Incident Response Specialist

Project overview

Incident Response Specialist

months +

+Inside IR35

+£60 - £70 ph

+On site in London

We are seeking an experienced Incident Response Specialist to provide hands-on Security Operations Centre (SOC) and incident response support across endpoint, cloud and application environments.

The successful candidate will investigate and respond to cyber security threats, with a particular focus on macOS endpoints, Linux cloud workloads, microservices and containerised environments. You will work closely with security and technical teams to assess incidents, support containment and remediation, and improve threat detection and response capabilities.

Key Responsibilities

Essential Skills and Experience

Working Arrangements

Candidates must be comfortable working in a fast-paced security operations environment and responding effectively to emerging cyber security threats.

If you'd like to discuss this Incident Response Specialist role in more detail, please send your updated CV to (see below) and I will get in touch.

• Monitor security alerts, perform triage and investigate potential incidents.
• Assess incident severity, scope, impact and required response actions.
• Conduct incident investigations and support containment and remediation activities.
• Investigate threats across macOS endpoints, Linux cloud workloads, microservices and containerised environments.
• Analyse and correlate security telemetry across endpoint, cloud and application environments.
• Maintain accurate incident records, investigation evidence and response documentation.
• Escalate significant incidents and collaborate with SOC and technical teams.
• Contribute to improving detection capabilities, investigation processes and incident response playbooks.
• Practical experience investigating cyber security threats and incidents across endpoints, cloud environments and applications.
• Hands-on experience with macOS security investigations and Linux workloads in cloud environments.
• Understanding of microservices and containerised environments.
• Experience using SIEM, EDR/XDR and cloud security monitoring technologies.
• Strong knowledge of threat detection, attacker tactics and techniques, including the MITRE ATT&CK framework.
• Ability to analyse security telemetry and determine incident severity, scope and impact.
• Experience documenting investigations, maintaining evidence and communicating findings clearly.
• Strong collaboration and communication skills, with the ability to engage technical and non-technical stakeholders.
• Location: On-site in London
• Working hours: 10-hour shifts between 06:00 and 16:00.
• Shift pattern: Sunday to Wednesday or Wednesday to Saturday, as directed by the customer.

Project details

• Start: ASAP
• Duration: 12 months
• Remote: onsite
• Location: London, United Kingdom, GB