Cloud Security Architect Location: Mostly remote - 2-3 days onsite per month (Cardiff area) Salary: Up to £85,000 + bonus + Great bens Must have Active SC Clearance About the Role We are looking for an experienced Cloud Security Architect with Active SC Clearance to join a well established organisation supporting large-scale digital transformation programmes. This is a senior position where you will act as the Domain Design Authority , owning security architecture across enterprise environments. You will play a critical role in ensuring the integrity, consistency, and evolution of security capabilities across services, while acting as a trusted advisor to both technical and business stakeholders. Key Responsibilities Act as Domain Design Authority for security architecture within your service line Define, govern, and assure enterprise security architecture across complex environments Provide strategic advisory across managed services, new deals, and transition programmes Ensure alignment with security standards, policies, and best practices Lead stakeholder engagement, building strong relationships across business and technology teams Provide technical leadership and guidance to engineering teams Translate complex security concepts into clear recommendations for senior stakeholders Skills & Experience Strong experience in enterprise security architecture within large-scale environments Expertise across: SOC / SIEM / SIAM Network Security Architecture Cloud Security (Azure, AWS, Hybrid environments) Strong understanding of modern security operations and tooling Familiarity with frameworks such as TOGAF, SABSA , and Secure by Design principles Proven ability to influence and engage stakeholders at all levels Experience working in multi-vendor and transformation environments Security Requirements Must be a sole UK national Must have active SC clearance Working Model This role is mostly remote but requiring 1-2 days onsite per month in the Cardiff area. What's on Offer Salary up to £85,000 + bonus Opportunity to work on high-profile transformation programmes A collaborative environment with strong focus on innovation and professional growth RSG Plc is acting as an Employment Agency in relation to this vacancy.
May 23, 2026
Full time
Cloud Security Architect Location: Mostly remote - 2-3 days onsite per month (Cardiff area) Salary: Up to £85,000 + bonus + Great bens Must have Active SC Clearance About the Role We are looking for an experienced Cloud Security Architect with Active SC Clearance to join a well established organisation supporting large-scale digital transformation programmes. This is a senior position where you will act as the Domain Design Authority , owning security architecture across enterprise environments. You will play a critical role in ensuring the integrity, consistency, and evolution of security capabilities across services, while acting as a trusted advisor to both technical and business stakeholders. Key Responsibilities Act as Domain Design Authority for security architecture within your service line Define, govern, and assure enterprise security architecture across complex environments Provide strategic advisory across managed services, new deals, and transition programmes Ensure alignment with security standards, policies, and best practices Lead stakeholder engagement, building strong relationships across business and technology teams Provide technical leadership and guidance to engineering teams Translate complex security concepts into clear recommendations for senior stakeholders Skills & Experience Strong experience in enterprise security architecture within large-scale environments Expertise across: SOC / SIEM / SIAM Network Security Architecture Cloud Security (Azure, AWS, Hybrid environments) Strong understanding of modern security operations and tooling Familiarity with frameworks such as TOGAF, SABSA , and Secure by Design principles Proven ability to influence and engage stakeholders at all levels Experience working in multi-vendor and transformation environments Security Requirements Must be a sole UK national Must have active SC clearance Working Model This role is mostly remote but requiring 1-2 days onsite per month in the Cardiff area. What's on Offer Salary up to £85,000 + bonus Opportunity to work on high-profile transformation programmes A collaborative environment with strong focus on innovation and professional growth RSG Plc is acting as an Employment Agency in relation to this vacancy.
My client seeks to recruit an SC Cleared Crowdstrike Deployment Engineer to join the Cyber team, with a primary focus of deploying CrowdStrike across both servers and endpoints.Key activities to include but not limited to: Configuration of Falcon policies, including:- Threat prevention (NGAV)- Detection and response (EDR/XDR)- Sensor management, updates, and grouping policies- Alignment of host groups and policies to organisational requirements.- Integration with identity/directory services for visibility and correlation.- Tuning of detection capabilities, including custom detection logic within agreed capacity.- Integration with SIEM/SOC platforms for alerting, event correlation, and centralised monitoring.- Enablement of response capabilities (host containment, Real Time Response).- Validation, testing, and troubleshooting of deployment and configuration (sample-based and advisory). Skills required: Active SC Clearance or ability to obtain Previous banking / finance experience Proven hands-on experience deploying and engineering CrowdStrike Falcon Strong background in endpoint and server security across enterprise, cloud, and hybrid estates Experience integrating security tooling with SIEM/SOC environments
May 21, 2026
Contractor
My client seeks to recruit an SC Cleared Crowdstrike Deployment Engineer to join the Cyber team, with a primary focus of deploying CrowdStrike across both servers and endpoints.Key activities to include but not limited to: Configuration of Falcon policies, including:- Threat prevention (NGAV)- Detection and response (EDR/XDR)- Sensor management, updates, and grouping policies- Alignment of host groups and policies to organisational requirements.- Integration with identity/directory services for visibility and correlation.- Tuning of detection capabilities, including custom detection logic within agreed capacity.- Integration with SIEM/SOC platforms for alerting, event correlation, and centralised monitoring.- Enablement of response capabilities (host containment, Real Time Response).- Validation, testing, and troubleshooting of deployment and configuration (sample-based and advisory). Skills required: Active SC Clearance or ability to obtain Previous banking / finance experience Proven hands-on experience deploying and engineering CrowdStrike Falcon Strong background in endpoint and server security across enterprise, cloud, and hybrid estates Experience integrating security tooling with SIEM/SOC environments
SOC / Cyber Threat Detection Analyst - SANS/GIAC Cyber Threat Detection Analyst Location: Wokingham, Berkshire (On-site) Salary: Competitive (dependent on experience) + excellent benefits & training Security Clearance: Ideally SC Cleared or eligible for SC Role Overview As a Cyber Threat Detection Analyst, you will play a hands-on role within an advanced cyber defence function, focused on proactive threat hunting, adversary behaviour analysis, and high-fidelity threat detection across enterprise environments. This role goes beyond reactive alert handling. You will actively hunt for malicious activity using telemetry, SIEM data, and threat intelligence, develop hypotheses based on MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs), and support incident management and response activities when threats are identified. We are open to experienced SOC Analysts where threat hunting, investigations, and proactive detection have formed a significant part of their role, and who are looking to further develop in a more hunting-led environment. This position is well suited to analysts who enjoy thinking like an attacker, have worked alongside or supported red team or purple team activities, and want to deepen their expertise in threat detection and detection engineering. Skills & Experience We're Seeking Experience in threat hunting, cyber threat detection, SOC, blue team, or cyber defence environments, with ideally around five years hands on experience. Strong hands-on experience using SIEM platforms, including: Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security/Kibana (KQL, ESQL) Practical and operational understanding of MITRE ATT&CK, attacker techniques, and adversary tradecraft Experience working with Indicators of Compromise (IOCs) and threat intelligence feeds Solid experience across the security event life cycle, including detection, investigation, and incident management Hands-on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or Carbon Black Strong knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, Firewalls, VPNs, Proxy technologies) Experience analysing telemetry from Windows, Linux, identity, endpoint, and network sources Strong analytical mindset with the ability to clearly communicate findings, impact, and risk Key Responsibilities Conduct proactive threat hunting activities across log, endpoint, and network telemetry to identify suspicious, stealthy, or previously unknown threats Develop and execute hunt hypotheses aligned to MITRE ATT&CK TTPs, adversary behaviours, and emerging threat intelligence Write, refine, and optimise SIEM queries using KQL, SPL, Elastic/ESQL, and Kibana Query Language Perform IOC analysis, enrichment, and validation, integrating internal and external threat intelligence sources Lead investigations from initial detection through scoping, root cause analysis, and impact assessment Support incident management and incident response activities, including containment, remediation, escalation, and lessons learned Collaborate closely with SOC teams, incident responders, red teams, and purple teams to validate detections and improve defensive coverage Contribute to detection logic improvements, use-case development, and continuous enhancement of hunting methodologies Produce clear investigation write-ups, timelines, and recommendations for technical and non-technical stakeholders Security Certifications (Highly Beneficial) SANS/GIAC certifications, including but not limited to: GCIH - Incident Handler GCIA - Intrusion Analyst GCED - Enterprise Defender GCTI - Cyber Threat Intelligence GMON - Continuous Monitoring GDAT - Defending Advanced Threats GCAT - Advanced Threat Intelligence OSCP or equivalent offensive security qualifications Crest certifications, such as: Crest Practitioner Intrusion Analyst (CPIA) Crest Registered Intrusion Analyst (CRIA) Crest Certified Threat Intelligence Analyst (CCTIA) Crest Certified Blue Team Professional (CCBTP) Microsoft SC-200 or related detection and response certifications Other recognised cyber security or threat intelligence credentials
