Incident response jobs in BirminghamCrear alertas

Security Tooling Engineer About Us NTT DATA is one of the world’s largest global security services providers, with over 7,500 security SMEs. We work with leading security technology vendors and pride ourselves on delivering innovative and effective solutions. Our people, clients, and communities are at the core of what we do. We’re seeking individuals passionate about building a more secure and sustainable world. The Security Tooling Engineer is responsible for the operation, maintenance, integration, and optimization of security platforms and tools that support the delivery of security services across NTT DATA and Service Recipients. This role ensures that security tooling operates reliably, integrates seamlessly with enterprise infrastructure, and complies with governance requirements outlined. Key Responsibilities Platform Operations & Maintenance • Operate and maintain security platforms in accordance with agreed Service Level Agreements (SLAs) as defined in Service Levels and KPIs, • Ensure high availability, performance, and reliability of all security tooling, • Monitor platform health and proactively address performance issues, • Manage platform upgrades, patches, and version control, • Provide monthly health and performance reports for all managed security platforms Data Source Management & Integration • Manage onboarding of data sources to security platforms (e.g., log sources to SIEM), • Configure data parsing, normalization, and enrichment to ensure data quality, • Design and maintain dashboards and visualizations for security monitoring and reporting, • Ensure integration with other Security Services and Tooling across the ecosystem, • Integrate security tools with recipients clients or Global's Splunk SIEM, CMDB, and ticketing systems, • Implement SSO (Single Sign-On) and MFA (Multi-Factor Authentication) integration with recipient clients or Global's identity and access management systems Access Management & Governance • Enforce Role-Based Access Control (RBAC) across all security platforms, • Conduct quarterly access reviews to ensure least-privilege access, • Manage user provisioning and deprovisioning for Global, Service Recipients, and authorized Supplier personnel, • Maintain auditable logs of all access changes, • Ensure all access changes are logged and auditable per clients requirements Configuration & Change Management • Manage security tool configurations in accordance with the Change Control Procedure, • Document all configuration changes and maintain configuration baselines, • Ensure configuration changes are approved by Global and/or Service Recipients before implementation, • Maintain configuration management database (CMDB) entries for all security tooling, • Support configuration audits and compliance reviews Vulnerability & Patch Management • Perform vulnerability scans of security tooling platforms in line with Vulnerability Management Service requirements, • Apply patches within timelines defined by recipient clients or Global policies and standards, • Report remediation status monthly, • Escalate unpatched critical vulnerabilities immediately to recipient clients or Global service, • Ensure security tooling platforms comply with recipient client or Global's patching policies Incident & Problem Management • Report tooling-related incidents (outages, performance issues, security events) to Global and or Service Recipients immediately, • Support Third Party vendor cases where Supplier actions affect system availability, integrity, or confidentiality, • Provide written notice of vulnerability disclosures and critical defects in tooling without undue delay, • Provide impact assessments and work-around proposals for tooling issues, • Log all tooling-related incidents and vulnerabilities in the agreed ticketing system, • Provide monthly reports detailing incident trends, vulnerability status, and remediation progress Tooling Replacement & Migration • Support tooling replacement activities when recipient clients or Global decides to replace existing tools, • Participate in hypercare activities for Replacement Tooling up to and including implementation date, • Ensure seamless migration of configurations, data, and integrations to new platforms, • Retrain on new tooling as required clients, • Cease use of Replaced Tooling by the specified replacement date Security Tooling Portfolio Management Manage and maintain the following categories of security tools: Security Operations Tools • SIEM (Security Information and Event Management) - e.g., Splunk, • EDR (Endpoint Detection and Response), • SOAR (Security Orchestration, Automation and Response), • Threat Intelligence Platforms, • Vulnerability Scanners (e.g., Qualys, Tenable), • Brand Protection and Domain Monitoring Tools, • SAST (Static Application Security Testing) - e.g., Checkmarx, Fortify, • DAST (Dynamic Application Security Testing) - e.g., Burp Suite, OWASP ZAP, • SCA (Software Composition Analysis) - e.g., Snyk, Black Duck, • CSPM (Cloud Security Posture Management) - e.g., Prisma Cloud, Wiz, • Container Scanning Tools, • Third Party Risk Management Platforms, • Security Service Desk Ticketing Systems (e.g., Jira, ServiceNow), • Reporting and Dashboard Platforms Experience • Minimum 4 years of experience in security operations, security engineering, or IT systems administration, • Minimum 2 years of hands-on experience with SIEM platforms (preferably Splunk), • Proven experience managing security tooling in enterprise environments, • Experience with integration of security tools with enterprise infrastructure (IAM, CMDB, ticketing), • Demonstrated experience with access management and RBAC implementation, • Experience with vulnerability management and patch management processes Technical Skills Security Platforms • SIEM: Splunk (required), QRadar, ArcSight, LogRhythm, Sentinel, • EDR: CrowdStrike, Carbon Black, SentinelOne, Microsoft Defender, • SOAR: Splunk Phantom, Palo Alto Cortex XSOAR, IBM Resilient, • Vulnerability Management: Qualys, Tenable, Rapid7, • REST APIs and API integration, • Scripting: Python, PowerShell, Bash, • Automation tools: Ansible, Terraform, Jenkins, • Linux and Windows server administration, • Networking fundamentals (TCP/IP, DNS, firewalls, proxies), • Cloud platforms: AWS, Azure, GCP, • SSO protocols: SAML, OAuth, OpenID Connect, • MFA solutions: Duo, Okta, Azure MFA, • LDAP/Active Directory integration, • Log management and parsing, • Data normalization and enrichment, • Dashboard and visualization design (Splunk, Grafana, Kibana), • Clients Global Security Control Framework, • ISO 27001, NIST Cybersecurity Framework, CIS Benchmarks, • ITIL service management practices, • Change management and configuration management

