Security Engineer (Cyber Incident Investigation & Response)

Computappoint; Greater London; Hybrid; GBP 83,000 - 138,000; Full time

Job summary

Computappoint is seeking a Security Engineer to act as the technical escalation point above the SOC, owning complex incidents and driving investigations to resolution.

The role focuses on incident triage, forensic analysis, threat hunting, and remediation within a large enterprise environment. You will investigate escalated events, determine IoCs, and enhance detection with engineering and threat-informed controls.

Qualifications

• Experience in Security Engineering, Incident Response, Digital Forensics, Threat Hunting, or SOC environments.
• Hands-on incident investigation in enterprise-scale environments.
• Ability to perform forensic analysis across endpoints, identities, network and cloud.
• Experience identifying IoCs and attacker activity, with remediation actions.
• Strong KQL development with SIEM/EDR and monitoring platforms.
• Excellent analytical and communication skills for stakeholders.

Responsibilities

• Investigate and lead response to security incidents from SOC to containment.
• Perform forensic analysis across endpoints, identities, network and cloud.
• Identify IoCs, attacker behaviours and attack pathways.
• Develop detection logic, correlation rules, and KQL queries.
• Produce findings, remediation recommendations and lessons learned.
• Collaborate with security ops, infra and apps teams to strengthen controls.

Skills

Security Engineering

Incident Response

Digital Forensics

Threat Hunting

SIEM / EDR

KQL queries

Communication skills

Tools

SIEM

EDR

KQL

Job description

Security Engineer (Cyber Incident Investigation & Response) | Outside IR35 Contract | Hybrid

• Rate: Market Rates
• Hybrid: 2 days a week onsite in London
• Industry: Highly Regulated Firm

Security Engineer (Cyber Incident Investigation & Response)

Our client is looking for a strong Security Engineer to act as the technical escalation point above their SOC function, taking ownership of complex security incidents and driving investigations through to resolution.

This is a hands‑on role focused on incident triage, forensic investigation, threat analysis, and remediation within a large enterprise environment.

You will be responsible for investigating escalated security events, identifying indicators of compromise (IoCs), performing root cause analysis, and improving detection capabilities through engineering and threat‑informed defence measures.

Key Responsibilities

• Investigate and lead the response to security incidents escalated from the SOC team through to containment and remediation
• Perform forensic analysis across endpoints, identities, network, and cloud environments to determine scope, impact, and root cause
• Identify, analyse, and validate indicators of compromise (IoCs), attacker behaviours, and attack pathways
• Develop and optimise detection logic, correlation rules, and KQL queries to improve threat visibility and response effectiveness
• Produce clear technical findings, remediation recommendations, and lessons learned following security incidents
• Partner with security operations, infrastructure, and application teams to strengthen security controls and reduce future risk

Qualifications and Requirements

• Previous experience in Security Engineering, Incident Response, Digital Forensics, Threat Hunting, or advanced SOC environments
• Strong hands‑on experience investigating escalated cyber security incidents within enterprise‑scale environments
• Proven ability to conduct forensic analysis and determine root cause across endpoint, identity, network, and cloud technologies
• Experience identifying indicators of compromise (IoCs), mapping attacker activity, and recommending effective remediation actions
• Strong KQL query development skills and experience working with SIEM, EDR, and security monitoring platforms
• Excellent analytical and communication skills, with the ability to present technical findings to both technical and non‑technical stakeholders

This role would suit someone who enjoys deep technical investigation, security engineering, and incident remediation rather than traditional alert monitoring or administrative SOC activities.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~