1 to 25 of 194 SIEM Jobs in the UK excluding London

highly technical engineering role, where you'll be hands-on developing and maintaining our security operations tooling. Key Responsibilities: Security Infrastructure & Engineering Architect, implement, and manage security technologies including: SIEM (Sentinel) Microsoft Defender suite (Cloud, Endpoint and Identity), Microsoft Sentinel, Purview and Azure infrastructure (including RBAC, PIM, NSGs and identity protections). Firewalls, IDS/IPS, WAF, VPN, and network More ❯

posture and make a measurable impact, we'd love to have you on the team. What you will do: Operate and optimise a wide range of security platforms, including SIEM, XDR, EDR, IAM, DLP, PAM, ZTNA, and vulnerability management tools Take ownership of the detection and response lifecycle - triaging alerts, investigating incidents, identifying root causes, and coordinating response actions Implement More ❯

Essentials Plus). Experience aligning infrastructure builds with cyber security standards such as NCSC guidance, CIS benchmarks, or Microsoft Security Baselines. Experience implementing monitoring, logging, and alerting toolsets including SIEM and threat detection platforms. Understanding of data classification, encryption, and secure storage/access principles. Familiarity with endpoint protection platforms and vulnerability management tools. Experience securing hybrid identity solutions and More ❯

detection and DevSecOps practices, ensuring security is embedded within operational workflows and cloud-native architectures. What you will do: Operate and optimise core cyber security tools and platforms, including SIEM, XDR, EDR, DLP, IAM, PAM, ZTNA and vulnerability management solutions Lead or support the detection and response lifecycle, including triage of alerts, investigation of incidents, root cause analysis, and coordination More ❯

etc.) UK data protection and compliance frameworks (GDPR, ICO guidance) Identity federation, SSO, and role-based access control Network segmentation and firewall configuration in cloud environments. Logging, monitoring, and SIEM integration (e.g. Splunk, Chronicle) Experience with Infrastructure as Code (Terraform, Deployment Manager). Desirable: Google Cloud Professional Cloud Security Engineer certification. Experience with UK public sector or regulated industries (e.g. More ❯

of security investigations best practice including the use of Microsoft Purview and computer forensics an advantage. Experience of utilising and monitoring Information Security solutions e.g. email/web gateways, SIEM, Endpoint protection etc. Strong awareness of Cloud services and supporting security solutions & standards. Good understanding of cloud native and devops practices including pipelines and associated processes Hands on experience of More ❯

and frameworks like NIST Cybersecurity Framework, ISO 27001, and CIS Critical Security Controls. Familiarity with the use of standard security technology solutions and processes such as user provisioning, directory, SIEM, vulnerability management, Cloud Security (OCI/Azure/AWS), Web Security, Email Security, Logging and Monitoring, General PKI and Cryptography. Evaluate and recommend security technologies, tools, and methodologies to enhance More ❯

a comprehensive security plan. Test cyber-attacks regularly to address vulnerabilities. Monitor security trends, adapt strategies. Oversee incident monitoring, detection, response via SOC and MSSPs. Manage security tools like SIEM and endpoint protection. Lead incident response and post-incident analysis. Enforce policies for data privacy (GDPR & NIST). Conduct regular security audits. Manage vendor relationships and negotiate contracts. Report service More ❯

a comprehensive security plan. Test cyber-attacks regularly to address vulnerabilities. Monitor security trends, adapt strategies. Oversee incident monitoring, detection, response via SOC and MSSPs. Manage security tools like SIEM and endpoint protection. Lead incident response and post-incident analysis. Enforce policies for data privacy (GDPR & NIST). Conduct regular security audits. Manage vendor relationships and negotiate contracts. Report service More ❯

a comprehensive security plan. Test cyber-attacks regularly to address vulnerabilities. Monitor security trends, adapt strategies. Oversee incident monitoring, detection, response via SOC and MSSPs. Manage security tools like SIEM and endpoint protection. Lead incident response and post-incident analysis. Enforce policies for data privacy (GDPR & NIST). Conduct regular security audits. Manage vendor relationships and negotiate contracts. Report service More ❯

Leading investigations into escalated security events and incidents Driving containment, remediation, and root-cause analysis for major incidents Performing malware analysis, reverse engineering, and threat hunting Developing and optimising SIEM use cases (Splunk, QRadar) Shaping SOC runbooks, playbooks, and incident response procedures Supporting client stakeholders with incident reporting and recommendations Staying ahead of emerging threats and integrating threat intelligence Acting More ❯

programming language - Demonstrable experience in using SOAR tooling and its application - Application of data science against large datasets involving unstructured data and designing data models - Knowledge of using SIEM platforms to identify suspected security events and creating content to enhance the platform - Knowledge of custom API's to leverage the SOAR's functionality - Ability to communicate to other stakeholders across More ❯

programming language - Demonstrable experience in using SOAR tooling and its application - Application of data science against large datasets involving unstructured data and designing data models - Knowledge of using SIEM platforms to identify suspected security events and creating content to enhance the platform - Knowledge of custom API's to leverage the SOAR's functionality - Ability to communicate to other stakeholders across More ❯