May 20, 2026
Full time
SOC / Cyber Threat Detection Analyst - SANS/GIAC Cyber Threat Detection Analyst Location: Wokingham, Berkshire (On-site) Salary: Competitive (dependent on experience) + excellent benefits & training Security Clearance: Ideally SC Cleared or eligible for SC Role Overview As a Cyber Threat Detection Analyst, you will play a hands-on role within an advanced cyber defence function, focused on proactive threat hunting, adversary behaviour analysis, and high-fidelity threat detection across enterprise environments. This role goes beyond reactive alert handling. You will actively hunt for malicious activity using telemetry, SIEM data, and threat intelligence, develop hypotheses based on MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs), and support incident management and response activities when threats are identified. We are open to experienced SOC Analysts where threat hunting, investigations, and proactive detection have formed a significant part of their role, and who are looking to further develop in a more hunting-led environment. This position is well suited to analysts who enjoy thinking like an attacker, have worked alongside or supported red team or purple team activities, and want to deepen their expertise in threat detection and detection engineering. Skills & Experience We're Seeking Experience in threat hunting, cyber threat detection, SOC, blue team, or cyber defence environments, with ideally around five years hands on experience. Strong hands-on experience using SIEM platforms, including: Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security/Kibana (KQL, ESQL) Practical and operational understanding of MITRE ATT&CK, attacker techniques, and adversary tradecraft Experience working with Indicators of Compromise (IOCs) and threat intelligence feeds Solid experience across the security event life cycle, including detection, investigation, and incident management Hands-on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or Carbon Black Strong knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, Firewalls, VPNs, Proxy technologies) Experience analysing telemetry from Windows, Linux, identity, endpoint, and network sources Strong analytical mindset with the ability to clearly communicate findings, impact, and risk Key Responsibilities Conduct proactive threat hunting activities across log, endpoint, and network telemetry to identify suspicious, stealthy, or previously unknown threats Develop and execute hunt hypotheses aligned to MITRE ATT&CK TTPs, adversary behaviours, and emerging threat intelligence Write, refine, and optimise SIEM queries using KQL, SPL, Elastic/ESQL, and Kibana Query Language Perform IOC analysis, enrichment, and validation, integrating internal and external threat intelligence sources Lead investigations from initial detection through scoping, root cause analysis, and impact assessment Support incident management and incident response activities, including containment, remediation, escalation, and lessons learned Collaborate closely with SOC teams, incident responders, red teams, and purple teams to validate detections and improve defensive coverage Contribute to detection logic improvements, use-case development, and continuous enhancement of hunting methodologies Produce clear investigation write-ups, timelines, and recommendations for technical and non-technical stakeholders Security Certifications (Highly Beneficial) SANS/GIAC certifications, including but not limited to: GCIH - Incident Handler GCIA - Intrusion Analyst GCED - Enterprise Defender GCTI - Cyber Threat Intelligence GMON - Continuous Monitoring GDAT - Defending Advanced Threats GCAT - Advanced Threat Intelligence OSCP or equivalent offensive security qualifications Crest certifications, such as: Crest Practitioner Intrusion Analyst (CPIA) Crest Registered Intrusion Analyst (CRIA) Crest Certified Threat Intelligence Analyst (CCTIA) Crest Certified Blue Team Professional (CCBTP) Microsoft SC-200 or related detection and response certifications Other recognised cyber security or threat intelligence credentials
Role: DV-Cleared Cyber Security Analyst / SOC Analyst Salary/Rate: £540-640 per day inside IR35 Location: on site Corsham 5x pw Contract Duration: contract until April 2027 We are currently looking for a Cyber Security Analyst / SOC Analyst for our government client. This Cyber Security Analyst / SOC Analyst role is based fully on site, 5 days per week in Corsham, over 13-hour shifts spanning days and nights, including weekends, 4 on 5 off, then 5 on 4 off. There is no further flexibility with the on-site requirement or office location. Security Clearance: Developed Vetting (DV Clearance) + sole UK national + Sensitive Post Check (which can take 3 months) The contract for this Cyber Security Analyst / SOC Analyst position is until April 2027, with potential to extend, operating inside IR35. This role is inside IR35 - Due to the service of the role, it will now be based on an Umbrella solution. Essential Skills / Experience required: Industry standard SOC Security qualifications (SANS, ISC2, etc.) Proven Tier 2/3 SOC Analyst experience (2 years+) Perform triage of security events ; determine scope, priority and impact, and make recommendations that enable expeditious remediation. Demonstratable experience working with SIEM technology and SIEM engineering (including tool configuration) i.e. ArcSight within an enterprise SOC. Experience in creation of use-cases, analytics and playbooks . An understanding of cloud Conduct real-time management of security incidents from detection to resolution. Technical Knowledge within anti-virus, networking, vulnerability management, encryption, Microsoft technologies, Linux. Knowledge of Information Security standards , legislation and practices, including GDPR & Data Protection Act 2018. Experience in dealing with a wide range of Information Security matters and operating in an ITIL based environment. Strong problem-solving ability, with flexibility to think creatively and adapt to and implement rapidly changing systems and services. Incident management experience and an ability to quickly tailor responses to deal with fast-moving situations. Highly desirable: Degree level qualification; preferably in technical, engineering or computing subject. Lead experience but would take a Tier 2 Analyst. Defence experience Role / Responsibilities: Responsible for supporting information security delivery work, including the development and implementation of Information Security Policies, Standards, processes and guidance. Responsibility for the security of Digital infrastructure by proactively analysing security threats/challenges/risks to the environment, including conducting penetration testing and compliance reviews monitoring of Information Security and information management to ensure compliance including reviewing and monitoring system and network logs for malicious activity or unacceptable use. If you are interested in the above role, please click Apply Now and send a CV for quick review. As a member of the Disability Confident Scheme, Circle and our Client guarantees to interview all candidates who have a disability and who meet all the essential criteria for the vacancy. In cases where we have a high volume of candidates who have a disability who meet all the essential criteria, we will interview the best candidates from within that group. Our client is proud to support the Armed Forces Covenant and as such, they guarantee to interview all veterans, spouses / partners of military personnel who meet all the essential criteria for the vacancy. In cases where they have a high volume of ex-military candidates / military spouses, partners, who meet all of the essential criteria, they will interview the best candidates from within that group. If you qualify, please notify us on igs at circlerecruitment dot com. We will be in touch to discuss your suitability and arrange your guaranteed interview. Should you require reasonable adjustments at any point during the recruitment process, if there is a better way for us to communicate, please do let us know. Circle Recruitment is acting as an Employment Agency in relation to this vacancy. Earn yourself a referral bonus if you refer somebody else who fills the role! We also offer an iPad if you refer a new client to us and we recruit for them. Follow us on Facebook - Circle Recruitment , Twitter and LinkedIn - Circle Recruitment.