Complete online training designed to take you from zero experience to your first Cyber Security role. You will learn industry-recognised methodologies, network security, threat detection, vulnerability management, and incident response, while building practical experience with Live Labs. The program

Trainee Cyber Security Course Programme Job Guarantee Included. Complete online training designed to take you from zero experience to your first Cyber Security role. You will learn industry-recognised methodologies, network security, threat detection, vulnerability management, and incident response

Complete online training designed to take you from zero experience to your first Cyber Security role. You will learn industry-recognised methodologies, network security, threat detection, vulnerability management, and incident response, while building practical experience with Live Labs. The program

Trainee Cyber Security Course Programme Job Guarantee Included. Complete online training designed to take you from zero experience to your first Cyber Security role. You will learn industry-recognised methodologies, network security, threat detection, vulnerability management, and incident response

Join OCI to design and deliver cloud-scale DDoS protection as part of our edge security platform. You’ll design and ship high-performance detection and mitigation systems, automate operations end-to-end, and help define the technical foundation for customer-facing DDoS capabilities. Basic qualifications • 6+ years building production backend systems (at least 3 years in high-scale or low-latency environments)., • Proficiency in one or more: Java/Python/C++/Rust/Go, • Strong preference for Java for control-plane/services., • Strong systems design skills: concurrency, memory management, performance tuning, API design, and distributed systems fundamentals., • Experience with DevOps at scale: CI/CD, automated testing, canarying, rollout/rollback, and configuration management., • IaC expertise (e.g., Terraform) and solid cloud infrastructure fundamentals., • Familiarity with DDoS or network security services and related attack/defense patterns., • Solid networking knowledge: TCP/IP, IPv4/IPv6, BGP fundamentals; DNS/DHCP understanding., • Observability experience (metrics, tracing, alerting) and operational excellence mindset. Preferred qualifications • Experience with anycast routing, traffic steering, and multi-region service readiness., • Exposure to SDN, programmable data planes, or hardware mitigation platforms., • Advanced telemetry/streaming pipelines for near-real-time detection (e.g., high-rate packet/flow analytics)., • Background in resilience engineering, chaos testing, and capacity planning at hyperscale., • Containerization/orchestration experience and secure service-to-service communication (mTLS, policy)., • Familiarity with zero trust principles, segmentation, and modern security architectures. How you’ll have impact • Ship core DDoS detection/mitigation capabilities that protect OCI’s Tier 0 availability., • Enable new customer-facing DDoS offerings with self-service policy and visibility., • Raise engineering quality, automation, and compliance maturity across the stack. Ways of working • Security and privacy by design; auditable controls and policy adherence from day one., • Data-driven delivery with clear KPIs, SLOs, and stage gates from prototype to GA., • Collaborative, inclusive engineering culture with code reviews, design docs, and knowledge sharing. What you’ll do • Design and build low-latency backend services for DDoS detection, classification, and mitigation across OCI’s global edge., • Implement scalable data and control planes (policy, signaling, telemetry, orchestration) with strong fault isolation and resiliency., • Develop traffic engineering capabilities (anycast, BGP signaling, routing policy) and integrate with OCI networking, DNS, and edge services., • Own operational readiness: SLOs/SLAs, on-call health, incident response, runbooks, and post-incident improvements., • Build automation-first workflows: CI/CD pipelines, test frameworks, canary/blue-green releases, and infrastructure-as-code., • Create robust observability (metrics, logs, traces) and capacity/scale modeling for high-throughput, high-availability systems., • Partner with product, SRE, and network engineering to deliver roadmap features from concept to GA with security-by-design., • Contribute to threat modeling, architecture reviews, and compliance/audit readiness for Tier 0 services.

