51 Incident Response jobs in London
Incident Response Lawyer
Posted today
Job Viewed
Job Description
We are representing a consultancy that are a leader in the Cyber Security and Incident response space. If you have experience leading the legal aspects of Data Breach case this could be the role for you. This role is open to any of the multiple offices my client has across the UK.
The client is looking for a Principal Associate to support and shape the delivery of expert incident response, digital risk, and cyber advisory services for a broad portfolio of global clients, from tech innovators and major insurers to public sector bodies and emergency services.
This award-winning cyber group is uniquely positioned at the intersection of law, digital forensics, and strategic response. With capabilities that span incident response, regulatory strategy, privacy law, threat intelligence, security controls, and tech litigation, they’re rewriting how legal support is delivered in high-pressure digital environments.
What You’ll Be Doing
You’ll play a critical role across matters ranging from real-time cyber incidents to regulatory investigations, and ongoing advisory support. Key responsibilities include:
- Leading and managing a caseload of cyber security incidents and data breaches
- Supporting strategic response plans for clients and helping them build resilience
- Providing coverage advice and monitoring counsel support for insurer clients
- Developing junior team members and helping grow our cyber legal offering
- Engaging directly with regulators, forensic experts, insurers, and corporate stakeholders
- Driving client solutions across legal, technical, and commercial dimensions
Ideal Candidate
- UK-qualified solicitor with 4+ years’ PQE
- Demonstrable experience in cyber and data protection law and experience working on Live Incidents
- Calm under pressure, especially in crisis situations and time-sensitive incident response
- Ideally experienced within the UK cyber insurance market (policy and claims exposure a bonus)
- Outstanding communicator, credible with clients, colleagues, and counterparties
- Familiar with SLA-driven work and high standards of compliance and reporting
Apply to start the conversation today.
Incident Response Lawyer
Posted today
Job Viewed
Job Description
Incident Response Lawyer
Posted today
Job Viewed
Job Description
Incident Response Assistant Manager
Posted today
Job Viewed
Job Description
Incident Response Assistant Manager (Client facing)
Hybrid/ flexible on location - London, Manchester, Birmingham, ect
£50k – £60k
A global Risk consultancy is looking for Strong Incident Response professionals to join their Cyber Response Team, within an area of huge growth and investment.
This is an excellent opportunity for exposure and growth! If you’re looking for the next step in your incident response career, we’d love to talk to you.
Day to day Responsibilities of an Incident Response Assistant Manager
- Manage cyber security incidents for clients, including digital forensics of relevant data
- Act as an advisor to clients on current cyber threats
- Liaise with clients on delivery and implementation
Requirements for an Incident Response Assistant Manager
- Broad knowledge and understanding across the cyber security landscape to be able to act as an advisor on the threat landscape
- Strong technical background (networks and programming knowledge)
- Proven experience working within Incident management and response
- Excellent communication both written and verbal.
- Incident Management Certifications are not necessary but are a nice to have! Such as CREST certified incident manager (CCIM) or GIAC Certified Incident Handler (GCIH)
If this looks interesting to you, please apply or reach out to Georgia at
Incident Response Assistant Manager
Posted today
Job Viewed
Job Description
Incident Response Assistant Manager
Posted today
Job Viewed
Job Description
Director, Cyber Defense (Incident Response)
Posted today
Job Viewed
Job Description
You will design and evolve scalable frameworks that combine detection engineering, forensics, threat intelligence, and automation to strengthen resilience. Beyond containment and recovery, you'll translate emerging threats into proactive defense strategies and advise executives during crises.
Collaboration is key, working with Threat Operations, Penetration Testing, Detection Engineering, and business collaborators to improve enterprise-wide readiness. You'll also mentor security analysts, sharing technical expertise and building the next generation of responders.
This role necessitates exhibited expertise in intricate investigations, good judgment in fast-paced circumstances, and the capability to impact across a global, matrixed environment. It is a pinnacle technical position within the Detection & Response program, offering broad impact without direct people management responsibilities.
Responsibilities & Accountabilities
+ Serve as the lead responder and technical authority for global crisis-level cybersecurity incidents, coordinating across executive, legal, and operational teams.
+ Architect and optimize detection and containment strategies that align to business operations and risk tolerance.
+ Develop detection logic, automation workflows, and forensic capabilities to accelerate MTTD and MTTR across distributed environments.
+ Author and present high-impact executive-level incident reports and technical debriefs.
+ Lead efforts to harden enterprise resilience by embedding lessons learned from incidents into architecture, policies, and controls.
+ Champion training, mentoring, and upskilling of existing team members by building structured career pathways, facilitating cross-team knowledge sharing, and guiding analysts toward advanced technical and leadership roles.
The ideal candidate for this role is a recognised subject matter authority in incident response with a demonstrated ability to lead complex, enterprise-wide security investigations. You bring deep technical expertise, critical thinking, and operational excellence to the table. You are fluent in modern adversary tradecraft, and your insights directly influence global cyber defense strategy.