May 19, 2026
Contractor
Role: DV-Cleared Cyber Security Analyst / SOC Analyst Salary/Rate: £540-640 per day inside IR35 Location: on site Corsham 5x pw Contract Duration: contract until April 2027 We are currently looking for a Cyber Security Analyst / SOC Analyst for our government client. This Cyber Security Analyst / SOC Analyst role is based fully on site, 5 days per week in Corsham, over 13-hour shifts spanning days and nights, including weekends, 4 on 5 off, then 5 on 4 off. There is no further flexibility with the on-site requirement or office location. Security Clearance: Developed Vetting (DV Clearance) + sole UK national + Sensitive Post Check (which can take 3 months) The contract for this Cyber Security Analyst / SOC Analyst position is until April 2027, with potential to extend, operating inside IR35. This role is inside IR35 - Due to the service of the role, it will now be based on an Umbrella solution. Essential Skills / Experience required: Industry standard SOC Security qualifications (SANS, ISC2, etc.) Proven Tier 2/3 SOC Analyst experience (2 years+) Perform triage of security events ; determine scope, priority and impact, and make recommendations that enable expeditious remediation. Demonstratable experience working with SIEM technology and SIEM engineering (including tool configuration) i.e. ArcSight within an enterprise SOC. Experience in creation of use-cases, analytics and playbooks . An understanding of cloud Conduct real-time management of security incidents from detection to resolution. Technical Knowledge within anti-virus, networking, vulnerability management, encryption, Microsoft technologies, Linux. Knowledge of Information Security standards , legislation and practices, including GDPR & Data Protection Act 2018. Experience in dealing with a wide range of Information Security matters and operating in an ITIL based environment. Strong problem-solving ability, with flexibility to think creatively and adapt to and implement rapidly changing systems and services. Incident management experience and an ability to quickly tailor responses to deal with fast-moving situations. Highly desirable: Degree level qualification; preferably in technical, engineering or computing subject. Lead experience but would take a Tier 2 Analyst. Defence experience Role / Responsibilities: Responsible for supporting information security delivery work, including the development and implementation of Information Security Policies, Standards, processes and guidance. Responsibility for the security of Digital infrastructure by proactively analysing security threats/challenges/risks to the environment, including conducting penetration testing and compliance reviews monitoring of Information Security and information management to ensure compliance including reviewing and monitoring system and network logs for malicious activity or unacceptable use. If you are interested in the above role, please click Apply Now and send a CV for quick review. As a member of the Disability Confident Scheme, Circle and our Client guarantees to interview all candidates who have a disability and who meet all the essential criteria for the vacancy. In cases where we have a high volume of candidates who have a disability who meet all the essential criteria, we will interview the best candidates from within that group. Our client is proud to support the Armed Forces Covenant and as such, they guarantee to interview all veterans, spouses / partners of military personnel who meet all the essential criteria for the vacancy. In cases where they have a high volume of ex-military candidates / military spouses, partners, who meet all of the essential criteria, they will interview the best candidates from within that group. If you qualify, please notify us on igs at circlerecruitment dot com. We will be in touch to discuss your suitability and arrange your guaranteed interview. Should you require reasonable adjustments at any point during the recruitment process, if there is a better way for us to communicate, please do let us know. Circle Recruitment is acting as an Employment Agency in relation to this vacancy. Earn yourself a referral bonus if you refer somebody else who fills the role! We also offer an iPad if you refer a new client to us and we recruit for them. Follow us on Facebook - Circle Recruitment , Twitter and LinkedIn - Circle Recruitment.
CBSbutler Holdings Limited trading as CBSbutler
Hemel Hempstead, Hertfordshire
SOC Engineer +6 months + +DV cleared role + 600 - 700 a day Inside IR35 +On site in Hemel Hempstead Skills: + SIEM / SPLUNK / SOC + DV clearance - must hold current active clearance Join our team as a SOC Engineer and become a critical player in safeguarding organizations through cutting-edge security monitoring and threat detection. In this role, you will lead the design, implementation, and optimization of advanced security tools within a dynamic Security Operations Centre, ensuring our clients' infrastructure remains resilient against emerging cyber threats. This is an exciting opportunity for an experienced cybersecurity professional to shape security strategies, work with innovative technologies, and make a tangible impact in the field of digital protection. Required Skills: Proven experience leading security engineering teams and managing large client engagements Expertise in SIEM platforms, specifically Splunk Enterprise & Enterprise Security and Elastic Stack / Elastic Security Deep knowledge of detection engineering, threat intelligence frameworks (MITRE ATT&CK), and noise reduction techniques Hands-on experience with data ingestion tools such as Elastic Agent, Beats, Splunk UF/HF, Syslog, Kafka Advanced proficiency in querying languages including SPL, KQL, and EQL Strong understanding of ECS and CIM log normalization, enrichment, and large-scale data architectures Expertise in detection rule design, tuning, and lifecycle management Proficiency with automation and orchestration tools, CI/CD pipelines, and Infrastructure as Code (Terraform, Ansible) Excellent stakeholder communication and client management skills Ability to assess risks, evaluate complex information, and communicate effectively at all levels Ready to take your cybersecurity expertise to the next level? Apply now and become a vital part of our mission to defend digital assets with innovative security solutions!
May 11, 2026
Contractor
SOC Engineer +6 months + +DV cleared role + 600 - 700 a day Inside IR35 +On site in Hemel Hempstead Skills: + SIEM / SPLUNK / SOC + DV clearance - must hold current active clearance Join our team as a SOC Engineer and become a critical player in safeguarding organizations through cutting-edge security monitoring and threat detection. In this role, you will lead the design, implementation, and optimization of advanced security tools within a dynamic Security Operations Centre, ensuring our clients' infrastructure remains resilient against emerging cyber threats. This is an exciting opportunity for an experienced cybersecurity professional to shape security strategies, work with innovative technologies, and make a tangible impact in the field of digital protection. Required Skills: Proven experience leading security engineering teams and managing large client engagements Expertise in SIEM platforms, specifically Splunk Enterprise & Enterprise Security and Elastic Stack / Elastic Security Deep knowledge of detection engineering, threat intelligence frameworks (MITRE ATT&CK), and noise reduction techniques Hands-on experience with data ingestion tools such as Elastic Agent, Beats, Splunk UF/HF, Syslog, Kafka Advanced proficiency in querying languages including SPL, KQL, and EQL Strong understanding of ECS and CIM log normalization, enrichment, and large-scale data architectures Expertise in detection rule design, tuning, and lifecycle management Proficiency with automation and orchestration tools, CI/CD pipelines, and Infrastructure as Code (Terraform, Ansible) Excellent stakeholder communication and client management skills Ability to assess risks, evaluate complex information, and communicate effectively at all levels Ready to take your cybersecurity expertise to the next level? Apply now and become a vital part of our mission to defend digital assets with innovative security solutions!