Join OCI’s Edge Security team as a Principal Engineer to architect and deliver cloud-scale DDoS protection. You’ll lead design for high-performance detection and mitigation systems, drive automation and operational excellence, and set the technical direction for customer-facing DDoS capabilities across OCI’s global edge. This role requires deep expertise in Linux networking data path and kernel-level networking (such as XDP, eBPF, DPDK, iptables, nftables), in addition to strong systems and DevOps engineering experience. Basic qualifications • 7–10 years building production backend systems, including 3–5 years in high-scale and/or low-latency environments., • Deep expertise in Linux networking data path and kernel-level networking (e.g., XDP, eBPF, dpdk, iptables, nftables) for traffic processing, filtering, and observability., • Proficiency in one or more: Java/Python/C++/Rust/Go (strong preference for Java for control-plane/services)., • Deep systems design expertise: concurrency, memory management, performance tuning, API design, consistency models, and distributed systems fundamentals., • Proven DevOps leadership at scale: CI/CD, automated testing, canarying, rollout/rollback, configuration management., • Strong IaC experience (e.g., Terraform) and solid cloud infrastructure fundamentals., • Domain experience in DDoS or network security services and common attack/defense patterns., • Advanced networking knowledge: TCP/IP, IPv4/IPv6, BGP, routing policy; DNS fundamentals., • Demonstrated operational excellence and observability practices (metrics, tracing, alerting). Preferred qualifications • Expertise with anycast routing, global traffic steering, and multi-region service readiness., • Experience with SDN, programmable data planes, or hardware mitigation platforms., • Building high-rate telemetry/streaming pipelines for near-real-time detection (packet/flow analytics)., • Background in resilience engineering, chaos testing, disaster recovery, and capacity planning at hyperscale., • Containerization/orchestration (e.g., Kubernetes) and secure service-to-service communication (mTLS, policy enforcement)., • Familiarity with zero trust, segmentation, and modern security architectures; exposure to compliance frameworks and audit preparation. How you’ll have impact • Deliver core DDoS detection/mitigation that protects OCI’s Tier 0 availability and customer trust., • Launch customer-facing DDoS offerings with self-service policy, visibility, and strong defaults., • Raise engineering quality, automation, and compliance maturity across the stack; mentor and grow the team’s technical bar. Ways of working • Security and privacy by design with auditable controls and policy adherence from day one., • Data-driven delivery with clear KPIs, SLOs, and stage gates from prototype to GA., • Collaborative, inclusive culture emphasizing design docs, code reviews, and knowledge sharing. What you’ll do • Lead architecture and delivery of low-latency backend services for DDoS detection, classification, and mitigation., • Define and evolve scalable data/control planes (policy, signaling, telemetry, orchestration) with strong fault isolation, resiliency, and compliance-by-design., • Own traffic engineering strategy (anycast, BGP policy, routing integration) and partner with networking, DNS, and edge platform teams., • Set operational standards: SLOs/SLAs, on-call health, incident response (including incident commander duties), runbooks, and post-incident learning., • Drive automation at scale: CI/CD strategy, test frameworks, progressive delivery (canary/blue-green), and infrastructure-as-code., • Establish robust observability (metrics, logs, traces) and capacity/scale models for high-throughput, highly available services., • Lead threat modeling, architecture reviews, and audit readiness for Tier 0 services; ensure security and privacy are embedded through the lifecycle., • Mentor engineers, influence cross-org roadmaps, and collaborate with Product, SRE, and Network Engineering from concept to GA.

