Incident Response Engineer — CSIRT & Threat Automation

Airbus S.A.S.; Hordle; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Season ticket loan

Car leasing scheme

Free onsite parking

Discounted shopping

Job summary

Airbus Defence and Space is seeking an Incident Response Analyst for its international CSIRT in Newport. You will manage full incident lifecycles, perform host forensics, and help industrialise security tooling across SOC Level 1/2, coordinating globally.

The role emphasizes automated response workflows, threat detection enhancements, and collaboration with a high‑tech, multi‑national team. A relevant degree and GIAC cert are preferred, with on‑call responsibilities and hybrid working options.

Qualifications

• Experience managing security incidents in a technical SOC/CSIRT environment.
• Experience performing host forensic analysis and reverse‑engineering for incident response.
• Experience designing and improving security processes, detection use cases and automated responses.

Responsibilities

• Investigate SOC alerts and manage the full lifecycle of security incidents.
• Support incident response in crisis mode as part of on‑call team, performing host forensics and reverse engineering.
• Contribute to tooling industrialisation (SIEM, EDR) and development of new detection use cases.
• Design, implement and coordinate incident response processes for SOC Level 1 and 2 across teams.
• Drive continuous improvement of threat detection and response capabilities within SOC operations.
• Execute projects related to advanced security monitoring and automated incident response workflows.

Skills

Security incident management

SOC/CSIRT operations

SIEM/EDR tooling

Forensic analysis

Reverse engineering

Threat detection

Incident response process design

Education

Relevant degree

GIAC certification

Tools

SIEM

EDR

Job description

Airbus Defence and Space is seeking an Incident Response Analyst for its international CSIRT in Newport. You will manage full incident lifecycles, perform host forensics, and help industrialise security tooling across SOC Level 1/2, coordinating globally.

The role emphasizes automated response workflows, threat detection enhancements, and collaboration with a high‑tech, multi‑national team. A relevant degree and GIAC cert are preferred, with on‑call responsibilities and hybrid working options.