My client seeks to recruit an SC Cleared Crowdstrike Engineer to join the Cyber team, with a primary focus of deploying CrowdStrike across both servers and endpoints.Key activities to include but not limited to: Configuration of Falcon policies, including:- Threat prevention (NGAV)- Detection and response (EDR/XDR)- Sensor management, updates, and grouping policies- Alignment of host groups and policies to organisational requirements.- Integration with identity/directory services for visibility and correlation.- Tuning of detection capabilities, including custom detection logic within agreed capacity.- Integration with SIEM/SOC platforms for alerting, event correlation, and centralised monitoring.- Enablement of response capabilities (host containment, Real Time Response).- Validation, testing, and troubleshooting of deployment and configuration (sample-based and advisory). Skills required: Active SC Clearance or ability to obtain Previous banking / finance experience Proven hands-on experience deploying and engineering CrowdStrike Falcon Strong background in endpoint and server security across enterprise, cloud, and hybrid estates Experience integrating security tooling with SIEM/SOC environments
May 08, 2026
Contractor
My client seeks to recruit an SC Cleared Crowdstrike Engineer to join the Cyber team, with a primary focus of deploying CrowdStrike across both servers and endpoints.Key activities to include but not limited to: Configuration of Falcon policies, including:- Threat prevention (NGAV)- Detection and response (EDR/XDR)- Sensor management, updates, and grouping policies- Alignment of host groups and policies to organisational requirements.- Integration with identity/directory services for visibility and correlation.- Tuning of detection capabilities, including custom detection logic within agreed capacity.- Integration with SIEM/SOC platforms for alerting, event correlation, and centralised monitoring.- Enablement of response capabilities (host containment, Real Time Response).- Validation, testing, and troubleshooting of deployment and configuration (sample-based and advisory). Skills required: Active SC Clearance or ability to obtain Previous banking / finance experience Proven hands-on experience deploying and engineering CrowdStrike Falcon Strong background in endpoint and server security across enterprise, cloud, and hybrid estates Experience integrating security tooling with SIEM/SOC environments
PRINCIPAL CYBERSECURITY ENGINEER SC Cleared - UK Only - (Sponsorship is unavailable) you must hold SC Clearance.Provide expert advice on the defences against cyber threats, data breaches, and emerging risks. This includes offering guidance on the selection, design, justification, implementation, and operational management of cybersecurity strategies, technologies, and standards. Contribute to the development and refinement of controls and processes to ensure the safety, confidentiality, integrity, availability, and overall security of data stored on systems. You will be responsible for identifying gaps in existing cybersecurity policies and procedures and, in collaboration with security, network, information governance, and technical leads, developing new measures to address these gaps. KEY RESPONSIBILITIES: You will work closely with system and service owners, as well as internal and external stakeholders, to design, implement, and enforce appropriate protective and detective security controls, policies, and procedures. The role includes the administration and operational management of security tooling and SIEM platforms, with responsibility for monitoring, detecting, and responding to cyber threats, intrusions, and unauthorised or suspicious activity. This includes Microsoft Sentinel (data and source tuning, creation and maintenance of workbooks and connectors, and threat intelligence review), Microsoft Defender for Endpoint and Defender for Cloud, and Darktrace, including system and model tuning, email module management, and configuration of autonomous response actions. You will be responsible for incident response activities, including triaging security alerts, investigating incidents, coordinating escalation and remediation, and conducting root cause analysis. You must be able to communicate effectively about security incidents and cyber risks to both technical and non-technical stakeholders. The role works closely with the Security Operations Centre (SOC) partner, supporting the assessment and investigation of alerts and contributing to the development and refinement of incident response plans and playbooks. You will support vulnerability management activities, including vulnerability assessments, annual audits, and penetration testing. This includes preparing and presenting incident, threat, and compliance reporting to stakeholders at all levels, including compiling a monthly SIRO report. Continuous improvement is a core responsibility. You will conduct post-incident reviews, recommend control and process improvements, and contribute to the creation and maintenance of cybersecurity governance documentation. You will also research emerging cyber threats and mitigation strategies and provide reports or presentations to senior stakeholders as required. The role supports cybersecurity training and awareness initiatives, promoting a strong security culture and helping to upskill colleagues in cybersecurity best practices. You will also collaborate with solution architects and project teams to ensure security is embedded into system and application designs, supporting secure architecture and delivery from the outset. Compliance & Framework Alignment: Ensure security operations align with regulatory standards and frameworks such as NIST, ISO 27001, and NCSC CAF. Person SpecificationEssential: Demonstrated experience with Microsoft Sentinel, Microsoft Defender for Endpoint/Cloud SIEM tools, threat intelligence platforms, and vulnerability management. Technical experience securing Microsoft Azure and Amazon Web Services cloud environments as well as on-premise/virtual Microsoft technologies. Strong analytical, communication, and problem-solving skills, including the ability to produce clear technical and non-technical reports. Ability to analyse and interpret security events/logs and perform remediation work to address security issues. Desirable: Recognised cybersecurity certifications (e.g., CompTIA Security+, CEH, GIAC, CISSP). Experience with DarkTrace Qualifications Bachelor's degree in Cybersecurity or Computer Science Hays Specialist Recruitment Limited acts as an employment agency for permanent recruitment and employment business for the supply of temporary workers. By applying for this job you accept the T&C's, Privacy Policy and Disclaimers which can be found at hays.co.uk
May 07, 2026
Full time
PRINCIPAL CYBERSECURITY ENGINEER SC Cleared - UK Only - (Sponsorship is unavailable) you must hold SC Clearance.Provide expert advice on the defences against cyber threats, data breaches, and emerging risks. This includes offering guidance on the selection, design, justification, implementation, and operational management of cybersecurity strategies, technologies, and standards. Contribute to the development and refinement of controls and processes to ensure the safety, confidentiality, integrity, availability, and overall security of data stored on systems. You will be responsible for identifying gaps in existing cybersecurity policies and procedures and, in collaboration with security, network, information governance, and technical leads, developing new measures to address these gaps. KEY RESPONSIBILITIES: You will work closely with system and service owners, as well as internal and external stakeholders, to design, implement, and enforce appropriate protective and detective security controls, policies, and procedures. The role includes the administration and operational management of security tooling and SIEM platforms, with responsibility for monitoring, detecting, and responding to cyber threats, intrusions, and unauthorised or suspicious activity. This includes Microsoft Sentinel (data and source tuning, creation and maintenance of workbooks and connectors, and threat intelligence review), Microsoft Defender for Endpoint and Defender for Cloud, and Darktrace, including system and model tuning, email module management, and configuration of autonomous response actions. You will be responsible for incident response activities, including triaging security alerts, investigating incidents, coordinating escalation and remediation, and conducting root cause analysis. You must be able to communicate effectively about security incidents and cyber risks to both technical and non-technical stakeholders. The role works closely with the Security Operations Centre (SOC) partner, supporting the assessment and investigation of alerts and contributing to the development and refinement of incident response plans and playbooks. You will support vulnerability management activities, including vulnerability assessments, annual audits, and penetration testing. This includes preparing and presenting incident, threat, and compliance reporting to stakeholders at all levels, including compiling a monthly SIRO report. Continuous improvement is a core responsibility. You will conduct post-incident reviews, recommend control and process improvements, and contribute to the creation and maintenance of cybersecurity governance documentation. You will also research emerging cyber threats and mitigation strategies and provide reports or presentations to senior stakeholders as required. The role supports cybersecurity training and awareness initiatives, promoting a strong security culture and helping to upskill colleagues in cybersecurity best practices. You will also collaborate with solution architects and project teams to ensure security is embedded into system and application designs, supporting secure architecture and delivery from the outset. Compliance & Framework Alignment: Ensure security operations align with regulatory standards and frameworks such as NIST, ISO 27001, and NCSC CAF. Person SpecificationEssential: Demonstrated experience with Microsoft Sentinel, Microsoft Defender for Endpoint/Cloud SIEM tools, threat intelligence platforms, and vulnerability management. Technical experience securing Microsoft Azure and Amazon Web Services cloud environments as well as on-premise/virtual Microsoft technologies. Strong analytical, communication, and problem-solving skills, including the ability to produce clear technical and non-technical reports. Ability to analyse and interpret security events/logs and perform remediation work to address security issues. Desirable: Recognised cybersecurity certifications (e.g., CompTIA Security+, CEH, GIAC, CISSP). Experience with DarkTrace Qualifications Bachelor's degree in Cybersecurity or Computer Science Hays Specialist Recruitment Limited acts as an employment agency for permanent recruitment and employment business for the supply of temporary workers. By applying for this job you accept the T&C's, Privacy Policy and Disclaimers which can be found at hays.co.uk
