Senior Cyber Security Consultant (Ref 26618)

Responsibilities

• Act as the Enterprise Cyber Security technical focal point during cyber incidents, working closely with SOC, CISO, infrastructure, network, cloud, application, and vendor teams.

• Support cyber incident response activities including triage, investigation, containment coordination, evidence gathering, remediation tracking, and post incident review.

• Conduct proactive threat hunting across Enterprise infrastructure using available telemetry from SIEM, EDR, NDR, vulnerability management, asset discovery, and other security tools.

• Identify suspicious behaviours, attack patterns, lateral movement indicators, privilege misuse, exposed services, anomalous access, and other signs of compromise.

• Develop and enhance threat hunting hypotheses, detection use cases, investigation playbooks, response procedures, and escalation workflows.

• Support improvement of security monitoring by identifying gaps in logs, telemetry, asset visibility, EDR/NDR/SIEM coverage, and detection rules.

• Work with SOC and central security teams to improve alert quality, detection coverage, investigation context, and incident response readiness.

• Support vulnerability management and risk-based remediation by correlating vulnerabilities with asset criticality, exposure, threat intelligence, and compensating controls.

• Support Enterprise cybersecurity initiatives including NDR deployment, asset discovery, micro-segmentation, Zero Trust controls, PIAM/IAM adoption, and security tool integration.

• Participate in security assessments, threat reviews, tabletop exercises, incident simulations, and lessons-learned activities.

• Support root cause analysis and ensure remediation actions from cyber incidents, audit findings, vulnerability reviews, and threat hunting activities are tracked to closure.

• Prepare management reports, investigation summaries, threat hunting findings, risk updates, incident dashboards, and security posture metrics.

• Support cybersecurity audits, regulatory requests, internal governance activities, and evidence collection where related to incident response, monitoring, and security controls.

• Maintain and improve technical documentation including incident response runbooks, threat hunting procedures, SOPs, escalation guides, and operational checklists.

• Provide guidance to internal teams on security best practices, incident handling, evidence preservation, secure configuration, and remediation actions.

Requirements

• Bachelor’s degree or diploma with relevant experience in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.

• Minimum 7 years of experience in cybersecurity operations, incident response, threat hunting, SOC operations, detection engineering, infrastructure security, or related roles.

• Strong understanding of cyber incident response lifecycle, including detection, triage, containment, eradication, recovery, and post-incident review.

• Hands-on experience with security technologies such as SIEM, EDR, NDR, vulnerability management, threat intelligence platforms, asset discovery tools, firewalls, and endpoint/network security controls.

• Good understanding of network security, TCP/IP, routing, firewalls, VPNs, DNS, authentication, Windows/Linux systems, Active Directory, and cloud security fundamentals.

• Experience analysing logs, alerts, network traffic, endpoint telemetry, user activity, and security events to identify threats or suspicious behaviours.

• Familiarity with MITRE ATT&CK, Cyber Kill Chain, threat hunting methodologies, and common attacker tactics, techniques, and procedures.

• Exposure to tools and technologies such as Microsoft Sentinel, Splunk, CrowdStrike, Tenable, Qualys, Darktrace, Palo Alto, Illumio, CyberArk, Delinea, Device42, or similar platforms.

• Ability to work across multiple teams during incidents and security projects, including SOC, CISO, infrastructure, network, application, cloud, GRC, and vendor teams.

• Strong analytical, troubleshooting, documentation, stakeholder management, and communication skills.

Licence no: 12C6060