Job Search

We are seeking an experienced Cyber Fusion CSIRT Lead to direct the organisation’s cyber incident response capability and coordinate the effective detection, investigation, containment, and remediation of security threats. You will lead a team of incident responders and work closely with security operations, threat intelligence, digital forensics, vulnerability management, infrastructure, legal, risk, and business stakeholders. The role requires calm, decisive leadership during high-impact incidents and the ability to translate complex technical issues into clear advice for senior decision-makers.

Responsibilities will include defining and continuously improving incident response processes, playbooks, escalation procedures, and communication plans; leading the triage and management of suspected and confirmed cyber incidents; coordinating forensic investigations and root-cause analysis; and ensuring timely recovery and lessons learned. You will oversee the development of proactive threat-hunting and intelligence-led response activities, assess emerging threats, and help strengthen detection and response capabilities across the environment. The role will also involve managing incident reporting, metrics, post-incident reviews, regulatory or contractual notifications where required, and relationships with external partners, law enforcement, and specialist providers.

Applicants should have substantial experience in cyber incident response, CSIRT, SOC, digital forensics, or a closely related discipline, including demonstrable experience leading major or complex security incidents. Strong knowledge of attack techniques, incident-handling frameworks, threat intelligence, endpoint and network investigations, cloud security, and security monitoring technologies is essential. Experience developing operational processes and mentoring technical teams is highly desirable. Relevant professional certifications, such as CISSP, CISM, GIAC, or equivalent, would be advantageous. You will need excellent communication, prioritisation, and stakeholder-management skills, a structured approach to problem-solving, and the resilience to operate effectively in a fast-paced environment, including participation in an out-of-hours incident escalation rota.

We are seeking an experienced Incident Response Consultant to help organisations prepare for, respond to, and recover from complex cybersecurity incidents. In this role, you will work with clients across a range of industries to investigate security events, contain threats, minimise business impact, and support effective recovery. You will contribute to incident response engagements from initial triage through to post-incident review, providing clear technical guidance and practical recommendations throughout.

Your responsibilities will include monitoring and analysing alerts, conducting digital forensics, identifying attack vectors, and assessing the scope and impact of compromises. You will lead or support incident response activities involving malware, ransomware, phishing, unauthorised access, data loss, and insider threats. The role will also involve developing and testing incident response plans, conducting tabletop exercises, creating investigation timelines, preserving evidence, and preparing detailed reports for both technical and non-technical audiences. You will collaborate with internal security teams, legal advisers, risk specialists, and senior stakeholders during high-pressure situations, ensuring that communication remains accurate, timely, and appropriately documented.

Applicants should have professional experience in incident response, security operations, digital forensics, or a closely related discipline. Strong knowledge of common attack techniques, threat intelligence, log analysis, network traffic, endpoint investigation, and security tools is essential. Experience with frameworks such as MITRE ATT&CK, NIST, or ISO 27001 would be advantageous, as would relevant certifications such as GIAC, CISSP, or equivalent qualifications. You should be analytical, calm under pressure, and confident making decisions in rapidly changing circumstances. Excellent written and verbal communication skills are required, along with the ability to explain complex findings clearly and work effectively with diverse stakeholders. A willingness to participate in an on-call rota and travel occasionally to client sites may also be required.

We are seeking a Cyber Fusion CSIRT Lead to direct and strengthen incident response, cyber threat intelligence and security operations across a complex technology environment. This role will lead the coordination of responses to significant cyber incidents, ensuring that threats are identified, contained, investigated and resolved efficiently. You will act as a senior point of contact during critical events, providing clear updates to technical teams, leadership and relevant stakeholders while maintaining a calm, structured and evidence-led approach.