Experience required:
+ Proven expertise in conducting and directing advanced investigations involving APTs, insider threats, malware outbreaks, and zero-day exploitation across hybrid environments (on-premise/cloud).
+ Proficiency in core security fields such as digital forensics (host and memory), malware reverse engineering, adversary simulation, and advanced threat detection.
+ Outstanding communication and storytelling skills-capable of distilling intricate technical situations for senior, legal, and business management.
+ Experience leading cross-functional incident post mortems, driving remediation roadmaps, and advancing organizational readiness through simulations, playbooks, and table top exercises.
+ Ability to drive continuous improvement by evaluating emerging technologies, evolving adversary tactics, and integrating new intelligence into response playbooks.
Desired Skills:
+ Advanced security certifications such as CISSP, OSCE, GCFA, GNFA, GREM, or GCTI.
+ Experience architecting scalable IR capabilities or transforming incident response programs across large, globally distributed enterprises.
+ Strong understanding of legal and regulatory requirements surrounding data breach handling, eDiscovery, and evidence preservation (e.g., GDPR, PCI-DSS, CCPA).
+ Fluency in threat intelligence integration and proactive threat hunting workflows across multiple telemetry sources.
+ Experience supporting executive-level briefings during high-profile or media-sensitive incidents.
+ Prior involvement in red/blue/purple team partnership or adversary emulation planning.
+ Experience building, mentoring, and scaling high-performing security teams, with a focus on knowledge transfer and professional development.
+ Familiarity with cloud-native security architectures (AWS, Azure, GCP) and incident response in containerized or serverless environments.
Requsition ID: REF9459O_
Be The First To Know
About the latest Incident response Jobs in London !
Graduate Consultant: Cyber Incident Response
Posted 22 days ago
Job Viewed
Job Description
We are now seeking talented individuals with a keen interest in developing a career in Cyber Security to join us as Graduate Consultants in London. As the Graduate Consultant you will work on an initial one-year fixed term contract (with potential to extend). This is an excellent career opportunity to join a specialist team dedicated to supporting clients with the most severe cyber security incidences. We operate a hybrid working model that requires you to work at our office in Bank for at least three days per week.
**Please note that the recruitment process will require your attendance at a virtual assessment centre during the week commencing 29th September so you must be available to attend on one of the days that week (29th – 3rd October).
Tasks and responsibilities
Case Management
- Maintain records of each case worked on by Cyber Response.
- Manage case management metrics tools and support in analysing case histories to drive insights for future use.
Reporting
- Provide situation reports and other significant case related material to the client and or the case lead.
- Provide documentation to the case lead in sufficient time to allow review and feedback, before submitting to a client.
- Produce case summary and other reports as directed.
Supporting the growth of the Cyber Response practice
- Refining Control Risks’ cyber response methodologies and approaches and tailoring the approach in changing market conditions.
- Supporting marketing initiatives.
As the Graduate Consultant you will focus on two key areas: crisis management and incident response.
Crisis Management
- Support the Cyber Incident Response team advising clients on post incident cyber crisis management independently or in conjunction with Control Risks response department.
- Support initial assessment of case and where appropriate, providing immediate verbal/written advice, recorded in an initial information gathering form.
- Support the Crisis Management team as it provides clients with on-going advice covering:
- Liaising with key stakeholders, including the Client, law firm and communication specialists.
- Options, contingency plans and recommendations for managing the strategic and or less technical elements of a response engagement.
- Discuss and input into communications strategies and plans.
Incident Response
- Support the Cyber Incident Response team advising clients on post incident cyber crisis management independently or in conjunction with Control Risks response department.
- Support initial assessment of case and where appropriate, providing immediate verbal/written advice, recorded in an initial information gathering form.
- Support the Incident Response team as it provides clients with on-going advice covering:
- Liaison with key stakeholders, communicators/intermediaries.
- Options, contingency plans and recommendations for managing the technical elements of response engagements.
- Additional technical support e.g. network forensics, support with EDR toolsets or additional support to the Digital Forensics department
- Discuss and input into communications strategies and plans.
Requirements
Knowledge and Experience
Essential
- Understanding of the cyber threat landscape and key cyber security concepts.
- Ability to communicate clearly in written and oral form at senior levels.
- Able to explain difficult technical concepts and ideas in non-technical terms.
- Ability to see security from the attacker’s point of view.
Preferred
- Business proficiency in European Languages
- Good knowledge of IT and network infrastructure.
Benefits
- Control Risks offers a competitively positioned compensation and benefits package that is transparent and summarized in the full job offer.
- Control Risks supports hybrid working arrangements, wherever possible, that emphasize the value of in-person time together - in the office and with our clients - while continuing to support flexible and remote working.
Incident Response Engineer, UK Security Operations
Posted 9 days ago
Job Viewed
Job Description
+ Bachelor's degree or equivalent practical experience.
+ Certification in Certified Ethical Hacker (CEH), Global Information Assurance Certification (GIAC) or Computing Technology Industry Association Security+ (CompTIA Sec+).
