Incident Response Specialist

CBSbutler Holdings Limited trading as CBSbutler; City Of London; On-site; GBP 83,000 - 96,000; Full time

Job summary

CBSbutler Holdings Limited trading as CBSbutler is seeking an Incident Response Specialist to provide hands-on SOC and incident response across endpoints, cloud and applications in London. You will investigate threats, coordinate containment and remediation, and strengthen our detection capabilities.

The role focuses on macOS endpoints, Linux workloads in cloud environments, microservices and containers, with on-site work in London and shift patterns aligned to customer needs.

Qualifications

• Experience investigating cyber security threats and incidents across endpoints, cloud environments and applications.

Responsibilities

• Monitor security alerts, triage and investigate incidents.
• Assess incident severity, scope and required response actions.
• Contain and remediate incidents; maintain records.
• Investigate threats across macOS endpoints, Linux workloads, microservices.
• Analyze telemetry across endpoints, cloud and applications.
• Escalate significant incidents and collaborate with SOC and technical teams.
• Contribute to improving detection capabilities, investigation processes and incident response playbooks.

Skills

macOS investigations

Linux workloads

Cloud environments

EDR/XDR

MITRE ATT&CK

SIEM

Threat detection

Incident documentation

Communication

Tools

SIEM

EDR

XDR

Cloud monitoring

Job description

Incident Response Specialist

• +12 months
• +Inside IR35
• +£60 - £70 ph
• +On site in London

We are seeking an experienced Incident Response Specialist to provide hands‑on Security Operations Centre (SOC) and incident response support across endpoint, cloud and application environments.

The successful candidate will investigate and respond to cyber security threats, with a particular focus on macOS endpoints, Linux cloud workloads, microservices and containerised environments. You will work closely with security and technical teams to assess incidents, support containment and remediation, and improve threat detection and response capabilities.

Key Responsibilities

• Monitor security alerts, perform triage and investigate potential incidents.
• Assess incident severity, scope, impact and required response actions.
• Conduct incident investigations and support containment and remediation activities.
• Investigate threats across macOS endpoints, Linux cloud workloads, microservices and containerised environments.
• Analyse and correlate security telemetry across endpoint, cloud and application environments.
• Maintain accurate incident records, investigation evidence and response documentation.
• Escalate significant incidents and collaborate with SOC and technical teams.
• Contribute to improving detection capabilities, investigation processes and incident response playbooks.

Essential Skills and Experience

• Practical experience investigating cyber security threats and incidents across endpoints, cloud environments and applications.
• Hands‑on experience with macOS security investigations and Linux workloads in cloud environments.
• Understanding of microservices and containerised environments.
• Experience using SIEM, EDR/XDR and cloud security monitoring technologies.
• Strong knowledge of threat detection, attacker tactics and techniques, including the MITRE ATT&CK framework.
• Ability to analyse security telemetry and determine incident severity, scope and impact.
• Experience documenting investigations, maintaining evidence and communicating findings clearly.
• Strong collaboration and communication skills, with the ability to engage technical and non-technical stakeholders.

Working Arrangements

• Location: On-site in London
• Working hours: 10-hour shifts between 06:00 and 16:00.
• Shift pattern: Sunday to Wednesday or Wednesday to Saturday, as directed by the customer.

Candidates must be comfortable working in a fast‑paced security operations environment and responding effectively to emerging cyber security threats.