Are you a Detection Engineer ready to take on the fight against modern adversaries? Join a well-established SOC working with high-profile Defence clients, where your expertise genuinely matters. In this hands-on technical role, you'll own the end-to-end design, development and maturity of detection logic across SIEM platforms-engineering effective responses to real-world attacker techniques. You'll operate with a high degree of autonomy, acting as a trusted SME across multiple secure environments within a complex MSSP setting. This is a standout opportunity to advance your career at the sharp end of cyber defence. Location: Hybrid working - 2 days per week in our Farnborough office. Security: You must hold or be eligible for SC Clearance. What you'll be doing: ? Design, build, test and continuously refine advanced SIEM detection logic, including rules, correlations and analytics. Research emerging threats, vulnerabilities and adversary TTPs, mapping them to MITRE ATT&CK to close detection and visibility gaps. Tune and validate detections to minimise false positives and deliver high-fidelity alerts for SOC analysts. Act as a technical authority, providing expert guidance to SOC Analysts, Architects and Engineers to strengthen overall detection capability. Define, implement and maintain technical detection standards across environments. Clearly communicate complex technical risks and detection logic to both technical teams and non-technical stakeholders. What you'll bring: Deep SIEM expertise, building advanced detection logic, automation and complex queries in Splunk (SPL) and Microsoft Sentinel (KQL). A proven track record delivering complex detection engineering projects within enterprise or MSSP environments. Strong analytical skills, with the ability to break down sophisticated attacks into actionable detection patterns. Confidence to own technical delivery end-to-end, driving work through to completion with minimal escalation. Expert knowledge of MITRE ATT&CK, with real-world application in detection engineering. A BSc in Computer Science, IT, or a related discipline. Solid scripting skills in Python, PowerShell, or similar, supporting automation and data manipulation. Experience developing detections in QRadar and/or conducting EDR-focused threat hunting (e.g. CrowdStrike, Microsoft Defender for Endpoint). Broad infrastructure awareness across Cloud (Azure/AWS), on-prem, and SaaS / PaaS / IaaS environments. If you are interested in this role but not sure if your skills and experience are exactly what we're looking for, please do apply, we'd love to hear from you! Employment Type: Full-time, Permanent. Location: Hybrid: 2 days per week in Farnborough. Security Clearance Level: SC Cleared or eligible. Internal Recruiter: Jane. Salary: To £65,000. Benefits: 25 days annual leave with the choice to buy additional days, health cash plan, life assurance and pension. Sopra Steria: Our Aerospace, Defence and Security business designs, develops and deploys digital solutions to Central Government clients. The work we do makes a real difference to the client's goal of National Security, and we operate in a unique and privileged environment. We are given time for professional development activities, and we coach and mentor our colleagues, sharing knowledge and learning from each other. We foster a culture in which employees feel valued and supported and have pride in their work for the customer, delivering outstanding rates of customer satisfaction in the UK's most complex safety- and security-critical markets.
May 03, 2026
Full time
Are you a Detection Engineer ready to take on the fight against modern adversaries? Join a well-established SOC working with high-profile Defence clients, where your expertise genuinely matters. In this hands-on technical role, you'll own the end-to-end design, development and maturity of detection logic across SIEM platforms-engineering effective responses to real-world attacker techniques. You'll operate with a high degree of autonomy, acting as a trusted SME across multiple secure environments within a complex MSSP setting. This is a standout opportunity to advance your career at the sharp end of cyber defence. Location: Hybrid working - 2 days per week in our Farnborough office. Security: You must hold or be eligible for SC Clearance. What you'll be doing: ? Design, build, test and continuously refine advanced SIEM detection logic, including rules, correlations and analytics. Research emerging threats, vulnerabilities and adversary TTPs, mapping them to MITRE ATT&CK to close detection and visibility gaps. Tune and validate detections to minimise false positives and deliver high-fidelity alerts for SOC analysts. Act as a technical authority, providing expert guidance to SOC Analysts, Architects and Engineers to strengthen overall detection capability. Define, implement and maintain technical detection standards across environments. Clearly communicate complex technical risks and detection logic to both technical teams and non-technical stakeholders. What you'll bring: Deep SIEM expertise, building advanced detection logic, automation and complex queries in Splunk (SPL) and Microsoft Sentinel (KQL). A proven track record delivering complex detection engineering projects within enterprise or MSSP environments. Strong analytical skills, with the ability to break down sophisticated attacks into actionable detection patterns. Confidence to own technical delivery end-to-end, driving work through to completion with minimal escalation. Expert knowledge of MITRE ATT&CK, with real-world application in detection engineering. A BSc in Computer Science, IT, or a related discipline. Solid scripting skills in Python, PowerShell, or similar, supporting automation and data manipulation. Experience developing detections in QRadar and/or conducting EDR-focused threat hunting (e.g. CrowdStrike, Microsoft Defender for Endpoint). Broad infrastructure awareness across Cloud (Azure/AWS), on-prem, and SaaS / PaaS / IaaS environments. If you are interested in this role but not sure if your skills and experience are exactly what we're looking for, please do apply, we'd love to hear from you! Employment Type: Full-time, Permanent. Location: Hybrid: 2 days per week in Farnborough. Security Clearance Level: SC Cleared or eligible. Internal Recruiter: Jane. Salary: To £65,000. Benefits: 25 days annual leave with the choice to buy additional days, health cash plan, life assurance and pension. Sopra Steria: Our Aerospace, Defence and Security business designs, develops and deploys digital solutions to Central Government clients. The work we do makes a real difference to the client's goal of National Security, and we operate in a unique and privileged environment. We are given time for professional development activities, and we coach and mentor our colleagues, sharing knowledge and learning from each other. We foster a culture in which employees feel valued and supported and have pride in their work for the customer, delivering outstanding rates of customer satisfaction in the UK's most complex safety- and security-critical markets.
Cyber Security Assurance Specialist SC Cleared We're supporting a leading UK research and technology organisation delivering nationally significant programmes, and they're looking for an SC cleared Cyber Security Assurance Specialist to play a key role in securing a complex, hybrid technology estate. The chosen candidate must have capabilites in risk assessments across IT, Cloud and OT environments with exposure to secure cloud or infrastructure design (Azure/M365).This is 8 month rolling contract, paying £407 PD Inside IR 35 to be based in Culham two to three days per week. Key responsibilities include: Conducting risk assessments across IT, cloud and OT environments Reviewing and advising on security architecture & design patterns Owning and maintaining enterprise risk registers Leading technical assurance reviews aligned to GovAssure / CAF / ISO27001 Supporting audit, compliance, and remediation activities Embedding security controls across platforms (Azure, M365, infrastructure) Working closely with engineering, architecture, and delivery teams Key experience: Strong experience in cyber security assurance / risk / governance roles Proven background in secure cloud or infrastructure design (Azure/M365) Experience with risk frameworks (ISO 31000, NIST, OWASP etc.) Knowledge of GovAssure, CAF, ISO27001, Cyber Essentials Entra ID / Azure / M365 SIEM / EDR / vulnerability management tools Access control models (RBAC/ABAC) Experience supporting audits, assurance reviews, and remediation plans Ability to translate technical risk into clear business language SC cleared, one stage, must be commutable from Cluham.
May 03, 2026
Contractor
Cyber Security Assurance Specialist SC Cleared We're supporting a leading UK research and technology organisation delivering nationally significant programmes, and they're looking for an SC cleared Cyber Security Assurance Specialist to play a key role in securing a complex, hybrid technology estate. The chosen candidate must have capabilites in risk assessments across IT, Cloud and OT environments with exposure to secure cloud or infrastructure design (Azure/M365).This is 8 month rolling contract, paying £407 PD Inside IR 35 to be based in Culham two to three days per week. Key responsibilities include: Conducting risk assessments across IT, cloud and OT environments Reviewing and advising on security architecture & design patterns Owning and maintaining enterprise risk registers Leading technical assurance reviews aligned to GovAssure / CAF / ISO27001 Supporting audit, compliance, and remediation activities Embedding security controls across platforms (Azure, M365, infrastructure) Working closely with engineering, architecture, and delivery teams Key experience: Strong experience in cyber security assurance / risk / governance roles Proven background in secure cloud or infrastructure design (Azure/M365) Experience with risk frameworks (ISO 31000, NIST, OWASP etc.) Knowledge of GovAssure, CAF, ISO27001, Cyber Essentials Entra ID / Azure / M365 SIEM / EDR / vulnerability management tools Access control models (RBAC/ABAC) Experience supporting audits, assurance reviews, and remediation plans Ability to translate technical risk into clear business language SC cleared, one stage, must be commutable from Cluham.