Who are we? Airportr is re-architecting the way baggage moves through the world. We’re building the digital rails for baggage, transforming a legacy, manual process into a seamless, data driven network that connects passengers, airlines, airports, and logistics partners in real time. Headquartered in London, we partner with some of the world’s leading airlines to deliver Baggage-as-a-Service, fully integrated into their booking and check-in journeys. Our platform is live across multiple European markets and expanding rapidly through strategic global partnerships that enable deployment across hundreds of airports and carriers. Airportr sits at the intersection of travel technology, logistics, and automation, combining deep operational know-how with modern engineering to solve one of air travel’s hardest problems at global scale. We’re on a mission to make baggage handling invisible: intelligent, automated, and effortlessly connected from doorstep to destination. What are we looking for? We’re looking for a brilliant, highly experienced Software Engineering Manager to ignite and lead our distributed tech function. You will be responsible for ensuring our teams are delivering high quality, scalable software that powers our global logistics operation. Reporting directly to our CTO, you'll be the pivotal operational leader for engineering, translating technical vision into tangible success and accelerating our ambitious business goals. Your primary mission will be to empower, support, and develop our Tech Leads, fostering their growth and ensuring our engineering squads thrive. We need a proactive, hands-on leader, someone who dives in, takes initiative and gets stuck in to make extraordinary things happen. We understand that some people value a highly structured, predictable environment. If that's your preference, we probably aren't the right company for you. Our pace is rapid, our priorities are agile, and our roadmap often shifts based on opportunity. We're looking for individuals who see this dynamic environment as an opportunity to contribute, innovate, and grow, not a challenge to stability. If you are passionate about deep collaboration and bringing ingenuity to solve problems on the fly, then we may be a match! Key Responsibilities • Cultivate an unwavering obsession with quality, delivery speed, and flawless execution. You'll refine our Agile processes to empower high-performing remote teams, ensuring we ship quickly, predictably, and with excellence., • Collaborate closely with the CTO and Product team to transform visionary technical strategies into clear, actionable plans and inspiring quarterly goals. You'll orchestrate scoping, resource allocation, and manage dependencies across all squads, driving collective success., • Become a master of foresight, spotting and swiftly resolving technical and process bottlenecks across the entire development pipeline. You won't wait for problems to emerge—you'll proactively solve them, keeping our momentum unstoppable., • Embrace continuous innovation, constantly refining our software architecture as we achieve key milestones and push the boundaries of what's possible., • Act as the senior technical voice who gets stuck in to help Tech Leads troubleshoot complex decisions or unblock critical issues. You will provide direct, practical mentorship required by a lean team., • Instil a culture of accountability for technical quality, coding standards, and security. You'll ensure that speed never compromises the stability and regulatory compliance of our critical airline and logistics systems—because excellence is non-negotiable., • You’ll be brilliant at getting the best out of our distributed (offshore) teams. This includes setting up clear communication strategies and maintaining high morale and culture across different time zones., • Build strong, trusting relationships with all internal teams, including Product, Operations, Commercial, and Customer Experience. You will ensure tech priorities perfectly support urgent business goals and operational reality., • Champion platform stability, overseeing uptime, latency, and incident response. You'll establish robust monitoring and on-call procedures, ensuring our teams are always prepared and responsive. How we will measure impact Your impact will be measured by clear, quantifiable improvements in delivery velocity and predictability, ensuring the on-time achievement of strategic goals. You will directly elevate engineering quality and platform stability, evidenced by improved uptime, lower latency, and a reduction in critical incidents. Crucial metrics will also include your leadership in the successful execution of architectural roadmaps, proactive resolution of technical bottlenecks, and the demonstrable growth and high retention of our distributed engineering teams. What will we need from you? • A proven track record in software engineering management, ideally within a scaling, fast-growth organisation where you've made a significant impact., • Proven experience driving and maturing Agile methodologies to significantly improve team processes and velocity in a dynamic, fast-paced environment., • Highly analytical, data-driven and inquisitive, constantly seeking insights and opportunities for improvement., • Solid grasp of modern cloud infrastructure and our stack: MS Azure, .NET, React, Angular, Micro-services and Service-bus., • Proven technical expertise in intricate, highly available and distributed systems, preferably within travel tech or regulated industries., • Exceptional communication and written skills, enabling you to articulate complex ideas with clarity and impact., • Expertise in leading and scaling remote-first, global, or offshore engineering teams, inspiring them to achieve greatness regardless of location., • The exceptional ability to communicate clear execution status and technical trade-offs to all levels of the organisation, fostering transparency and alignment., • Masterful prioritisation skills, allowing you to expertly balance competing requests and laser-focus on high-impact work that drives our mission forward. This is a remote with requirement to travel to London office for meetings/team days monthly. Our salaries are determined by experience and location and are benchmarked at the 75th percentile.

