Security Consultant

Franklin Fitch; England; Hybrid; GBP 55,000 - 70,000; Full time

Job summary

Franklin Fitch is seeking a Cyber Security Consultant for a hybrid MSP role in the UK. You will design, develop and optimise detection and response capabilities across SIEM, XDR, and SOAR, delivering customer-facing engagements.

The role blends technical delivery with advisory duties, implementing detection rules, MITRE ATT&CK-aligned use cases and SOAR automations while producing clear documentation and guidance to strengthen clients' security postures.

Qualifications

• Experience delivering detection engineering engagements with SIEM/XDR.
• Proven ability to design and implement detection rules and logic.
• Experience with MITRE ATT&CK aligned detections and threat intel.

Responsibilities

• Design and implement high-quality detection rules across SIEM and XDR platforms.
• Develop detection use cases aligned with MITRE ATT&CK framework.
• Build SOAR automations and incident response workflows.
• Provide customer-facing advisory and workshops to mature detection capabilities.

Skills

SIEM engineering

Detection engineering

SOAR platforms

Python scripting

PowerShell scripting

MITRE ATTACK

XDR/EDR technologies

Azure security monitoring

Cloud telemetry

Customer-facing consultancy

Tools

Cortex XSOAR

Microsoft Logic Apps

SentinelOne

Microsoft Sentinel

Job description

Cyber Security Consultant | £55,000 - £70,000 + bonus | Hybrid | MSP

This is a customer-facing consultancy role where you'll work with a wide range of organisations to design, develop and optimise detection and response capabilities across leading SIEM, XDR and SOAR technologies. You'll combine deep technical expertise with strong consulting skills, helping customers improve their security maturity through practical, scalable solutions.

What you'll be doing

You'll play a key role in delivering detection engineering engagements, including:

• Designing and implementing high-quality detection rules across SIEM and XDR platforms.
• Creating and optimising detection logic using KQL and other query languages.
• Developing detection use cases aligned with the MITRE ATT&CK framework and current threat techniques.
• Assessing customer telemetry and identifying opportunities to improve visibility and detection coverage.
• Building SOAR automations, integrations and response workflows to reduce manual effort.
• Developing incident response playbooks that support effective Security Operations Centre (SOC) processes.
• Applying threat intelligence to continuously improve detections and response capabilities.
• Promoting a Detection-as-Code approach, ensuring detection content is scalable, version controlled and repeatable.
• Producing clear technical documentation, detection strategies and coverage assessments for customers.

Alongside technical delivery, you'll act as a trusted advisor by leading workshops, presenting recommendations to stakeholders and helping customers develop long-term detection strategies.

What we're looking for

We're interested in security professionals who enjoy solving complex problems and working closely with customers.

You'll ideally have experience with:

• SIEM engineering, preferably Microsoft Sentinel.
• Detection engineering and rule development using KQL or similar languages.
• SOAR platforms such as Microsoft Logic Apps, Cortex XSOAR or equivalent.
• Python, PowerShell or other scripting languages for automation and API integration.
• MITRE ATT&CK and threat-informed detection engineering.
• XDR/EDR technologies including Microsoft Defender, CrowdStrike, Cortex XDR or SentinelOne.
• Azure security monitoring and cloud telemetry.
• Log source onboarding, data normalisation and detection coverage analysis.
• Threat intelligence integration and enrichment.
• Customer-facing consultancy or professional services environments.