We are looking for a Managing Security Engineer to lead the design, implementation and documentation of enterprise security monitoring platforms. This is a key technical leadership role, responsible for ensuring the right tooling, controls and processes are in place to help protect and monitor our clients' environments. This opportunity is ideally suited to someone with strong hands-on experience deploying and managing Splunk at enterprise scale. In return, the role offers the chance to broaden your capability and gain deeper experience in Elastic Security, with support to build your expertise further. You will work closely with cross-functional teams to assess risk, design effective security controls and define testing requirements. You will champion security by design, promote engineering excellence and act as a trusted advisor to clients, helping them understand their security challenges and implement practical, effective solutions to strengthen their security posture. This is an excellent opportunity to deepen your hands-on cybersecurity expertise while making a meaningful impact across both client and organisational security. This role is permanent and requires full-time, on-site working in Hemel Hempstead. The successful candidate may also participate in an out-of-hours call-out rota. What you will be doing: Lead the deployment, management and optimisation of Splunk Enterprise and Splunk ES platforms in large, complex environments. Support and develop capability in Elastic Stack / Elastic Security, with training and upskilling provided as needed. Design, implement and maintain data pipelines, including log ingestion, enrichment and schema standardisation. Develop and tune security detection content, translating threat intelligence and TTPs aligned to MITRE ATT&CK into actionable, high-value alerts. Manage the full detection content lifecycle: design, test, deploy, monitor, tune and retire, using version control and rollback processes. Automate workflows and platform configurations using CI/CD, SOAR, scripting and Infrastructure as Code tools such as Terraform and Ansible. Ensure platform performance, stability and resilience through capacity planning, high availability, disaster recovery and proactive monitoring. Provide technical leadership and guidance to internal teams and clients on security monitoring strategy and best practice. What you will bring: Proven experience deploying and managing Splunk at enterprise scale. Strong hands-on knowledge of SIEM engineering, including indexing, parsing, onboarding and performance tuning. Experience designing and optimising detection content, including MITRE ATT&CK-aligned use cases and alert tuning to reduce noise. Good understanding of data pipeline engineering, log enrichment, data quality and large-scale ingestion architectures. Strong knowledge of SPL; experience with KQL and EQL would be beneficial, but is not essential. Experience with automation and Infrastructure-as-Code within security monitoring or SIEM environments. Solid understanding of SIEM platform operations, including clustering, scaling, high availability, disaster recovery and performance optimisation. Strong problem-solving skills and a proactive approach to improving security operations. An interest in developing expertise in Elastic Security, with support and training available as part of the role. If you are interested in this role but not sure if your skills and experience are exactly what we're looking for, please do apply, we'd love to hear from you! Employment Type: Full Time, Permanent Location: Hemel Hempstead Security Clearance Level: DV Cleared Internal Recruiter: Jane Salary: from £DOE Benefits: £5400 Car Allowance, 25 days annual leave with the option to buy additional days, private health care, life assurance, pension, and generous flexible benefits fund Loved reading about this job and want to know more about us? Sopra Steria's Aerospace, Defence and Security business designs, develops and deploys digital solutions to Central Government clients. The work we do makes a real difference to the client's goal of National Security, and we operate in a unique and privileged environment. We are given time for professional development activities, and we coach and mentor our colleagues, sharing knowledge and learning from each other. We foster a culture in which employees feel valued and supported and have pride in their work for the customer, delivering outstanding rates of customer satisfaction in the UK's most complex safety- and security-critical markets.
May 03, 2026
Full time
We are looking for a Managing Security Engineer to lead the design, implementation and documentation of enterprise security monitoring platforms. This is a key technical leadership role, responsible for ensuring the right tooling, controls and processes are in place to help protect and monitor our clients' environments. This opportunity is ideally suited to someone with strong hands-on experience deploying and managing Splunk at enterprise scale. In return, the role offers the chance to broaden your capability and gain deeper experience in Elastic Security, with support to build your expertise further. You will work closely with cross-functional teams to assess risk, design effective security controls and define testing requirements. You will champion security by design, promote engineering excellence and act as a trusted advisor to clients, helping them understand their security challenges and implement practical, effective solutions to strengthen their security posture. This is an excellent opportunity to deepen your hands-on cybersecurity expertise while making a meaningful impact across both client and organisational security. This role is permanent and requires full-time, on-site working in Hemel Hempstead. The successful candidate may also participate in an out-of-hours call-out rota. What you will be doing: Lead the deployment, management and optimisation of Splunk Enterprise and Splunk ES platforms in large, complex environments. Support and develop capability in Elastic Stack / Elastic Security, with training and upskilling provided as needed. Design, implement and maintain data pipelines, including log ingestion, enrichment and schema standardisation. Develop and tune security detection content, translating threat intelligence and TTPs aligned to MITRE ATT&CK into actionable, high-value alerts. Manage the full detection content lifecycle: design, test, deploy, monitor, tune and retire, using version control and rollback processes. Automate workflows and platform configurations using CI/CD, SOAR, scripting and Infrastructure as Code tools such as Terraform and Ansible. Ensure platform performance, stability and resilience through capacity planning, high availability, disaster recovery and proactive monitoring. Provide technical leadership and guidance to internal teams and clients on security monitoring strategy and best practice. What you will bring: Proven experience deploying and managing Splunk at enterprise scale. Strong hands-on knowledge of SIEM engineering, including indexing, parsing, onboarding and performance tuning. Experience designing and optimising detection content, including MITRE ATT&CK-aligned use cases and alert tuning to reduce noise. Good understanding of data pipeline engineering, log enrichment, data quality and large-scale ingestion architectures. Strong knowledge of SPL; experience with KQL and EQL would be beneficial, but is not essential. Experience with automation and Infrastructure-as-Code within security monitoring or SIEM environments. Solid understanding of SIEM platform operations, including clustering, scaling, high availability, disaster recovery and performance optimisation. Strong problem-solving skills and a proactive approach to improving security operations. An interest in developing expertise in Elastic Security, with support and training available as part of the role. If you are interested in this role but not sure if your skills and experience are exactly what we're looking for, please do apply, we'd love to hear from you! Employment Type: Full Time, Permanent Location: Hemel Hempstead Security Clearance Level: DV Cleared Internal Recruiter: Jane Salary: from £DOE Benefits: £5400 Car Allowance, 25 days annual leave with the option to buy additional days, private health care, life assurance, pension, and generous flexible benefits fund Loved reading about this job and want to know more about us? Sopra Steria's Aerospace, Defence and Security business designs, develops and deploys digital solutions to Central Government clients. The work we do makes a real difference to the client's goal of National Security, and we operate in a unique and privileged environment. We are given time for professional development activities, and we coach and mentor our colleagues, sharing knowledge and learning from each other. We foster a culture in which employees feel valued and supported and have pride in their work for the customer, delivering outstanding rates of customer satisfaction in the UK's most complex safety- and security-critical markets.