Key responsibilities include managing and mentoring a team of incident responders and cyber analysts; developing and maintaining CSIRT processes, playbooks and operating procedures; coordinating investigations into malware, ransomware, phishing, data loss, insider threats and other security events; and overseeing the collection, preservation and analysis of forensic evidence. You will work closely with security operations, infrastructure, application, risk, legal and compliance teams to improve detection and response capabilities. The role will also contribute to threat hunting, intelligence-led defence, vulnerability prioritisation, crisis exercises, post-incident reviews and the continuous improvement of security controls. You will establish meaningful performance metrics, identify recurring attack patterns and ensure lessons learned are converted into practical actions.

The successful candidate will bring substantial experience in cyber incident response, digital forensics, threat intelligence or security operations, including experience leading responses to high-impact incidents. Strong knowledge of incident management frameworks, attack techniques, malware analysis, network and endpoint security, cloud environments and security monitoring technologies is required. Experience with SIEM, EDR, SOAR and threat intelligence platforms, along with familiarity with recognised frameworks such as NIST or MITRE ATT&CK, would be highly beneficial. Professional certifications in cybersecurity, incident handling or digital forensics are desirable. You will need excellent communication and stakeholder-management skills, sound judgement under pressure, strong analytical capability and the ability to translate complex technical issues into clear recommendations. This role may require participation in an on-call or out-of-hours incident response rota.

We are seeking an Incident Response Investigator to identify, assess and manage security incidents across a complex technology environment. The successful candidate will investigate suspected cyber attacks, policy violations, data breaches and other security events, working methodically to establish the facts, determine impact and support timely resolution. You will monitor alerts and intelligence sources, conduct triage, preserve evidence and maintain accurate, auditable incident records from initial detection through closure.

Key responsibilities include analysing logs, endpoint activity, network traffic, email artefacts and cloud data to identify indicators of compromise and reconstruct attack timelines. You will coordinate containment, eradication and recovery activities with technical teams, while escalating critical incidents in line with agreed procedures. The role will involve preparing clear investigation reports, documenting root causes, recommending corrective actions and contributing to post-incident reviews. You will also help improve playbooks, detection rules and response processes, support threat-hunting initiatives and provide practical guidance to colleagues on incident handling and information security risks.

Applicants should have proven experience in cyber incident response, digital investigations, security operations or a closely related discipline. Strong knowledge of investigation techniques, security monitoring, common attack methods and relevant frameworks such as NIST or MITRE ATT&CK is expected. Experience with SIEM, EDR, forensic or cloud security tools, together with the ability to interpret technical evidence, is highly desirable. You should be comfortable working under pressure, managing multiple investigations and communicating complex findings to both technical and non-technical audiences. A structured, analytical approach, sound judgement, attention to detail and a commitment to confidentiality are essential. Relevant professional certifications or equivalent practical experience will be advantageous.

We are seeking an Incident Response Analyst to help protect critical systems, applications, and data from cyber threats. In this role, you will monitor, investigate, and respond to security incidents across a diverse technology environment. You will analyse alerts from security monitoring tools, validate potential threats, determine scope and impact, and coordinate timely containment and remediation activities. The position requires sound technical judgement, strong attention to detail, and the ability to remain effective during high-priority incidents.

Key responsibilities include triaging and investigating alerts, conducting endpoint, network, identity, and cloud-based analysis, and developing incident timelines using relevant logs and forensic evidence. You will support malware and phishing investigations, identify indicators of compromise, recommend and implement containment actions, and assist with eradication and recovery efforts. You will also create clear incident reports, maintain accurate case documentation, contribute to post-incident reviews, and recommend improvements to security controls and response procedures. The role may involve participation in an on-call rota and collaboration with infrastructure, application, risk, privacy, and business teams.

The successful candidate will have experience in cybersecurity operations, incident response, security monitoring, or a related technical discipline. You should be familiar with SIEM, endpoint detection and response, network security, threat intelligence, vulnerability management, and common forensic techniques. Working knowledge of attack frameworks such as MITRE ATT&CK, incident handling methodologies, and relevant security standards is desirable. Professional certifications in incident response, digital forensics, or information security are advantageous. Strong analytical, written, and verbal communication skills are essential, along with the ability to prioritise competing demands, explain technical issues to non-specialist audiences, and continuously improve response capabilities.