Job Title: Subsea Tooling Manager Location: Aberdeen, Newcastle or North Yorkshire Role Purpose The Subsea Tooling Manager is responsible for the technical, commercial, and strategic management of a global subsea tooling portfolio. The role ensures tooling solutions are engineered, delivered, and cost-managed to meet project requirements safely, efficiently, and reliably, while driving performance, profitability, and market growth. Key Responsibilities Technical Leadership • Lead the design, development, selection, and integration of subsea tooling, including pipeline PIG launch and recovery systems and subsea connectors., • Provide technical leadership to tooling engineers, ensuring compliance with industry standards and best practices., • Ensure tooling designs are maintained, certified, and compliant with regulatory and quality requirements., • Support projects through technical reviews, feasibility assessments, and operational troubleshooting., • Drive continuous improvement in tooling performance, reliability, and innovation. Commercial & Strategic Management • Own the commercial strategy for subsea tooling, including budgeting, pricing, and cost control., • Support sales enquiries and prepare technical and commercial proposals in response to RFQs., • Manage vendor relationships, procurement strategies, and contract negotiations., • Optimise tooling inventory and lifecycle management to reduce cost and lead times., • Identify market trends, emerging technologies, and growth opportunities., • Develop and deliver short-term revenue improvement plans and a 3–5 year strategic roadmap, including funded new product development., • Support marketing activities, customer engagement, and industry exhibitions. Project, Operational, HSE & Quality • Coordinate with internal teams to ensure tooling is delivered to customer expectations., • Ensure timely resolution of equipment and operational issues., • Champion a strong HSE culture and ensure compliance with safety, legislative, and quality systems., • Participate in audits, incident investigations, and continuous improvement activities. Key Competencies • Strong technical expertise in subsea tooling and ROV-related systems., • Proven commercial and financial management capability., • Leadership, strategic planning, and execution skills., • Strong organisational, communication, and problem-solving abilities., • Commitment to safety, quality, and continuous improvement. Qualifications & Experience • Degree in Mechanical Engineering, Marine Engineering, Robotics, or related discipline., • Chartered Engineer status desirable., • 7+ years’ experience in subsea tooling, ROV operations, or subsea engineering., • Proven experience in design-and-build environments and technical team management., • Strong knowledge of offshore energy industry standards (API, ISO, IMCA). Work Environment • Office-based with regular travel to operational teams, customers, and exhibitions in the UK and overseas.