CBSbutler Holdings Limited trading as CBSbutler
Hemel Hempstead, Hertfordshire
Managing Security Engineer (DV Cleared) Hemel Hempstead - 5 days onsite 500- 700 per day Inside IR35 We're seeking a DV-cleared Managing Security Engineer to lead the design, implementation, and optimisation of security monitoring platforms feeding into a central SOC. This is a hands-on leadership role focused on building scalable SIEM solutions and strengthening client security posture. Key Responsibilities Lead design and deployment of security monitoring tools (Elastic & Splunk) Build and optimise large-scale log ingestion pipelines and data models (ECS/CIM) Develop and tune detection rules using KQL, EQL, and SPL Drive detection engineering lifecycle aligned to MITRE ATT&CK Implement automation, CI/CD, and Infrastructure as Code for SIEM platforms Ensure platform performance, scalability, and resilience (HA/DR, clustering) Collaborate with stakeholders to assess risk and deliver security improvements Essential Skills & Experience Proven leadership in Security Engineering and client-facing environments Strong hands-on expertise with Elastic Stack and Splunk (Enterprise/ES) Advanced knowledge of SIEM operations, detection engineering, and RBA Experience with large-scale data ingestion, enrichment, and pipeline design Familiarity with automation tools, SOAR, Terraform/Ansible, and CI/CD Excellent communication, stakeholder management, and problem-solving skills This is a great opportunity to play a key role in delivering high-impact cybersecurity solutions while remaining technically hands-on. If this role is of interest, apply now!
Apr 30, 2026
Contractor
Managing Security Engineer (DV Cleared) Hemel Hempstead - 5 days onsite 500- 700 per day Inside IR35 We're seeking a DV-cleared Managing Security Engineer to lead the design, implementation, and optimisation of security monitoring platforms feeding into a central SOC. This is a hands-on leadership role focused on building scalable SIEM solutions and strengthening client security posture. Key Responsibilities Lead design and deployment of security monitoring tools (Elastic & Splunk) Build and optimise large-scale log ingestion pipelines and data models (ECS/CIM) Develop and tune detection rules using KQL, EQL, and SPL Drive detection engineering lifecycle aligned to MITRE ATT&CK Implement automation, CI/CD, and Infrastructure as Code for SIEM platforms Ensure platform performance, scalability, and resilience (HA/DR, clustering) Collaborate with stakeholders to assess risk and deliver security improvements Essential Skills & Experience Proven leadership in Security Engineering and client-facing environments Strong hands-on expertise with Elastic Stack and Splunk (Enterprise/ES) Advanced knowledge of SIEM operations, detection engineering, and RBA Experience with large-scale data ingestion, enrichment, and pipeline design Familiarity with automation tools, SOAR, Terraform/Ansible, and CI/CD Excellent communication, stakeholder management, and problem-solving skills This is a great opportunity to play a key role in delivering high-impact cybersecurity solutions while remaining technically hands-on. If this role is of interest, apply now!
SOC / Cyber Threat Detection Analyst - SANS/GIAC Cyber Threat Detection Analyst Location: Wokingham, Berkshire (On-site) Salary: Competitive (dependent on experience) + excellent benefits & training Security Clearance: Ideally SC Cleared or eligible for SC Role Overview As a Cyber Threat Detection Analyst, you will play a hands-on role within an advanced cyber defence function, focused on proactive threat hunting, adversary behaviour analysis, and high-fidelity threat detection across enterprise environments. This role goes beyond reactive alert handling. You will actively hunt for malicious activity using telemetry, SIEM data, and threat intelligence, develop hypotheses based on MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs), and support incident management and response activities when threats are identified. We are open to experienced SOC Analysts where threat hunting, investigations, and proactive detection have formed a significant part of their role, and who are looking to further develop in a more hunting-led environment. This position is well suited to analysts who enjoy thinking like an attacker, have worked alongside or supported red team or purple team activities, and want to deepen their expertise in threat detection and detection engineering. Skills & Experience We're Seeking Experience in threat hunting, cyber threat detection, SOC, blue team, or cyber defence environments, with ideally around five years hands on experience. Strong hands-on experience using SIEM platforms, including: Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security/Kibana (KQL, ESQL) Practical and operational understanding of MITRE ATT&CK, attacker techniques, and adversary tradecraft Experience working with Indicators of Compromise (IOCs) and threat intelligence feeds Solid experience across the security event life cycle, including detection, investigation, and incident management Hands-on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or Carbon Black Strong knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, Firewalls, VPNs, Proxy technologies) Experience analysing telemetry from Windows, Linux, identity, endpoint, and network sources Strong analytical mindset with the ability to clearly communicate findings, impact, and risk Key Responsibilities Conduct proactive threat hunting activities across log, endpoint, and network telemetry to identify suspicious, stealthy, or previously unknown threats Develop and execute hunt hypotheses aligned to MITRE ATT&CK TTPs, adversary behaviours, and emerging threat intelligence Write, refine, and optimise SIEM queries using KQL, SPL, Elastic/ESQL, and Kibana Query Language Perform IOC analysis, enrichment, and validation, integrating internal and external threat intelligence sources Lead investigations from initial detection through scoping, root cause analysis, and impact assessment Support incident management and incident response activities, including containment, remediation, escalation, and lessons learned Collaborate closely with SOC teams, incident responders, red teams, and purple teams to validate detections and improve defensive coverage Contribute to detection logic improvements, use-case development, and continuous enhancement of hunting methodologies Produce clear investigation write-ups, timelines, and recommendations for technical and non-technical stakeholders Security Certifications (Highly Beneficial) SANS/GIAC certifications, including but not limited to: GCIH - Incident Handler GCIA - Intrusion Analyst GCED - Enterprise Defender GCTI - Cyber Threat Intelligence GMON - Continuous Monitoring GDAT - Defending Advanced Threats GCAT - Advanced Threat Intelligence OSCP or equivalent offensive security qualifications Crest certifications, such as: Crest Practitioner Intrusion Analyst (CPIA) Crest Registered Intrusion Analyst (CRIA) Crest Certified Threat Intelligence Analyst (CCTIA) Crest Certified Blue Team Professional (CCBTP) Microsoft SC-200 or related detection and response certifications Other recognised cyber security or threat intelligence credentials
Apr 30, 2026
Full time
SOC / Cyber Threat Detection Analyst - SANS/GIAC Cyber Threat Detection Analyst Location: Wokingham, Berkshire (On-site) Salary: Competitive (dependent on experience) + excellent benefits & training Security Clearance: Ideally SC Cleared or eligible for SC Role Overview As a Cyber Threat Detection Analyst, you will play a hands-on role within an advanced cyber defence function, focused on proactive threat hunting, adversary behaviour analysis, and high-fidelity threat detection across enterprise environments. This role goes beyond reactive alert handling. You will actively hunt for malicious activity using telemetry, SIEM data, and threat intelligence, develop hypotheses based on MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs), and support incident management and response activities when threats are identified. We are open to experienced SOC Analysts where threat hunting, investigations, and proactive detection have formed a significant part of their role, and who are looking to further develop in a more hunting-led environment. This position is well suited to analysts who enjoy thinking like an attacker, have worked alongside or supported red team or purple team activities, and want to deepen their expertise in threat detection and detection engineering. Skills & Experience We're Seeking Experience in threat hunting, cyber threat detection, SOC, blue team, or cyber defence environments, with ideally around five years hands on experience. Strong hands-on experience using SIEM platforms, including: Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security/Kibana (KQL, ESQL) Practical and operational understanding of MITRE ATT&CK, attacker techniques, and adversary tradecraft Experience working with Indicators of Compromise (IOCs) and threat intelligence feeds Solid experience across the security event life cycle, including detection, investigation, and incident management Hands-on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or Carbon Black Strong knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, Firewalls, VPNs, Proxy technologies) Experience analysing telemetry from Windows, Linux, identity, endpoint, and network sources Strong analytical mindset with the ability to clearly communicate findings, impact, and risk Key Responsibilities Conduct proactive threat hunting activities across log, endpoint, and network telemetry to identify suspicious, stealthy, or previously unknown threats Develop and execute hunt hypotheses