AD) Microsoft Purview Microsoft Intune Azure Security Center Information Security (On-Premise): Firewalls (e.g. Palo Alto, Fortinet) Intrusion Detection/Prevention Systems (IDS/IPS) Endpoint Protection Platforms (EPP) SIEM tools (on-prem or hybrid) Identity & Access Management (IAM) Patch management and vulnerability scanning Data Loss Prevention (DLP) Candidate Profile Proven experience delivering large-scale cyber and information security programmes More ❯

of: Corestream (GRC Business Assurance tool) End-point protection Email Protection Encryption Technologies Web Filtering Application control Data Leakage Mobile Device Management Vulnerability Testing Penetration Testing Phishing simulation campaigns SIEM and logging systems Cyber Incident Response OWASP top 10 compliance analysis Forensic Investigation/Breaches Managerial Duties Please see job description for full details of responsibilities Person Specification QUALIFICATIONS/ More ❯

PowerShell and automation. Consulting experience across IT and digital teams. Flexibility for occasional travel and out-of-hours support. Exposure to MxDR/SOC environments and advanced security protocols (SIEM, IDS/IPS, firewalls). Knowledge of GDPR, Cyber Essentials+, PCI-DSS, and other compliance standards. Strong grasp of data protection legislation (e.g., GDPR, Data Protection Act). Global Impact More ❯

Teams, SharePoint, Intune, Azure) Windows Server/Active Directory, Networking fundamentals (DNS, DHCP, VPNs, firewalls). Security tools, vulnerability management, and incident response Security technologies (firewalls, IDS/IPS, SIEM, vulnerability scanners) Familiarity with Microsoft Defender and Mimecast. Strong analytical and troubleshooting skills across complex IT environments. Experience of Compliance, IT Governance, Change Management etc Any relevant professional certifications would More ❯

creation, and threat modelling. The Senior SOC Engineer will play a key role in building and optimising detection and response strategies, ensuring robust protection against evolving threats. Key Responsibilities SIEM Engineering & Management Deploy, configure, and maintain the QRadar SIEM platform. Onboard and normalise log sources across on-premises and cloud environments. Develop and optimise analytical rules for threat detection, anomaly … Modelling & Use Case Development Lead threat modelling exercises using frameworks such as MITRE ATT&CK, STRIDE, and Cyber Kill Chain. Translate threat models into actionable detection use cases and SIEM rules. Prioritise detection engineering based on business risk and impact. Reporting & Collaboration Produce reports and dashboards to communicate security posture and incident trends. Partner with IT, DevOps, and compliance teams … to clients. Participate in continual service improvement initiatives, recommending changes to address recurring incidents. Skills & Qualifications Eligible for, or already holding, SC Clearance. Proven expertise in IBM QRadar and SIEM engineering. Strong knowledge of log formats, parsing, and normalisation. Proficiency in SIEM query languages such as KQL, SPL, AQL. Scripting experience with Python or PowerShell for automation. Deep understanding of More ❯

Regulatory requirement expertise - Cyber Essentials Plus, ISO 27001 and GDPR Microsoft security tools - Defender, Entra ID, Purview Cloud platform exposure - Azure preferred Broad experience of configuring and management of SIEM tooling Certifications CISSP, CISM are a non-negotiable Hands-on expertise with identity and access management, endpoint protection, vulnerability and patch management and cloud security. Ability to explain complex technical More ❯

compliance with security standards (e.g., ISO 27001, SOC 2, GDPR) and internal policies and procedures for cloud and IT environments. Lead incident response, vulnerability management, and threat detection using SIEM tools, MDR and antivirus platforms. Secure and implement policies and procedures for disaster recovery and business continuity. Work with the CTO and the rest of the executive team to embed More ❯

and collaboratively with cross-functional teams. Understanding of Microsoft Azure, Entra ID, Conditional Access, and Intune. Experience with Active Directory, DNS/DHCP, Group Policy, and VPNs. Familiarity with SIEM/XDR platforms, endpoint protection, and incident response tools. Ability to work independently and collaboratively across teams. Preferred Experience: Minimum 3 years' experience in a technical support role with exposure More ❯

You have excellent problem-solving and analytical skills, along with effective communication and presentation abilities. You have hands-on experience with cyber security platforms from industry leaders, including EDR, SIEM, IPS, WAF, DLP, Identity & Data Management, and Network Security technologies. Experience with related infrastructure technologies is also acceptable. You are hands on experience with cloud platforms such as Azure and More ❯

You have excellent problem-solving and analytical skills, along with effective communication and presentation abilities. You have hands-on experience with cyber security platforms from industry leaders, including EDR, SIEM, IPS, WAF, DLP, Identity & Data Management, and Network Security technologies. Experience with related infrastructure technologies is also acceptable. You are hands on experience with cloud platforms such as Azure and More ❯

Network, Application Logs Security frameworks/Standards (NIST, CIS, ISO27001) Scripting & Automation (PowerShell, Azure CLI, Azure Logic Apps) MITRE ATT&CK, Threat Modelling Knowledge of CVEs and security vulnerabilities SIEM Tools, Cyber Hunting Techniques Operational threat intelligence and common attack vectors Security vulnerabilities, technical reports Cyber Defence Manager will pay a salary range of £70,000 to £85,000 plus More ❯

Network, Application Logs Security frameworks/Standards (NIST, CIS, ISO27001) Scripting & Automation (PowerShell, Azure CLI, Azure Logic Apps) MITRE ATT&CK, Threat Modelling Knowledge of CVEs and security vulnerabilities SIEM Tools, Cyber Hunting Techniques Operational threat intelligence and common attack vectors Security vulnerabilities, technical reports Cyber Defence Manager will pay a salary range of £70,000 to £85,000 plus More ❯