Incident Responder

Role: Incident Responder

Location: London, City - 3-4 days in office.

Details: Initial 6 month contract, with guaranteed conversion to perm within that period.

Perm salary: up to £85k

Initial contract rate: TBC

Requirements:

• At least five years of experience working in a Cyber Security Operations or SOC environment, with a minimum of one year directly involved in managing and responding to live security incidents.
• Strong background in investigating cyber threats from initial alert through to resolution, including assessment, prioritisation, escalation and coordination of response activities.
• Experience leveraging SIEM and security monitoring technologies, such as Splunk, Microsoft Sentinel or QRadar, to identify suspicious activity and support complex investigations.
• Good knowledge of modern cyber attack techniques and adversary behaviour, with the ability to recognise and map activity against frameworks such as MITRE ATT&CK.
• Familiarity with recognised incident management frameworks and best practices, including the NIST and SANS approaches to incident handling.
• Ability to investigate threats using multiple sources of security data, including endpoint telemetry, network traffic, system logs and packet captures.
• Strong understanding of enterprise security controls and technologies, including EDR solutions, firewalls and IDS/IPS, together with knowledge of how these technologies can be used to prevent and contain attacks.
• Experience writing and using search queries to support investigations and proactive threat hunting, including technologies such as Splunk SPL and CrowdStrike Query Language.
• Able to communicate investigation outcomes, technical risks and recommended actions clearly to a range of audiences, including senior and non-technical stakeholders.
• A highly analytical and investigative mindset, with strong problem-solving skills and the ability to remain methodical during complex or high-pressure incidents.
• Awareness of key cybersecurity regulations, standards and control frameworks, including GDPR, DORA, ISO 27001, NIST Cybersecurity Framework and CIS Controls.