aligned to MITRE ATT&CK TTPs, adversary behaviours, and emerging threat intelligence Write, refine, and optimise SIEM queries using KQL, SPL, Elastic/ESQL, and Kibana Query Language Perform IOC analysis, enrichment, and validation, integrating internal and external threat intelligence sources Lead investigations from initial detection through scoping, root cause analysis, and impact assessment Support incident management and incident response activities, including containment, remediation, escalation, and lessons learned Collaborate closely with SOC teams, incident responders, red teams, and purple teams to validate detections and improve defensive coverage Contribute to detection logic improvements, use-case development, and continuous enhancement of hunting methodologies Produce clear investigation write-ups, timelines, and recommendations for technical and non-technical stakeholders Security Certifications (Highly Beneficial) SANS/GIAC certifications, including but not limited to: GCIH - Incident Handler GCIA - Intrusion Analyst GCED - Enterprise Defender GCTI - Cyber Threat Intelligence GMON - Continuous Monitoring GDAT - Defending Advanced Threats GCAT - Advanced Threat Intelligence OSCP or equivalent offensive security qualifications Crest certifications, such as: Crest Practitioner Intrusion Analyst (CPIA) Crest Registered Intrusion Analyst (CRIA) Crest Certified Threat Intelligence Analyst (CCTIA) Crest Certified Blue Team Professional (CCBTP) Microsoft SC-200 or related detection and response certifications Other recognised cyber security or threat intelligence credentials
SOC / Cyber Threat Detection Analyst - SANS/GIAC Cyber Threat Detection Analyst Location: Wokingham, Berkshire (On-site) Salary: Competitive (dependent on experience) + excellent benefits & training Security Clearance: Ideally SC Cleared or eligible for SC Role Overview As a Cyber Threat Detection Analyst, you will play a hands-on role within an advanced cyber defence function, focused on proactive threat hunting, adversary behaviour analysis, and high-fidelity threat detection across enterprise environments. This role goes beyond reactive alert handling. You will actively hunt for malicious activity using telemetry, SIEM data, and threat intelligence, develop hypotheses based on MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs), and support incident management and response activities when threats are identified. We are open to experienced SOC Analysts where threat hunting, investigations, and proactive detection have formed a significant part of their role, and who are looking to further develop in a more hunting-led environment. This position is well suited to analysts who enjoy thinking like an attacker, have worked alongside or supported red team or purple team activities, and want to deepen their expertise in threat detection and detection engineering. Skills & Experience We're Seeking Experience in threat hunting, cyber threat detection, SOC, blue team, or cyber defence environments, with ideally around five years hands on experience. Strong hands-on experience using SIEM platforms, including: Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security/Kibana (KQL, ESQL) Practical and operational understanding of MITRE ATT&CK, attacker techniques, and adversary tradecraft Experience working with Indicators of Compromise (IOCs) and threat intelligence feeds Solid experience across the security event life cycle, including detection, investigation, and incident management Hands-on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or Carbon Black Strong knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, Firewalls, VPNs, Proxy technologies) Experience analysing telemetry from Windows, Linux, identity, endpoint, and network sources Strong analytical mindset with the ability to clearly communicate findings, impact, and risk Key Responsibilities Conduct proactive threat hunting activities across log, endpoint, and network telemetry to identify suspicious, stealthy, or previously unknown threats Develop and execute hunt hypotheses aligned to MITRE ATT&CK TTPs, adversary behaviours, and emerging threat intelligence Write, refine, and optimise SIEM queries using KQL, SPL, Elastic/ESQL, and Kibana Query Language Perform IOC analysis, enrichment, and validation, integrating internal and external threat intelligence sources Lead investigations from initial detection through scoping, root cause analysis, and impact assessment Support incident management and incident response activities, including containment, remediation, escalation, and lessons learned Collaborate closely with SOC teams, incident responders, red teams, and purple teams to validate detections and improve defensive coverage Contribute to detection logic improvements, use-case development, and continuous enhancement of hunting methodologies Produce clear investigation write-ups, timelines, and recommendations for technical and non-technical stakeholders Security Certifications (Highly Beneficial) SANS/GIAC certifications, including but not limited to: GCIH - Incident Handler GCIA - Intrusion Analyst GCED - Enterprise Defender GCTI - Cyber Threat Intelligence GMON - Continuous Monitoring GDAT - Defending Advanced Threats GCAT - Advanced Threat Intelligence OSCP or equivalent offensive security qualifications Crest certifications, such as: Crest Practitioner Intrusion Analyst (CPIA) Crest Registered Intrusion Analyst (CRIA) Crest Certified Threat Intelligence Analyst (CCTIA) Crest Certified Blue Team Professional (CCBTP) Microsoft SC-200 or related detection and response certifications Other recognised cyber security or threat intelligence credentials
Apr 30, 2026
Full time
SOC / Cyber Threat Detection Analyst - SANS/GIAC Cyber Threat Detection Analyst Location: Wokingham, Berkshire (On-site) Salary: Competitive (dependent on experience) + excellent benefits & training Security Clearance: Ideally SC Cleared or eligible for SC Role Overview As a Cyber Threat Detection Analyst, you will play a hands-on role within an advanced cyber defence function, focused on proactive threat hunting, adversary behaviour analysis, and high-fidelity threat detection across enterprise environments. This role goes beyond reactive alert handling. You will actively hunt for malicious activity using telemetry, SIEM data, and threat intelligence, develop hypotheses based on MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs), and support incident management and response activities when threats are identified. We are open to experienced SOC Analysts where threat hunting, investigations, and proactive detection have formed a significant part of their role, and who are looking to further develop in a more hunting-led environment. This position is well suited to analysts who enjoy thinking like an attacker, have worked alongside or supported red team or purple team activities, and want to deepen their expertise in threat detection and detection engineering. Skills & Experience We're Seeking Experience in threat hunting, cyber threat detection, SOC, blue team, or cyber defence environments, with ideally around five years hands on experience. Strong hands-on experience using SIEM platforms, including: Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security/Kibana (KQL, ESQL) Practical and operational understanding of MITRE ATT&CK, attacker techniques, and adversary tradecraft Experience working with Indicators of Compromise (IOCs) and threat intelligence feeds Solid experience across the security event life cycle, including detection, investigation, and incident management Hands-on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or Carbon Black Strong knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, Firewalls, VPNs, Proxy technologies) Experience analysing telemetry from Windows, Linux, identity, endpoint, and network sources Strong analytical mindset with the ability to clearly communicate findings, impact, and risk Key Responsibilities Conduct proactive threat hunting activities across log, endpoint, and network telemetry to identify suspicious, stealthy, or previously unknown threats Develop and execute hunt hypotheses aligned to MITRE ATT&CK TTPs, adversary behaviours, and emerging threat intelligence Write, refine, and optimise SIEM queries using KQL, SPL, Elastic/ESQL, and Kibana Query Language Perform IOC analysis, enrichment, and validation, integrating internal and external threat intelligence sources Lead investigations from initial detection through scoping, root cause analysis, and impact assessment Support incident management and incident response activities, including containment, remediation, escalation, and lessons learned Collaborate closely with SOC teams, incident responders, red teams, and purple teams to validate detections and improve defensive coverage Contribute to detection logic improvements, use-case development, and continuous enhancement of hunting methodologies Produce clear investigation write-ups, timelines, and recommendations for technical and non-technical stakeholders Security Certifications (Highly Beneficial) SANS/GIAC certifications, including but not limited to: GCIH - Incident Handler GCIA - Intrusion Analyst GCED - Enterprise Defender GCTI - Cyber Threat Intelligence GMON - Continuous Monitoring GDAT - Defending Advanced Threats GCAT - Advanced Threat Intelligence OSCP or equivalent offensive security qualifications Crest certifications, such as: Crest Practitioner Intrusion Analyst (CPIA) Crest Registered Intrusion Analyst (CRIA) Crest Certified Threat Intelligence Analyst (CCTIA) Crest Certified Blue Team Professional (CCBTP) Microsoft SC-200 or related detection and response certifications Other recognised cyber security or threat intelligence credentials
