detection testing to prove that intelligence-driven defenses fire … quality to perform under pressure. Strong command of threat-informed defense: translating intelligence into detection coverage and architecture decisions, anchored in MITRE ATT&CK, with kill chain analysis as a supporting lens for mapping attacker progression. Working command of detection engineering practice: detection-as-code ...

documentation, analytical, and stakeholder management skills. Desirable Certifications such as SC-200, SC-300, CISSP, GCIH, GCIA, or equivalent. Knowledge of MITRE ATT&CK, NIST Cyber Security Framework, and Zero Trust principles. Experience with PowerShell, Python, or security automation technologies. Experience contributing to cyber service ...

Modelling exercises and risk assessments. Knowledge of threat actor tactics, techniques, and procedures (TTPs).Understanding of common attack frameworks such as MITRE ATT&CK and Cyber Kill Chain. Experience investigating security events and supporting incident response activities. Strong analytical, investigative, and problem-solving skills. Ability ...

Azure Sentinel, Splunk, or Sophos Taegis. Familiarity with EDR tools including SentinelOne or CrowdStrike. A strong understanding of common attack techniques (MITRE ATT&CK). Working knowledge of Windows, Linux, identity systems, and networking. Experience working with cloud platforms (OCI preferred) in a security context. ...

Adversarial Testing and Vulnerability Disclosure Programmes. Understanding of Cyber Threat Intelligence, phishing, social engineering and insider risk management. Good understanding of MITRE ATT&CK and NIST Cybersecurity Frameworks. Strong analytical and problem-solving skills, with the ability to investigate technical security issues and recommend appropriate ...

security monitoring and investigations Good understanding of SIEM technologies, log analysis and threat detections Knowledge of security frameworks such as MITRE ATT&CK and the Cyber Kill Chain Experience investigating phishing, malware, endpoint, identity and network security incidents Familiarity with Windows, Linux, Active Directory ...

GCIA, GNFA, CISSP, CISM, or equivalent experience in incident response and security operations. Experience with threat hunting, purple teaming, and using MITRE ATT&CK to structure detections, gaps analysis, and defensive improvements. Experience with security operations in cloud platforms and common tools (e.g., Microsoft Defender ...