Incident Response Engineer – CSIRT & Automation

Airbus S.A.S.; Sandown; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Annual profit share

Contributory pension

Share options

Free onsite parking

Season ticket loan

Tax‑free technology scheme

Discounted shopping

Job summary

Airbus Defence and Space is seeking an Incident Response Analyst to join the international CSIRT in Newport. You will manage the full lifecycle of security incidents, support SOC service delivery, and help industrialise tooling for threat detection across our global enterprise.

The role is highly technical, on‑call capable, with a focus on automation and improving incident response workflows. Candidates should have strong SOC/CSIRT experience and related certifications.

Qualifications

• Experience managing security incidents within a SOC/CSIRT environment.
• Experience performing host forensic analysis and reverse engineering.
• Experience designing or improving security processes and automated responses.
• Degree or equivalent with cybersecurity knowledge; GIAC certification preferred.

Responsibilities

• Investigate SOC alerts and manage the full lifecycle of security incidents.
• Support incident response in crisis mode as part of the on‑call crisis team.
• Contribute to the industrialisation of security tooling (SIEM, EDR) and new detection use cases.
• Design, implement, and coordinate robust incident response processes for SOC Level 1 and 2.
• Drive continuous improvement of threat detection and response capabilities.
• Execute projects related to advanced security monitoring and automated incident response.

Skills

Incident response

SOC/CSIRT experience

Forensic analysis

Reverse engineering

Security tooling

Threat detection

Process improvement

Cybersecurity principles

Education

Bachelor's degree or equivalent

GIAC certification

Tools

SIEM

EDR

Forensic tools

Job description

Airbus Defence and Space is seeking an Incident Response Analyst to join the international CSIRT in Newport. You will manage the full lifecycle of security incidents, support SOC service delivery, and help industrialise tooling for threat detection across our global enterprise.

The role is highly technical, on‑call capable, with a focus on automation and improving incident response workflows. Candidates should have strong SOC/CSIRT experience and related certifications.