Incident Response Specialist

Experis (Austria); Greater London; On-site; GBP 70,000 - 90,000; Full time

Job summary

The Incident Response Specialist role in London focuses on hands-on SOC operations, threat detection, and incident response across macOS, Linux, cloud, and containerised environments. You will monitor alerts, investigate incidents, contain threats, coordinate remediation, and contribute to playbooks and detection rules.

The ideal candidate has strong documentation skills and can communicate complex findings to technical and business stakeholders.

Qualifications

• Proven experience within a Security Operations Centre (SOC) or Incident Response function.
• Experience investigating threats across macOS, Linux, cloud, and containers.
• Experience with SIEM, EDR/XDR, cloud monitoring tools.
• Strong understanding of cyber threat detection and incident response methodologies.
• Knowledge of attacker TTPs.
• Familiarity with the MITRE ATT&CK Framework.
• Experience correlating security telemetry from multiple sources.
• Strong documentation and reporting skills.

Responsibilities

• Monitor and triage security alerts in a SOC environment.
• Investigate incidents across endpoints, cloud, and apps.
• Analyze events for severity, scope, impact, and remediation requirements.
• Contain, recover, and remediate incidents; coordinate actions.
• Document investigation findings and response actions.
• Escalate complex incidents with technical and security teams.
• Contribute to detection rules, response playbooks, and process improvements.

Skills

SOC experience

Incident response

MITRE ATT&CK

Threat detection

EDR/XDR

Cloud monitoring

macOS/Linux

Container security

Documentation

Communication

Tools

SIEM

EDR/XDR

Cloud tools

Job description

Incident Response Specialist (SOC)

Location: London (Onsite)
Duration: 12 Months
Inside IR35

The Opportunity

We're seeking an experienced Incident Response Specialist to provide hands-on Security Operations Centre (SOC) and Incident Response support within a fast-paced cyber security environment.

This role focuses on monitoring, investigating, and responding to cyber security threats across macOS endpoints, Linux cloud environments, microservices, and containerised platforms. You'll work closely with security and engineering teams to contain threats, coordinate remediation activities, and continuously strengthen detection and response capabilities.

Key Responsibilities

• Monitor and triage security alerts within a SOC environment.
• Investigate and respond to cyber security incidents across endpoint, cloud, and application environments.
• Analyse security events to determine severity, scope, impact, and remediation requirements.
• Conduct investigations involving:
• macOS endpoints
• Linux cloud workloads
• Microservices architectures
• Containerised environments
• Support incident containment, recovery, and remediation activities.
• Document investigation findings, evidence, and response actions.
• Escalate complex incidents and collaborate with technical and security teams.
• Contribute to the development of detection rules, response playbooks, and process improvements.

Essential Skills & Experience

• Proven experience within a Security Operations Centre (SOC) or Incident Response function.
• Hands-on experience investigating threats across:
• macOS
• Linux
• Cloud platforms
• Containers and microservices
• Experience with:
• SIEM platforms
• EDR/XDR technologies
• Cloud security monitoring tools
• Strong understanding of cyber threat detection and incident response methodologies.
• Knowledge of attacker tactics, techniques, and procedures (TTPs).
• Familiarity with the MITRE ATT&CK Framework.
• Experience correlating security telemetry from multiple sources to assess threats and incidents.
• Strong documentation and reporting skills.
• Ability to communicate technical findings clearly to technical and non-technical stakeholders.

What We're Looking For

You’ll be a proactive cyber security professional who thrives in operational environments and enjoys investigating complex security incidents. Comfortable working under pressure, you’ll have a strong analytical mindset and a passion for improving cyber resilience through effective threat detection, investigation, and response.

If you have strong SOC and Incident Response experience across cloud, Linux, macOS, and containerised environments, we’d love to hear from you.