1 to 25 of 81 MITRE ATT&CK Jobs in the UK excluding London

delivered in a consistent and scalable way. Working directly with customers, you will define detection strategies, design use cases aligned to MITRE ATT&CK, and guide improvements in visibility, coverage and response maturity. You will work closely with platform onboarding and engineering teams, supplementing them … rulesets across SIEM and XDR platformsDevelop and tune detection logic using KQL or equivalent query languagesDesign detection use cases aligned to MITRE ATT&CK and real-world attack techniquesMap customer log sources to detection use cases to assess coverage and identify gapsDesign and implement SOAR ...

improve security telemetry, alert enrichment, investigation workflows and response times. Conduct threat hunting using adversary behaviours, TTPs and frameworks such as MITRE ATT&CK, incorporating findings into security controls and detections. Create and continuously improve incident runbooks, playbooks and detection processes based on findings from … ability to write and develop queries for complex investigations. Understanding of adversary tactics, techniques and procedures (TTPs), offensive security concepts and MITRE ATT&CK principles. Practical knowledge of cloud environments and security controls, with the ability to apply detection and incident response practices across hybrid ...

SIEM and XDR platforms Develop and tune detection logic using KQL or equivalent query languages Design detection use cases aligned to MITRE ATT&CK and real-world attack techniques Map customer log sources to detection use cases to assess coverage and identify gaps Design … consultant Lead workshops covering detection engineering, use case design and SOC maturity Guide customers on improving detection coverage and aligning to MITRE ATT&CK Clearly explain detection strategies, gaps and recommendations to both technical and non-technical stakeholders Work closely with platform onboarding and engineering ...

rulesets across SIEM and XDR platformsDevelop and tune detection logic using KQL or equivalent query languagesDesign detection use cases aligned to MITRE ATT&CK and real-world attack techniquesMap customer log sources to detection use cases to assess coverage and identify gapsDesign and implement SOAR … trusted technical consultantLead workshops covering detection engineering, use case design and SOC maturityGuide customers on improving detection coverage and aligning to MITRE ATT&CKClearly explain detection strategies, gaps and recommendations to both technical and non-technical stakeholdersWork closely with platform onboarding and engineering teams to ensure smooth ...

designers to ensure intuitive interfaces that match SOC analyst mental models and workflow patterns. Providing technical consultation on threat detection logic, MITRE ATT&CK mapping, and security operations best practices. Supporting go-to-market activities by creating technical content, conducting product demonstrations, and engaging with … customers. Mentoring and educating internal teams on SOC operations, threat landscapes, and analyst workflows. Ensuring product features align with industry frameworks (MITRE ATT&CK, NIST, ISO 27001) and SOC maturity models. Act as a trusted SOC and cyber defence expert in customer meetings, workshops ...

with threat intelligence teams to enhance detection logic. Threat Modelling & Use Case Development Lead threat modelling exercises using frameworks such as MITRE ATT&CK, STRIDE, and Cyber Kill Chain. Translate threat models into actionable detection use cases and SIEM rules. Prioritise detection engineering based … Python or PowerShell for automation. Deep understanding of threat detection, incident response, and the cyber kill chain. Familiarity with frameworks including MITRE ATT&CK, NIST, and CIS. Strong communication, analytical, and presentation skills. Solid understanding of network traffic flows, vulnerability management, and penetration testing principles. ...

help define corrective actions to reduce future risks. Threat Modelling & Use Case Development Perform threat modeling using industry frameworks such as MITRE ATT&CK, STRIDE, or the Cyber Kill Chain.Design actionable SIEM use cases, detection rules, and workflows aligned with risk prioritization.Evaluate use-case effectiveness … scripting (e.g., Python, PowerShell) to automate tasks and build SOC efficiencies.Deep familiarity with cyber threat detection techniques related to frameworks like MITRE ATT&CK and vulnerability management.Experience managing ITIL processes, including Incident, Problem, and Change Management. Certifications Required CISSP, GIAC, SC-200, Splunk Power User ...

will be responsible for producing an executive summary‐style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances``` Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team‐player attitude with a willingness to share knowledge ...

will be responsible for producing an executive summary-style report, which will include a timeline of key events mapped to the MITRE ATT&CK framework. This comprehensive report will serve as a valuable resource for stakeholders, highlighting the steps taken to combat the cybersecurity incident … circumstances Occasionally willing to begin work early and/or stay late when warranted for customer engagements Strong grasp of the MITRE ATT&CK framework Enjoy mentoring and assisting in the development of junior analysts A team-player attitude with a willingness to share knowledge ...

escalation playbooks; suggest improvements based on recurring issues or inefficiencies. Threat Awareness: Maintain awareness of current cyber threats, attacker techniques (MITRE ATT&CK), and industry trends relevant to the organisations threat landscape. About You: Previous experience in a SOC, IT Operations, or security support role. … systems. Working knowledge of SIEM platforms (e.g. Microsoft sentinel, Splunk, Elastic, QRadar). Awareness of security frameworks and methodologies (NIST CSF, MITRE ATT&CK, ISO27001). #J-18808-Ljbffr ...