Colt is the New Standard in high bandwidth network and voice services for enterprises and wholesale customers in Europe, Asia and North America’s largest business hubs. With a global reach but a deep local presence, Colt is big enough to deliver and small enough to care. Why we need this role? Colt Technology Services SOC is seeking a Tech Lead - SOC Responder. This is an opportunity to meaningfully contribute to a highly visible security operations function with global impact upon Colt, business units, partners, and customers. While working as part of this team, the successful individual will provide world class incident response functions to detect, protect, respond, and sustain operations within cyberspace. What you will do: Support SOC Manager to deliver the following • SIEM, IR tools platform management including all design, implementation and administration activities , Use cases preparation and implementation, connector deployment, maintenance & health checks, • Responsible for operational activities, Technology escalation support, Security Solution assessment, build activities , existing Service maturing and Build activities assist, • Analyse potential infrastructure security incidents to determine if incident qualifies as a legitimate security breach, • Establishing and governing the security incident response processes, investigations and security operational processes., • Maintenance and enhancement of formal service catalogue, service descriptions, targets and performance against these., • Ensure security services, tools and platforms are adequately maintained., • Monitoring of and reporting on the effectiveness of our security enforcing technologies., • Identification and ongoing monitoring of specific security risks and KPIs and production of management information to ensure Colt receives value from key security investments/services., • Contribute to design, development and maintenance of security standards and controls., • Align team's goals and plan with Colt’s long term priorities and strategy., • Develop and grow the talent and people capability within the security teams. What We're Looking For? • 6+ years Information Security Incident Response experience with a focus on detection and response to malicious activity using log data from various sources preferred., • Strong Networking and Systems experience, preferably in an Enterprise environment, • Strong understanding of Information Security and the threat landscape surrounding enterprise systems., • Strong Scripting experience (python, powershell, Unix shell), • Demonstrated experience working in all phases of the SDLC, • Deep understanding and experience using cyber security operations, security monitoring, endpoint (EDR), Network, and SIEM Tools., • Prior SOC experience a plus, • Extensive knowledge of network and server security protocols, technologies, and products., • Industry recognized certifications (CISSP, GCIH, GCFA, OSCP, etc) preferred, • Strong oral and written communication skills., • Relentless curiosity and attention to detail, • Ability to learn quickly and leverage prior experiences to effectively solve current security challenges., • Refusing to accept the status quo, • Degree in Information Technology, Engineering or similar, • SIEM management - Desirable to have some advanced Certification from SIEM vendor on products such as ArcSight , MS Sentinel or Logrhythem What We Offer You Looking to make a mark? At Colt, you’ll make a difference. Because around here, we empower people. We don’t tell you what to do. Instead, we employ people we trust, who come together across the globe to create intelligent solutions. Our global teams are full of ambitious, driven people, all working together towards one shared purpose: to put the power of the digital universe in the hands of our customers wherever, whenever and however they want. We give our people the opportunity to inspire and lead teams, and work on projects that connect people, cities, businesses, and ideas. We want you to help us change the world, for the better. Diversity and inclusion • Signed the UN Women Empowerment Principles which guide our Gender Action Plan, • Trained 60 (and growing) Colties to be Mental Health First Aiders Our benefits support you through all parts of life, for both physical and mental health. • Flexible working hours and the option to work from home., • Extensive induction program with experienced mentors and buddies., • Opportunities for further development and educational opportunities., • Global Family Leave Policy., • Employee Assistance Program., • When you join Colt you become part of our global network. We are proud of our colleagues and the stories and experience they bring – take a look at ‘Our People’ site including our Empowered Women in Tech.

Role Title: Enterprise Infrastructure Principal Engineer Job Type: Contract Location: Sheffield/Birmingham/Edinburgh Start date: 19th January 2026 Performance Summary Statements • Strong Performance: Consistently demonstrates sound technical judgment, aligns platform decisions with enterprise goals, and enables progress across multiple teams. • Exceptional Performance: Sets enterprise-wide technical direction, reduces systemic risk, and scales impact through standards, strategy, and mentorship. Architecture & Systems Knowledge Meets Expectations Demonstrates working knowledge of: • Key Platform Products/Services, • Network topology, IAM, CI/CD, monitoring, and security tooling, • Accurately explains current-state architecture, dependencies, and constraints. Exceeds Expectations • Identifies undocumented system behaviors, hidden coupling, or legacy risks early., • Provides leadership with a concise, accurate current-state assessment. Reliability, Security & Risk Awareness Meets Expectations • Reviews historical incidents, audits, and compliance requirements., • Understands escalation paths, operational ownership, and change management processes. Exceeds Expectations • Proactively identifies systemic reliability or security risks and articulates business impact., • Surfaces risk tradeoffs in clear, executive-appropriate language. Enterprise Influence & Collaboration Meets Expectations Establishes productive relationships across: • Enterprise Infrastructure, • Security, • Application teams (our customers), • Architecture review boards, • Respects governance and decision-making processes. Exceeds Expectations • Quickly earns trust as a neutral, high-judgment technical advisor., • Is consulted informally on complex or sensitive technical decisions. Architecture & Technical Direction Meets Expectations • Authors or contributes to enterprise-grade design documents. Aligns proposals with: • Enterprise architecture standards, • Security and compliance requirements, • Cost and operational constraints Exceeds Expectations • Simplifies or clarifies existing architecture standards., • Resolves cross-team architectural disagreements through data and reasoning. Execution & Delivery Meets Expectations Leads or materially contributes to at least one high-impact infrastructure initiative, such as: • Platform modernization, • IaC standardization, • CI/CD reliability improvements, • Cost optimization Exceeds Expectations • Delivers measurable improvements (e.g., ↓ MTTR, ↓ deployment failures, ↓ cloud spend)., • Enables delivery across multiple teams without direct authority. Reliability, Security & Operations Meets Expectations Improves consistency of: • Incident response, • Postmortems, • Change management practices Exceeds Expectations • Introduces or strengthens reliability metrics, or risk dashboards used beyond a single team., • Elevates operational maturity at the program or portfolio level. Mentorship & Technical Stewardship Meets Expectations • Mentors senior/staff engineers through design reviews and technical guidance., • Models strong documentation and decision-making discipline. Exceeds Expectations • Raises design quality across teams., • Reduces rework and decision churn through clearer architectural guidance. Enterprise Infrastructure Strategy Meets Expectations • Contributes to or co-owns infrastructure strategy and roadmap., • Aligns infrastructure investments with business priorities and regulatory needs. Exceeds Expectations • Influences multi-year platform direction., • Helps leadership make informed tradeoffs between speed, cost, and risk. Systems Thinking & Risk Management Meets Expectations Establishes repeatable processes for: • Architecture reviews, • Capacity planning, • Disaster recovery validation Exceeds Expectations • Reduces systemic risk through standardization and simplification., • Prevents incidents through proactive design and early intervention. Developer Productivity & Platform Enablement Meets Expectations • Improves clarity around:, • Ownership models, • Approved patterns, • Supported platforms Exceeds Expectations • Enables self-service infrastructure and “golden paths.”, • Noticeable reduction in escalations and ad-hoc exceptions. Organizational Leadership & Presence Meets Expectations • Communicates complex topics effectively to senior leadership., • Operates comfortably in ambiguity and enterprise-scale complexity. Exceeds Expectations • Recognized as a principal-level authority across multiple organizations., • Shapes culture around quality, reliability, and technical excellence. Disclaimer Notwithstanding any guidelines given to level of experience sought, we will consider candidates from outside this range if they can demonstrate the necessary competencies. Square One is acting as both an employment agency and an employment business, and is an equal opportunities recruitment business. Square One embraces diversity and will treat everyone equally. Please see our website for our full diversity statement.

