SOC Incident Response Pro: Cloud, Linux & Containers

Experis (Austria); Greater London; On-site; GBP 70,000 - 90,000; Full time

Job summary

The Incident Response Specialist role in London focuses on hands-on SOC operations, threat detection, and incident response across macOS, Linux, cloud, and containerised environments. You will monitor alerts, investigate incidents, contain threats, coordinate remediation, and contribute to playbooks and detection rules.

The ideal candidate has strong documentation skills and can communicate complex findings to technical and business stakeholders.

Qualifications

• Proven experience within a Security Operations Centre (SOC) or Incident Response function.
• Experience investigating threats across macOS, Linux, cloud, and containers.
• Experience with SIEM, EDR/XDR, cloud monitoring tools.
• Strong understanding of cyber threat detection and incident response methodologies.
• Knowledge of attacker TTPs.
• Familiarity with the MITRE ATT&CK Framework.
• Experience correlating security telemetry from multiple sources.
• Strong documentation and reporting skills.

Responsibilities

• Monitor and triage security alerts in a SOC environment.
• Investigate incidents across endpoints, cloud, and apps.
• Analyze events for severity, scope, impact, and remediation requirements.
• Contain, recover, and remediate incidents; coordinate actions.
• Document investigation findings and response actions.
• Escalate complex incidents with technical and security teams.
• Contribute to detection rules, response playbooks, and process improvements.

Skills

SOC experience

Incident response

MITRE ATT&CK

Threat detection

EDR/XDR

Cloud monitoring

macOS/Linux

Container security

Documentation

Communication

Tools

SIEM

EDR/XDR

Cloud tools

Job description

The Incident Response Specialist role in London focuses on hands-on SOC operations, threat detection, and incident response across macOS, Linux, cloud, and containerised environments. You will monitor alerts, investigate incidents, contain threats, coordinate remediation, and contribute to playbooks and detection rules.

The ideal candidate has strong documentation skills and can communicate complex findings to technical and business stakeholders.