We are seeking a Senior Incident Responder to lead the identification, investigation, containment and resolution of complex cybersecurity incidents across a diverse technology environment. You will act as a senior point of escalation during high-impact events, coordinating technical response activities while ensuring that risks to systems, data and business operations are rapidly assessed and controlled. The role will involve working closely with security operations, infrastructure, cloud, application, legal, compliance and business stakeholders to deliver a coordinated and effective response.

Key responsibilities include triaging and investigating alerts, conducting host and network-based analysis, developing incident timelines, preserving and analysing digital evidence, and identifying indicators of compromise. You will lead containment, eradication and recovery activities, support threat hunting and contribute to detection engineering by translating incident findings into improved monitoring and response capabilities. You will also manage incident communications, provide clear updates to senior stakeholders, maintain accurate case records and produce detailed post-incident reports. A key part of the role will be identifying root causes, tracking remedial actions and helping strengthen incident response playbooks, procedures and operational resilience. You may also support exercises, vulnerability investigations, forensic reviews and the mentoring of less experienced responders.

Applicants should have significant experience in cybersecurity incident response, digital forensics, security operations or a closely related discipline, with a strong understanding of attack techniques, intrusion lifecycles and security frameworks. Practical experience with SIEM, endpoint detection and response, network monitoring, cloud security and forensic analysis tools is essential. You should be confident analysing logs and telemetry, writing scripts to support investigations, and making sound decisions under pressure. Strong written and verbal communication skills are required, together with the ability to explain technical risks to both technical and non-technical audiences. Relevant professional certifications in incident response, forensics, cloud security or information security are advantageous. The successful candidate will demonstrate sound judgement, curiosity, discretion and a commitment to continuous improvement.

We are seeking a Security Engineer, Incident Response to help protect critical systems, applications, and data from evolving cyber threats. In this role, you will investigate security alerts and incidents, coordinate effective containment and remediation, and help strengthen the organisation’s overall detection and response capabilities. You will work closely with security operations, infrastructure, engineering, application, and business teams to manage incidents from initial triage through recovery and post-incident review.

Your responsibilities will include monitoring and analysing alerts from endpoint, network, identity, cloud, and application security tools; conducting forensic investigations; identifying attack techniques, indicators of compromise, and root causes; and maintaining clear, timely incident documentation. You will develop and improve playbooks, procedures, and automation to increase response speed and consistency. The role will also involve supporting threat hunting, vulnerability remediation, security control validation, tabletop exercises, and lessons-learned activities. You may participate in an on-call rotation and provide clear updates to technical and non-technical stakeholders during high-impact events.

The successful candidate will have professional experience in incident response, security operations, digital forensics, or a closely related discipline, along with a strong understanding of common attack methods, intrusion analysis, and incident lifecycle management. Experience with SIEM, EDR, cloud security, identity platforms, network analysis, scripting, and security automation is highly desirable. You should be comfortable analysing complex technical information, making sound decisions under pressure, and communicating clearly in writing and verbally. Familiarity with frameworks such as MITRE ATT&CK, NIST, or CIS is beneficial. Relevant certifications in security, incident response, cloud, or digital forensics are welcomed, but practical capability, curiosity, and a commitment to continuous learning are equally valued.

We are seeking an experienced Incident Response Manager to lead the coordination, investigation, and resolution of security incidents across a complex, globally distributed operational environment. This role will oversee incident response activities from initial detection and triage through containment, eradication, recovery, and post-incident review. You will work closely with security operations, threat intelligence, cyber investigations, technology, legal, risk, and business teams to protect people, facilities, information, and critical services.

Key responsibilities include managing high-severity incidents and serving as an escalation point during active events; establishing incident priorities, response plans, communications, and decision-making processes; directing investigations involving cyber threats, insider risk, physical security concerns, and operational disruption; and ensuring timely, accurate reporting to relevant stakeholders. You will maintain and improve incident response procedures, playbooks, escalation paths, and case-management standards. The role will also lead post-incident reviews, identify root causes and control gaps, track corrective actions, and provide recommendations that strengthen organisational resilience. Additional duties include developing metrics and dashboards, supporting risk assessments and exercises, and promoting consistent response practices across regions and functions.

