Cyber Incident Responder

Ellis IT; Stati Uniti; Ibrido; USD 59.000 - 79.000; Tempo pieno

Vantaggi offerti da questo lavoro

Remote/onsite mix

Competitive salary £45k-£60k

Descrizione del lavoro

Ellis IT in Manchester, United Kingdom, seeks an experienced security professional to lead cyber incident response for active breaches across law firms, corporates and government clients. The role blends remote and onsite engagement, demanding rapid containment, forensics and clear guidance under pressure.

You will coordinate teams, analyze logs (Office 365 telemetry included), perform forensic acquisitions and malware analysis to guide remediation. Immediate start.

Competenze

• 4+ years hands-on cybersecurity operations.
• Knowledge of Cyber Kill Chain and MITRE ATT&CK.
• Understanding of defence-in-depth security controls.
• Experience with incident handling, threat hunting, and threat intel workflows.
• Proficiency with HIDS/IDS/IPS, SIEMs, AD controllers, and firewalls.
• Cloud knowledge across Azure, Office 365, AWS and Google Cloud.

Mansioni

• Lead emergency incident response with containment, mitigation and remediation.
• Coordinate remote and onsite initial responses, organising teams and resources.
• Collect, correlate and analyse logs from servers, firewalls, IDS/IPS, traffic, and hosts, focusing on Office 365 telemetry.
• Carry out forensic acquisitions preserving evidentiary integrity.
• Perform malware analysis to determine scope, behaviour and remediation paths.

Conoscenze

Cybersecurity ops

Cyber Kill Chain

MITRE ATT&CK

Security architecture

Incident handling

Threat hunting

Threat intelligence

HIDS/IDS/IPS

SIEMs

Active Directory

Strumenti

HIDS

IDS/IPS

SIEM

Active Directory

Firewalls

Azure

Office 365

AWS

Google Cloud

Descrizione del lavoro

Role overview

This permanent position places an experienced security professional at the centre of cyber incident response, supporting law firms, corporate organisations, and law enforcement clients during active breaches and compromises. The work blends remote and onsite engagement, calling for someone who can lead containment efforts, perform digital forensics, and translate technical findings into clear, actionable guidance under time pressure.

Responsibilities

• Lead emergency incident response activities, delivering containment, mitigation, and remediation actions against active threats.
• Coordinate initial response efforts both remotely and onsite, organising teams and resources to stabilise affected customer environments.
• Collect, correlate, and analyse logs from servers, firewalls, intrusion detection systems, traffic flows, and host systems, with a particular emphasis on Office 365 telemetry.
• Carry out forensic acquisitions of disks, volatile memory, mobile devices, and other relevant data sources while preserving evidentiary integrity.
• Perform malware analysis to determine scope, behaviour, and effective remediation paths.

Requirements

• At least four years of hands-on experience in cybersecurity operations.
• Demonstrated command of frameworks such as the Cyber Kill Chain and MITRE ATT&CK, alongside broader security intelligence concepts.
• Solid grasp of enterprise-grade security controls and defence-in-depth architectures.
• Practical experience with incident handling, threat hunting, and threat intelligence workflows.
• Proficiency working with HIDS, IDS/IPS platforms, SIEMs, Active Directory controllers, and firewalls.
• Working knowledge of cloud environments spanning Microsoft Azure, Office 365, Amazon Web Services, and Google Cloud.

Benefits and work setup

• Permanent, full-time role based in Manchester, United Kingdom, with an immediate start.
• Salary range of £45,000 to £60,000, dependent on experience.
• Mix of remote and onsite client engagement, with exposure to a varied portfolio of legal, corporate, and public-sector cases.