threat detection platforms. Create and optimise detection logic using technologies such as Splunk and endpoint security solutions. Map detections against the MITRE ATT&CK framework to ensure comprehensive threat coverage. Continuously improve detection quality by analysing alert fidelity, false positives, and operational effectiveness. Validate detections … following: Splunk and SPL YARA rule development EDR detection engineering SIEM content development and tuning Experience mapping detections to the MITRE ATT&CK framework. Strong understanding of modern security principles including Zero Trust, identity-first security, secrets management, and network segmentation. Desirable Experience Experience with ...

sign-ins, malicious OAuth consent, mailbox access), including session/token revocation Design, build and test SIEM detection rules mapped to MITRE ATT&CK, and tune out false positives without blanket whitelisting Build automation for SOC processes - enrichment, ticketing, containment - using Python, Logic Apps, APIs … security incidents from triage through to closure Hands-on experience writing and tuning SIEM detection logic, with a solid understanding of MITRE ATT&CK and KQL (or equivalent) Practical scripting/automation experience (Python, Logic Apps, REST APIs) or hands-on SOAR platform configuration Working ...

endpoint, identity, cloud and Office to spot emerging patterns and support investigations Map threats, TTPs and campaigns to frameworks such as MITRE ATT&CK Work closely with the wider SOC to feed findings into triage, detections and remediation, and build towards producing threat and vulnerability … threat landscape Exposure to vulnerability and threat tooling, ideally Tenable and Microsoft Defender or similar Solid working knowledge of CVEs, CVSS, MITRE ATT&CK and the common types of threats and data breaches Genuinely keen to move into threat and vulnerability work and develop into ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

Lead and support incident response activities, providing expert guidance on containment, eradication and recovery. Enhance detection rules and use cases using MITRE ATT&CK and threat-informed defence techniques. Support threat intelligence activities and contribute to the continuous improvement of SOC operations. What … Bring: Proven experience working within a Security Operations Centre. Hands-on experience with Microsoft Sentinel and Splunk. Strong understanding of MITRE ATT&CK. It would be great if you had: Networking protocols and infrastructure (TCP/IP, LAN/WAN, HTTP, SMTP, FTP, LDAP). Firewalls, VPNs ...

optimise detection content across Microsoft Sentinel, Defender XDR, CrowdStrike and associated platforms, developing advanced KQL queries and analytics rules aligned to MITRE ATT&CK. Act as senior technical owner for security platforms including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune, Darktrace and supporting technologies, managing … understanding of Azure, AWS and hybrid infrastructure security, with strong knowledge of networking, operating systems and attacker techniques. Practical understanding of MITRE ATT&CK, Cyber Kill Chain, NIST and SANS incident response frameworks. Experience working within regulated and audited environments, including ISO 27001 and Cyber ...

Azure Sentinel, Splunk, or Sophos Taegis. Familiarity with EDR tools including SentinelOne or CrowdStrike. A strong understanding of common attack techniques (MITRE ATT&CK). Working knowledge of Windows, Linux, identity systems, and networking. Experience working with cloud platforms (OCI preferred) in a security context. ...

Teaming, Continuous Adversarial Testing and Vulnerability Disclosure Programmes.Understanding of Cyber Threat Intelligence, phishing, social engineering and insider risk management.Good understanding of MITRE ATT&CK and NIST Cybersecurity Frameworks.Strong analytical and problem-solving skills, with the ability to investigate technical security issues and recommend appropriate actions.Ability ...

activities during major cyber security incidents. Experience contributing to the development of monitoring use cases and detection improvements. Applied knowledge of MITRE ATT&CK or equivalent adversary behaviour frameworks. TPBN1_UKTJ ...

activities during major cyber security incidents. Experience contributing to the development of monitoring use cases and detection improvements. Applied knowledge of MITRE ATT&CK or equivalent adversary behaviour frameworks. ...

activities during major cyber security incidents. Experience contributing to the development of monitoring use cases and detection improvements. Applied knowledge of MITRE ATT&CK or equivalent adversary behaviour frameworks. ...

security principles, including OWASP Top 10, WAF and API security Experience with vulnerability management, patching and security remediation Knowledge of the MITRE ATT&CK Framework and common attack techniques Experience applying security standards such as NCSC guidance, CIS benchmarks or Microsoft Security Baselines Understanding ...

HTTP, SMB, LDAP. Operational knowledge of Windows, macOS and Linux. Ability to read and interpret logs from multiple sources. Awareness of MITRE ATT&CK and differentiating legitimate admin activity vs suspicious behaviour. Experience with Microsoft Sentinel, Google SecOps or other SIEM platforms. Experience with Defender ...

technologies A good understanding of incident response processes and methodologies Knowledge of common attack techniques, tactics and procedures, including the MITRE ATT&CK framework Experience analysing logs across endpoint, network, cloud or identity environments An understanding of threat intelligence and indicators of compromise Strong analytical ...

security principles and cloud security architecture Experience with Microsoft Entra ID, Conditional Access and identity security Understanding of security frameworks including MITRE ATT&CK, NIST or ISO 27001 Experience with security automation and Infrastructure as Code technologies such as Terraform, Bicep or Azure DevOps Desirable ...