Cybersecurity Incident Response Specialist

Careerwise; City Of London; On-site; GBP 55,000 - 85,000; Full time

Job summary

Careerwise is seeking a Cybersecurity Incident Response Analyst to join our global Security Operations Centre, helping detect, investigate, contain and resolve incidents across the EMEA region.

You will monitor SIEM/EDR/XDR alerts, triage incidents, coordinate containment with IT and security teams, and contribute to playbooks, post‑incident reviews and improved detection capabilities.

Experience with Windows/Linux artefacts, MITRE ATT&CK, NIST guidance and strong reporting is essential.

Qualifications

• Experience in cyber incident response and security monitoring.
• Hands-on experience investigating alerts using SIEM and EDR/XDR.
• Experience analysing Windows and Linux host artefacts and logs.
• Knowledge of the incident response life cycle.
• Experience producing incident records and post-incident findings.
• Familiar with MITRE ATT&CK, Cyber Kill Chain and NIST guidance.
• Understanding of core security domains: networking, IAM, email, endpoints, vulnerability management and data loss prevention.

Responsibilities

• Monitoring and analysing alerts from SIEM, EDR/XDR, identity, email, cloud and network controls to identify suspicious or malicious activity.
• Triaging alerts, validating incidents, assessing severity and business impact, and escalating per processes and SLAs.
• Leading or supporting investigations into phishing, malware, account compromise, data loss and unauthorised access.
• Coordinating containment, eradication and recovery with infrastructure, applications, identity, cloud and business teams.
• Maintaining case records, investigation timelines, evidence and decision logs.
• Collecting, preserving and analysing endpoint, server, identity, network, email and cloud artefacts.
• Identifying indicators of compromise and threat actor behaviour, and documenting findings clearly.
• Safeguarding evidence integrity and chain of custody in regulated investigations.
• Creating, tuning and validating detection rules and queries to improve coverage and reduce false positives.
• Assessing detection gaps and recommending improvements to logging, telemetry and controls.
• Developing, maintaining and exercising incident response plans and playbooks.
• Conducting post‑incident reviews and root‑cause analysis, tracking actions to closure.

Skills

Cyber incident response

Security monitoring

SOC operations

Windows forensics

Linux forensics

Incident reporting

Threat frameworks

Tools

SIEM

EDR/XDR

Job description

Careerwise is seeking a Cybersecurity Incident Response Analyst to join our global Security Operations Centre, helping detect, investigate, contain and resolve incidents across the EMEA region.

You will monitor SIEM/EDR/XDR alerts, triage incidents, coordinate containment with IT and security teams, and contribute to playbooks, post‑incident reviews and improved detection capabilities.

Experience with Windows/Linux artefacts, MITRE ATT&CK, NIST guidance and strong reporting is essential.