Incident Response Lead for Cyber Defense (FTC, Hybrid)

Michael Page; West Kirby; Hybrid; GBP 55,000 - 75,000; Full time

Benefits offered by this job

Private healthcare

Life assurance

Training & development

Job summary

Michael Page is seeking a skilled L3 SOC Analyst/Security Engineer to investigate and respond to security incidents escalated by the SOC. You will perform in‑depth event analysis, detect threats, and work with external MSSPs to ensure effective monitoring and remediation.

You will help implement and refine operational security controls, conduct system reviews, and drive continuous security improvements across cloud and on‑prem environments in a hybrid UK setting.

Qualifications

• Experience as an L3 SOC Analyst or Security Engineer.
• Strong background in security operations, incident response and threat detection.
• Hands-on cyber security investigation and remediation experience.
• Exposure to detection engineering and cloud/enterprise environments.
• Familiarity with MITRE ATT&CK framework.

Responsibilities

• Investigate and respond to security incidents escalated through Security Operations.
• Perform detailed security event analysis and identify threats or areas for investigation.
• Collaborate with external security providers for monitoring and incident handling.
• Remediation and recommendations to improve security controls and reduce risk.
• Conduct security reviews of systems, infrastructure, and processes.
• Drive continuous security improvements and implement operational controls.

Skills

L3 SOC Analyst

Security Engineer

Security operations

Incident response

Threat detection

MITRE ATT&CK

Cloud security

End-to-end investigation

Job description

Michael Page is seeking a skilled L3 SOC Analyst/Security Engineer to investigate and respond to security incidents escalated by the SOC. You will perform in‑depth event analysis, detect threats, and work with external MSSPs to ensure effective monitoring and remediation.

You will help implement and refine operational security controls, conduct system reviews, and drive continuous security improvements across cloud and on‑prem environments in a hybrid UK setting.