ServiceNow SIR Engineer | Hybrid Cyber Incident Specialist

Cyber UK; Warrington; Hybrid; GBP 117,096 - 158,424; Part time

Job summary

Cyber UK is seeking a Security Incident Response Engineer to design and embed robust incident response capabilities in the ServiceNow SIR module, aligned to NCSC and best‑practice frameworks.

You will work at the intersection of cyber operations and ServiceNow engineering, integrating with SIEM/SOC tools, building dashboards, playbooks and documenting configurations.

The role is hybrid in Warrington, 6‑month contract with potential extension, SC clearance preferred.

Qualifications

• Proven ServiceNow experience, ideally with SecOps/SIR.
• Strong background in cyber security and incident response.
• Experience engaging with stakeholders across Cyber Operations, IT and senior management.
• Public sector experience is beneficial but not essential if SIR credentials are strong.

Responsibilities

• ServiceNow SIR workflow design & development.
• Review and translate incident processes into ServiceNow SIR workflows.
• Platform configuration & enhancement.
• Systems integration & automation with SIEM/SOC tools, ITSM, and SOAR.
• Data dashboards and reporting for CSOC analysts and senior management.
• Documentation & playbooks for maintainability.
• Training & BAU handover to embed SIR into operations.

Skills

ServiceNow

SecOps/SIR

Stakeholder mgmt

SOC/CSOC

SIEM integration

Tools

CSOC tooling

Job description

Cyber UK is seeking a Security Incident Response Engineer to design and embed robust incident response capabilities in the ServiceNow SIR module, aligned to NCSC and best‑practice frameworks.

You will work at the intersection of cyber operations and ServiceNow engineering, integrating with SIEM/SOC tools, building dashboards, playbooks and documenting configurations.

The role is hybrid in Warrington, 6‑month contract with potential extension, SC clearance preferred.