Incident Response Engineer - CSIRT (Hybrid)

Airbus S.A.S.; St Leonards; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Profit sharing

Contributory pension

Share options

Car leasing scheme

Free onsite parking

Season ticket loan

Tax-free technology scheme

Discounted shopping

Job summary

Airbus Defence and Space is seeking an Incident Response Analyst to join the international CSIRT in Newport. You will manage the full lifecycle of security incidents, support SOC services, and drive automation and detection use cases across the enterprise.

This hands-on role requires experience with SIEM/EDR, on-call crisis responsiveness, and a proactive approach to improving security processes and incident workflows.

Qualifications

• Experience managing security incidents and monitoring SOC alerts in a technical CSIRT environment.
• Experience performing host forensic analysis and reverse-engineering to support incident response.
• Experience designing and improving security processes, use cases, and automated response capabilities.
• Knowledge of cyber security principles, practical application, degree or equivalent experience, and GIAC certifications.

Responsibilities

• Investigate SOC alerts and manage full lifecycle of security incidents.
• Support incident response in crisis mode as part of on-call team.
• Industrialise security tooling (SIEM/EDR) and develop new detection use cases.
• Design and coordinate incident response processes for SOC Level 1/2 across teams.
• Drive continuous improvement of threat detection and response capabilities.

Skills

Security incident management

CSIRT/SOC experience

Threat detection concepts

Crisis response & on-call

Automation & tooling

Education

Bachelor's degree in cybersecurity or related field

Industry certifications (GIAC)

Tools

SIEM

EDR

Forensic tools

Job description

Airbus Defence and Space is seeking an Incident Response Analyst to join the international CSIRT in Newport. You will manage the full lifecycle of security incidents, support SOC services, and drive automation and detection use cases across the enterprise.

This hands-on role requires experience with SIEM/EDR, on-call crisis responsiveness, and a proactive approach to improving security processes and incident workflows.