The successful candidate will bring substantial experience in security incident response, investigations, crisis management, or security operations, ideally within a large, multinational, or highly regulated environment. Strong knowledge of incident management frameworks, investigative methods, threat assessment, evidence handling, and security technologies is required. You should be comfortable making sound decisions under pressure, managing multiple priorities, and communicating clearly with both technical and senior audiences. Experience leading cross-functional teams, coordinating confidential matters, and working across time zones is highly desirable. Professional certifications in security, incident response, investigations, risk, or business continuity are advantageous. The role requires sound judgement, discretion, strong analytical and organisational skills, and a commitment to continuous improvement.

We are seeking a Senior Threat Hunting & Incident Response professional to lead advanced cyber defence activities across the EMEA region. This role will be responsible for proactively identifying sophisticated threats, investigating security incidents and coordinating effective containment and recovery actions. You will work closely with security operations, infrastructure, cloud, application and risk teams to strengthen detection capabilities and reduce organisational exposure.

Key responsibilities include designing and executing threat-hunting investigations across endpoint, network, identity, cloud and application environments; analysing security telemetry to identify indicators of compromise, attacker behaviour and emerging techniques; and leading incident response activities from initial triage through eradication, recovery and lessons learned. You will develop and maintain incident response playbooks, improve detection rules and use threat intelligence to inform monitoring priorities. The role will also involve conducting root-cause analysis, producing clear technical and executive-level reports, supporting digital forensic investigations and helping to coordinate responses with internal and external stakeholders across multiple countries and time zones.

The successful candidate will have significant experience in threat hunting, cyber incident response, security investigations or a closely related discipline, ideally within a complex international environment. Strong knowledge of attack frameworks such as MITRE ATT&CK, common intrusion techniques, malware behaviour, identity attacks and cloud security is expected. You should be confident working with SIEM, EDR, network detection and response, vulnerability, case-management and forensic tooling, with practical experience developing queries, analysing logs and automating repeatable tasks using scripting languages such as Python or PowerShell. Excellent communication, prioritisation and decision-making skills are essential, together with the ability to remain calm during high-impact incidents. Relevant professional certifications in incident handling, threat intelligence, digital forensics or security operations are advantageous. The position may require participation in an on-call rota and occasional travel within EMEA.

We are seeking a Security Engineering Manager to lead incident response and cloud security operations across a complex AWS environment. This role will manage a team of security engineers and coordinate the detection, investigation, containment, and recovery of security incidents affecting cloud infrastructure, applications, and data. You will establish effective response processes, improve operational readiness, and ensure incidents are handled quickly, consistently, and with clear communication to technical and business stakeholders.

Responsibilities include developing and maintaining incident response playbooks, leading investigations into suspected compromises, and coordinating forensic analysis, remediation, and post-incident reviews. You will partner with CloudOps, infrastructure, software engineering, risk, and compliance teams to strengthen preventive and detective controls. The role will also oversee security monitoring, alert triage, threat hunting, vulnerability remediation, and the continuous improvement of logging and telemetry across AWS services. You will define operational metrics, report on incident trends and response performance, and help shape security strategy, standards, and governance.

The successful candidate will have significant experience managing security engineering or incident response teams, together with hands-on expertise in AWS security and cloud operations. Strong knowledge of identity and access management, network security, encryption, endpoint and workload protection, SIEM platforms, infrastructure as code, and security automation is required. Experience responding to major incidents, conducting root-cause analysis, and working with frameworks such as NIST or MITRE ATT&CK is highly desirable. You should be an assured communicator and people leader who can make sound decisions under pressure, develop technical talent, and collaborate effectively across a fast-moving organisation. Relevant cloud or security certifications are advantageous.