You'll work across servers, networks, storage, and security tools, contributing to infrastructure projects as well as cyber initiatives such as vulnerability management, incident response, and enhancing security controls. IT Security Engineer, Infrastructure Engineer, Network Security Engineer,. We'

Trainee Cyber Security Course Programme Job Guarantee Included Complete online training designed to take you from zero experience to your first Cyber Security role. You will learn industry-recognised methodologies, network security, threat detection, vulnerability management, and incident response,

Trainee Cyber Security Course Programme Job Guarantee Included Complete online training designed to take you from zero experience to your first Cyber Security role. You will learn industry-recognised methodologies, network security, threat detection, vulnerability management, and incident response,

Trainee Cyber Security Course Programme Job Guarantee Included Complete online training designed to take you from zero experience to your first Cyber Security role. You will learn industry-recognised methodologies, network security, threat detection, vulnerability management, and incident response,

You will automate security processes and procedures and be part of a Security Incident Response Team. Working as a Security Engineer you will be designing, building and maintaining internal security tools, controls and services. Worked in a DevOps, SRE, Security Engineering and/or software developme

You will manage service delivery, oversee a team of security analysts, and ensure timely incident responses.

As Head of IT Security Incident and Threat Management, you will shape and lead the organization’s global response to cyber threats — ensuring they stay one step ahead of emerging risks. Head of IT Security Incident and Threat Management. Strong leadership in IT security, particularly in incident

A leading green technology company in the UK is seeking a Remote Monitoring Centre Analyst responsible for proactively monitoring systems and events from a remote location.The successful candidate will analyze alerts for potential incidents, provide troubleshooting, and ensure system stability.Key q

Sky's operational resilience model addresses the linked fields of business continuity, incident management, crisis management and emergency response. You will be on call for one week on a rotational basis, ensuring timely response to incidents and helping to facilitate efficient resolution of issues

This role involves leading cyber incident responses, managing forensic investigations, and delivering high-quality solutions to clients.

You'll work closely with stakeholders across the organisation to ensure that key information is effectively conveyed and that the programme supports Sky's overall resilience response strategy As an Operational Resilience Practitioner, you will support each discipline of the team (Operational Resilie

Senior Incident Response Security Engineer. Join to apply for the Senior Incident Response Security Engineer role at Prima. To fuel this growth we need a Security Engineer focused on Incident Response to join our Security Team.