+ 2 years of experience in similar SOC related roles, explicitly in responding to and actioning on security incidents.
+ Experience in technical troubleshooting and writing code in one or more programming languages.
+ Eligibility to obtain UK Developed Vetting (DV) security clearance; British Citizenship is required for this role.
**Preferred qualifications:**
+ Certifications in Security+ or similar Cyber Security/Incident Response.
+ Experience responding to security incidents on Kubernetes.
+ Experience analyzing, triaging, and remediating common information security incidents.
+ Understanding of common attacker tactics, tools, and techniques.
+ Excellent problem-solving and investigative skills.
+ Current and active UK Developed Vetting (DV) Security Clearance.
The UK Security Operations (SecOps) team in Google Public Sector delivers, operates and secures private cloud services. We aim to provide the flexibility, reliability, and scalability of public cloud for customers with exceptionally high security requirements that can only be met in a private cloud environment. We deliver and operate these private cloud deployments for the most critical customers, helping scale, secure and maintain the deployment whilst working closely with Google product teams to continually improve our technology.
Security Operations plays a critical role in safeguarding Google's public sector customers by proactively monitoring, detecting, and investigating security incidents around the clock. Operating 24/7, the team ensures comprehensive coverage of environments and swiftly responds to suspicious activity. In this role, you will respond to escalated security incidents and proactively enhance the Security Operations Center (SOC) by building platform efficiencies, conducting threat hunting, and participating in purple team events. You will participate in a rotating on-call schedule outside of core business hours and over the weekend to ensure security incidents can be swiftly resolved.
**Responsibilities:**
+ Respond to security incidents escalated from the front line 24/7 team.
+ Build and develop security efficiencies on the platform to improve the overall security operations center (SOC).
+ Conduct threat hunting activities on the platform and participate in purple team events.
+ Review and develop security operations center dashboards for anomalous activity.
+ Be a subject matter expert (SME) across typical security disciplines, vulnerability, Endpoint Detection and Response (EDR), Security Information and Event Management (SIEM) etc.
Google is proud to be an equal opportunity workplace and is an affirmative action employer. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. See also and If you have a need that requires accommodation, please let us know by completing our Accommodations for Applicants form:
Software Engineering Manager, Site Reliability, Cloud Incident Response
Posted 8 days ago
Job Viewed
Job Description
+ Bachelor's degree or equivalent practical experience.
+ 8 years of experience with software development in one or more programming languages (e.g., Python, C, C++, Java, JavaScript).
+ 3 years of experience in a technical leadership role; overseeing projects, with 2 years of experience in a people management, supervision/team leadership role.
+ Experience with cloud services, telemetry systems and incident response.
**Preferred qualifications:**
+ Master's degree or PhD in Computer Science, or a related technical field.
+ Experience as a cloud customer.
Site Reliability Engineering (SRE) combines software and systems engineering to build and run large-scale, massively distributed, fault-tolerant systems. SRE ensures that Google Cloud's services-both our internally critical and our externally-visible systems-have reliability, uptime appropriate to customer's needs and a fast rate of improvement. Additionally SRE's will keep an ever-watchful eye on our systems capacity and performance.
Much of our software development focuses on optimizing existing systems, building infrastructure and eliminating work through automation. On the SRE team, you'll have the opportunity to manage the complex challenges of scale which are unique to Google Cloud, while using your expertise in coding, algorithms, complexity analysis and large-scale system design. SRE's culture of intellectual curiosity, problem solving and openness is key to its success. Our organization brings together people with a wide variety of backgrounds, experiences and perspectives. We encourage them to collaborate, think big and take risks in a blame-free environment. We promote self-direction to work on meaningful projects, while we also strive to create an environment that provides the support and mentorship needed to learn and grow.
The Cloud Incident Response Team supports the responders, tooling, and outcomes for Google Cloud Platform (GCP) major incidents. The team collaborates across GCP products, customer facing teams, and a wide range of stakeholders, where you will be helping to coordinate, mitigate, or resolve issues across all of GCP.
Google Cloud accelerates every organization's ability to digitally transform its business and industry. We deliver enterprise-grade solutions that leverage Google's cutting-edge technology, and tools that help developers build more sustainably. Customers in more than 200 countries and territories turn to Google Cloud as their trusted partner to enable growth and solve their most critical business problems.
**Responsibilities:**
+ Participate in on-call rotation supporting Critical Incident Response for GCP.
+ Focus on high-quality customer outcomes and continuous collaboration across GCP teams.
+ Create Incident Management at Google (IMAG) training and processes for incident management life-cycle and partnering with Cloud SRE Uber Tech Leads, and Cloud Support leadership team.
+ Build systems and tooling to support the team, improve visibility, detection of issues, communications to customers, stakeholders, and customer facing teams.
+ Define and escalate risks in Cloud, reduce incident probabilities with strategic and pragmatic approaches as needed.
Google is proud to be an equal opportunity workplace and is an affirmative action employer. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. See also and If you have a need that requires accommodation, please let us know by completing our Accommodations for Applicants form: