Senior Threat Detection & Incident Response Engineer

Jobtailor; Cambridge; On-site; GBP 65,000 - 95,000; Full time

Job summary

Jobtailor in Cambridge is seeking a hands-on security investigator to lead investigations into escalated incidents, develop hypotheses, collect artefacts and determine root cause across endpoints, networks and cloud. You will build and optimise detection rules, queries and monitoring logic to strengthen our security posture.

The role covers threat hunting using MITRE ATT&CK, creating runbooks and automation to speed investigations, and collaborating with external SOC and internal engineering

Qualifications

• Hands-on experience investigating security incidents, including developing investigation hypotheses, collecting artefacts and analysing endpoint, network and application data.
• Strong working knowledge of SIEM and security monitoring tooling, including the ability to write and develop queries for complex investigations.
• Understanding of adversary tactics, techniques and procedures (TTPs), offensive security concepts and MITRE ATT&CK principles.
• Practical knowledge of cloud environments and security controls, with the ability to apply detection and incident response practices across hybrid infrastructure.
• Background developing detection logic, runbooks, automation or security tooling.
• Knowledge of operating system internals and forensic investigation across Windows, macOS or Linux environments.
• Scripting knowledge such as PowerShell or Python would be advantageous.

Responsibilities

• Lead investigations into escalated security events and incidents, developing hypotheses, collecting evidence and determining root cause and impact.
• Build and optimise detection rules, queries and monitoring logic across cloud, endpoint, network and application environments.
• Develop tooling and automation to improve security telemetry, alert enrichment, investigation workflows and response times.
• Conduct threat hunting using adversary behaviours, TTPs and frameworks such as MITRE ATT&CK, incorporating findings into security controls and detections.
• Create and continuously improve incident runbooks, playbooks and detection processes based on findings from real-world investigations.
• Work with the external SOC and internal engineering teams to strengthen monitoring coverage, investigate escalations and continuously improve detection and response capability.
• Participate in an on-call rotation.

Skills

Incident Investigation

Detection Logic Development

MITRE ATT&CK

SIEM Tooling

Cloud Security

Threat Hunting

Forensic Investigation

Scripting (PowerShell/Python)

Tools

SIEM

Security Monitoring Tooling

Automation Tools

Job description

Jobtailor in Cambridge is seeking a hands-on security investigator to lead investigations into escalated incidents, develop hypotheses, collect artefacts and determine root cause across endpoints, networks and cloud. You will build and optimise detection rules, queries and monitoring logic to strengthen our security posture.

The role covers threat hunting using MITRE ATT&CK, creating runbooks and automation to speed investigations, and collaborating with external SOC and internal engineering