Direct experience in handling cyber security incidents and associated incident response tools. Develop and maintain incident response playbooks and runbooks to ensure standardized and efficient response processes. Demonstrated expertise in areas like incident response, intrusion and malware analysis

Our CIR specialists are called to answer client needs regarding proactive incident response advisory services, reactive incident response, post-breach assessments, managed threat hunting as well as implementing response automation technologies. Proven experience in Incident Response supervising tech

A leading technology firm in the UK is seeking an experienced OT/ICS Cyber Security Consultant to focus on red team activities including penetration testing and resilience validation.The ideal candidate will have 3-5 years of cyber security experience, strong knowledge of ICS/OT, and excellent commu

Specialised experience in cyber incident response and cyber incident management. Incident analysis, combining sound analytical skills with advanced knowledge of cybersecurity, digital forensics and incident response. Experience conducting digital forensics or incident response or a similar role.

A leading retail company in the UK seeks an Information Security professional focusing on incident response within their technology estate.

A niche consulting organization based in London is seeking an experienced cybersecurity expert to manage complex incidents and enhance response strategies. This role involves coordinating cybersecurity responses and preparing relevant reports for technical and non-technical audiences.

A cybersecurity firm based in London is seeking a Senior SOC Analyst (Level 3) to lead incident investigations, manage client communication, and refine detection content within the SOC team.

The successful candidate will review alerts, evaluate incident response quality, and support SOC maturity assessments. Candidates should have experience in SOC operations and incident response leadership, with strong analytical writing skills.

This mid-senior level role involves leading security governance and compliance, risk management, and incident response coordination mainly in a remote environment.

A leading IT consultancy firm in the United Kingdom is seeking an Incident Response Project Manager.

A leading asset management firm in Greater London is seeking a Senior Cyber Defence Operations Analyst to lead incident response and vulnerability management efforts. Candidates should have a strong background in incident response, knowledge of SIEM tools, and effective collaboration skills.

A global intelligence firm in Greater London is seeking an Analyst in Cyber Threat Intelligence.In this role, you will track and analyze cyber threats, conduct investigations, and develop intelligence reports.Ideal candidates have strong analysis skills and an interest in cyber threats.The firm offe

The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. We are looking for an experienced, hands-on security practitioner to drive the adoption of modern security processes and tooling, with a

A leading cloud services provider in Greater London is seeking a Security Engineer to manage incident response operations and develop security automation solutions on AWS. Ideal candidates will have over 3 years in technical IT security and significant hands-on experience in threat detection and res

You’ll shape crisis response frameworks that work under real pressure, strengthen leadership decision‑making, and ensure clients are confident in their readiness to respond to cyber incidents. Build and enhance incident management and crisis response plans aligned to best practice (NIST, ISO 270

Develop and maintain incident response playbooks and runbooks to ensure standardized and efficient response processes. Direct experience in handling cyber security incidents and associated incident response tools. Bachelor's degree in computer science, information systems, or related technical disci

The ideal candidate will have extensive experience in cloud security, incident response, and stakeholder communication.

Candidates should have hands-on experience in AWS security services, strong scripting skills, and familiarity with incident response.

As our Incident Response Project Manager, you will be primarily dedicated to external, client-facing projects within our Incident Response team. Incident Response Project Manager. This position will report directly to our Director of Incident Response PMO.

Ideal candidates will have a Bachelor's degree in a related field and at least three years of relevant experience, including a robust understanding of incident response and security engineering. The role will focus on managing cybersecurity incidents from identification to eradication while working

A leading mobile infrastructure company in the UK is seeking an experienced H&S Incident Response Manager. This hybrid role involves managing incident and issue response across the organization, ensuring alignment with policies and standards. The ideal candidate will have a strong background in best

A leading design platform is looking for a Senior Security Engineer - Incident Response to lead incident response coordination, monitor security threats, and develop automation workflows. The ideal candidate will have strong cloud security knowledge and experience in incident response.

When not responding to breaches, you will conduct enterprise threat hunting, help clients develop incident response plans, facilitate tabletop and purple team exercises, and provide other strategic security services related to incident response. Significant hands‑on experience with hardware/softwa

Cyber Security Incident Response Consultant. Join an international cybersecurity consultancy delivering critical incident response solutions to government agencies and enterprise clients worldwide. Support government cybersecurity programmes building incident response capabilities in partner nations

A specialized cybersecurity consultancy in Greater London is seeking a Senior Cyber Security Analyst to lead investigations and analyze threats.You will oversee client engagements, conduct risk assessments, and implement best practices to enhance security.Ideal candidates should have over 2 years of