Cyber Threat Specialist (Blue Team) – Financial Services – London – Hybrid – Excellent Overall Package
The role
Join a leading financial services client as a Cyber Threat Specialist (Blue Team) and help strengthen a critical Threat Detection & Response function. You will be a key member of the Threat Detection & Response team, focusing on defensive security across complex, business-critical environments. Working closely with engineering, infrastructure and security teams, you will help design, implement and optimise high-fidelity detections, investigate incidents, and contribute to continuous improvement of cyber defences.
What you’ll be doing
*Deliver hands-on detection engineering, incident response, threat hunting, security engineering and threat intelligence activities.
*Investigate and respond to security incidents across host, identity, email, SaaS and cloud workloads.
*Use and tune security tooling such as EDR, DLP, SIEM and SOAR to improve detection and response effectiveness.
*Apply frameworks such as MITRE ATT&CK and the cyber kill chain to map, detect and disrupt attacker tradecraft.
*Leverage offensive tooling (Kali, Cobalt Strike, Metasploit, Bloodhound, Mimikatz, etc.) to understand and defend against real-world attack techniques.
*Contribute to secure architectures across networks, operating systems and cloud platforms.
What we’re looking for
*Minimum of 3 years’ hands-on experience in at least two of: detection engineering , incident response, digital forensics, security operations, threat hunting, threat intelligence, with exposure to the others.
*Strong experience with security tooling: EDR, DLP, SIEM, SOAR.
*Solid background in threat investigation and incident response.
*Good understanding of MITRE ATT&CK, cyber kill chain and common attacker tradecraft.
*Familiarity with offensive tools such as Kali, Cobalt Strike, Metasploit, Bloodhound, Mimikatz.
*Strong knowledge of networking and security protocols (TCP/IP, HTTPS, DNS, firewalls, proxies).
*Experience with Windows and Linux/Unix (Kubernetes exposure a plus).
*Scripting or programming skills in Bash, Python or PowerShell.
*Exposure to CI/CD tools and cloud platforms (e.g. Ansible Tower, Bitbucket, Pipelines, Azure).
*Understanding of secure network architectures and related technologies.
How to apply
If you’re interested and think you align with this opportunity, please apply with an updated CV.