Cyber Incident Response Engineer – Forensics & Threat Detection

Computappoint; Greater London; Hybrid; GBP 80,000 - 110,000; Full time

Benefits offered by this job

Hybrid work schedule

City of London office access

Job summary

Computappoint is seeking a seasoned Security Engineer for incident investigation and response in a regulatory environment. The role combines hands-on triage, forensic analysis, threat assessment, and remediation within a large enterprise.

You will investigate escalated security events, map IoCs and attacker behaviours, and improve detection with engineering and threat-informed defenses. Hybrid work in London is available.

Qualifications

• Experience in Security Engineering or Incident Response in enterprise settings.
• Proven forensic analysis across endpoints, networks and cloud.
• Strong KQL query development and SIEM experience.
• Ability to communicate findings to technical and non-technical stakeholders.

Responsibilities

• Lead response to security incidents escalated from SOC to containment and remediation.
• Perform forensic analysis across endpoints, identities, networks, and cloud.
• Identify IoCs, attacker behaviours, and attack pathways.
• Develop detection logic, rules, and KQL queries to improve threat visibility.
• Produce technical findings, remediation recommendations, and lessons learned.
• Collaborate with security, infra, and application teams to strengthen controls.

Skills

Incident response

Forensic analysis

Threat hunting

SIEM

KQL

Communication

Tools

EDR

Cloud security

EndPoint security

Job description

Computappoint is seeking a seasoned Security Engineer for incident investigation and response in a regulatory environment. The role combines hands-on triage, forensic analysis, threat assessment, and remediation within a large enterprise.

You will investigate escalated security events, map IoCs and attacker behaviours, and improve detection with engineering and threat-informed defenses. Hybrid work in London is available.