Incident Detection, Triage and Response

• Monitor and analyse alerts from SIEM, EDR/XDR, identity, email, cloud, network and other security controls to identify suspicious or malicious activity.
• Triage alerts, validate incidents, determine severity and business impact, and escalate in line with the incident response process and defined service levels.
• Lead or support investigations into internal and external threats, including phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
• Coordinate containment, eradication and recovery activities with infrastructure, application, identity, cloud and business teams, maintaining clear ownership and decision records.
• Maintain accurate incident case records, investigation timelines, evidence, actions, decisions and closure rationale from initial detection through to resolution.
• Provide timely incident updates and concise technical and management reports, including material facts, impact, risk, actions, dependencies and next steps.

Digital Forensics and Investigation

• Collect, preserve and analyse endpoint, server, identity, network, email and cloud artefacts in accordance with approved forensic and evidence-handling procedures.
• Perform host and network analysis using logs, packet captures, forensic images and security telemetry to establish scope, root cause, attacker activity and affected assets.
• Identify indicators of compromise, tactics, techniques and procedures, and map findings to MITRE ATT&CK where appropriate.
• Support legally or regulatorily sensitive investigations by maintaining evidence integrity, chain of custody and appropriate access controls.
• Engage specialist internal or external forensic support where the complexity, scale or sensitivity of an incident requires additional expertise.

Threat Hunting and Detection Improvement

• Develop and execute hypothesis-led threat hunts using threat intelligence, environmental knowledge and observed attacker behaviours.
• Create, tune and validate monitoring use cases, correlation rules, queries, custom indicators and detection content to improve coverage and reduce false positives.
• Assess detection gaps identified during incidents and recommend enhancements to logging, telemetry, processes and security controls.
• Contribute to purple-team, penetration-testing and control-validation activities and ensure relevant findings are converted into actionable detection or response improvements.

Incident Response Capability and Governance

• Develop, maintain and exercise incident response plans, standard operating procedures, playbooks, call-out arrangements and stakeholder communication templates.
• Conduct post-incident reviews and root-cause analysis, track lessons learned and ensure agreed corrective actions are assigned and monitored to closure.
• Contribute to incident response metrics, key risk indicators, trend analysis and control-effectiveness reporting for management and governance forums.
• Support cyber exercises and simulations to validate roles, escalation paths, communications and decision-making under realistic incident conditions.
• Keep current with emerging threats, vulnerabilities, attack methods and changes to relevant industry frameworks and regulatory expectations.