Security Consultant

Consult; Greater London; Hybrid; GBP 55,000 - 70,000; Full time

Job summary

Consult is seeking a Cyber Security Consultant to design, develop and optimise detection and response capabilities across SIEM, XDR and SOAR technologies for a variety of customers.

You will deliver detection engineering engagements, create and optimise detection logic, and develop incident response playbooks while acting as a trusted advisor in workshops and customer meetings.

Qualifications

• Experience in security consulting and customer-facing environments.
• Strong knowledge of SIEM/XDR/SOAR tech and detection engineering.
• Ability to design and implement detection rules and playbooks.

Responsibilities

• Design and implement high-quality detection rules across SIEM and XDR platforms.
• Develop detection use cases aligned with MITRE ATT&CK framework.
• Build SOAR automations and incident response workflows.
• Produce technical documentation and coverage assessments for customers.
• Lead workshops and present recommendations to stakeholders.

Skills

SIEM engineering

Detection engineering

KQL

SOAR platforms

Python

PowerShell

MITRE ATT&CK

XDR/EDR tech

Microsoft Defender

CrowdStrike

Cortex XDR

SentinelOne

Azure security

Log onboarding

Threat intelligence

Customer-facing

Tools

Logic Apps

Cortex XSOAR

SentinelOne

Cortex XDR

Microsoft Defender

Job description

Cyber Security Consultant | £55,000 - £70,000 + bonus | Hybrid | MSP

This is a customer-facing consultancy role where you'll work with a wide range of organisations to design, develop and optimise detection and response capabilities across leading SIEM, XDR and SOAR technologies. You'll combine deep technical expertise with strong consulting skills, helping customers improve their security maturity through practical, scalable solutions.

What you'll be doing

You'll play a key role in delivering detection engineering engagements, including:

• Designing and implementing high-quality detection rules across SIEM and XDR platforms.
• Creating and optimising detection logic using KQL and other query languages.
• Developing detection use cases aligned with the MITRE ATT&CK framework and current threat techniques.
• Assessing customer telemetry and identifying opportunities to improve visibility and detection coverage.
• Building SOAR automations, integrations and response workflows to reduce manual effort.
• Developing incident response playbooks that support effective Security Operations Centre (SOC) processes.
• Applying threat intelligence to continuously improve detections and response capabilities.
• Promoting a Detection-as-Code approach, ensuring detection content is scalable, version controlled and repeatable.
• Producing clear technical documentation, detection strategies and coverage assessments for customers.

Alongside technical delivery, you'll act as a trusted advisor by leading workshops, presenting recommendations to stakeholders and helping customers develop long-term detection strategies.

What we're looking for

We're interested in security professionals who enjoy solving complex problems and working closely with customers.

You’ll ideally have experience with:

• SIEM engineering, preferably Microsoft Sentinel.
• Detection engineering and rule development using KQL or similar languages.
• SOAR platforms such as Microsoft Logic Apps, Cortex XSOAR or equivalent.
• Python, PowerShell or other scripting languages for automation and API integration.
• MITRE ATT&CK and threat-informed detection engineering.
• XDR/EDR technologies including Microsoft Defender, CrowdStrike, Cortex XDR or SentinelOne.
• Azure security monitoring and cloud telemetry.
• Log source onboarding, data normalisation and detection coverage analysis.
• Threat intelligence integration and enrichment.
• Customer-facing consultancy or professional services environments.