Incident Response Analyst (Cyber Security)

Careerwise; Greater London; Hybrid; GBP 72,000 - 94,000; Full time

Job summary

Careerwise is seeking a Senior Incident Response Analyst in London for a 12-month hybrid contract. The role demands 8+ years in incident response and strong cyber security experience across SIEM/EDR/XDR, forensics, and threat hunting.

You will lead investigations, containment, and recovery while coordinating with multiple stakeholder teams. Bulletproof knowledge of MITRE ATT&CK, threat intelligence, and scripting with Python/PowerShell is highly desirable.

Qualifications

• 8+ years of experience in Incident Response
• Strong cyber security experience
• Experience with SIEM/EDR/XDR
• Experience with Windows/Linux forensics
• Knowledge of MITRE ATT&CK
• Experience in banking, regulated environments preferred

Responsibilities

• Monitor and analyse security alerts across SIEM, EDR/XDR, identity, email, cloud and network security platforms.
• Validate incidents, assess severity and impact, investigate threats and coordinate containment and recovery.
• Conduct forensic investigations across Windows/Linux endpoints, servers, networks, logs and cloud.
• Develop detection rules, SIEM queries and correlation logic to improve threat detection.
• Coordinate incident response with multiple teams and maintain timelines and reports.
• Develop incident response playbooks and post-incident reviews.

Skills

Incident Response

Cyber Security

SIEM/EDR/XDR

Threat Hunting

Forensics

MITRE ATT&CK

Python

PowerShell

Stakeholder Mgmt

Threat Intelligence

Education

Cyber security degree

Certifications: GCIH

Certifications: GCFA

Certifications: GCIA

Certifications: SC-200

Certifications: CySA+

Certifications: CISSP

Tools

Wireshark

Velociraptor

Volatility

EnCase

Microsoft Sentinel

Defender XDR

KQL

Python

PowerShell

Job description

Rate – upto £450/Day Outside IR35

12 Months contract

London Based (Hybrid – 2 Days in office)

Responsibilities:

• Must have atleast 8+ yrs of experience as an Incident Response Analyst.
• Must have strong experience in cyber security.

• - Incident Detection, Triage & Response: Monitor and analyse security alerts across SIEM, EDR/XDR, identity, email, cloud, and network security platforms. Validate incidents, assess severity and business impact, investigate threats such as phishing, malware, account compromise, and unauthorised access, and coordinate containment, eradication, and recovery activities in line with established SLAs.
• - Digital Forensics & Threat Investigation: Conduct forensic investigations across Windows/Linux endpoints, servers, network traffic, authentication logs, email, and cloud environments. Collect and preserve digital evidence, maintain chain of custody, identify Indicators of Compromise (IoCs), establish root cause, and map attacker tactics and techniques to the MITRE ATT&CK framework.
• - Threat Hunting & Detection Engineering: Perform proactive, hypothesis-driven threat hunting using threat intelligence, security telemetry, and attacker behavioural patterns. Develop, tune, and validate detection rules, SIEM queries, correlation logic, and custom indicators to improve threat detection, reduce false positives, and address security monitoring gaps.
• - Incident Coordination & Stakeholder Management: Collaborate with infrastructure, application, cloud, identity, risk, legal, compliance, business, and third-party teams to manage incidents throughout the response lifecycle. Maintain accurate incident timelines, evidence, action logs, escalation records, and investigation reports while providing timely technical updates and management communications.
• - Incident Response Governance & Continuous Improvement: Develop and maintain incident response playbooks, standard operating procedures, escalation matrices, and communication templates. Conduct root-cause analysis and post-incident reviews, track remediation actions, support cyber incident simulations, and report incident metrics, trends, risks, and control effectiveness to management.
• - Technical Skills & Experience: Demonstrate hands‑on experience in Cyber Security Incident Response, SOC operations, SIEM and EDR/XDR platforms, Windows/Linux forensics, network analysis, cloud security, identity and access management, email security, and vulnerability management. Working knowledge of NIST incident response guidance, MITRE ATT&CK, Cyber Kill Chain, and evidence-handling procedures is essential. Experience with Microsoft Sentinel, Defender XDR, KQL, Python, PowerShell, threat intelligence, and forensic tools such as Wireshark, Velociraptor, Volatility, or EnCase is desirable.
• - Qualifications & Professional Competencies: Hold a degree in Cyber Security, Computer Science, or a related discipline, or possess equivalent practical experience. Relevant certifications such as GCIH, GCFA, GCIA, SC-200, CySA+, or CISSP are advantageous. Prior experience in banking, financial services, or other regulated environments is preferred, along with strong analytical skills, sound judgement under pressure, effective stakeholder communication, and an understanding of regulatory, confidentiality, and data privacy requirements within the EMEA environment.