SOC and incident response jobs in the United Kingdom

34 open SOC and incident response roles at 26 companies in the United Kingdom. 30 of them are open to candidates of any nationality; the rest ask for citizenship or a government security clearance.

Rebuilt 25 Oct 2026
open roles
34
companies
26
open to any nationality
88%
estimated median pay
$102k

Companies hiring

CompanyOpen rolesAny nationalityRelocation
Rockstar Games3100%
Methods2100%
Check Point Software Technologies2100%
NTT DATA2100%
Lloyds Banking Group20%
NCC Group2100%
Amazon2100%
Saviynt1100%
Jagex1100%
Corpay1100%
Capita1100%
Radiant1100%
Motorway1100%
Sophos1100%
Electronic Arts1100%

Newest roles

NTT DATA

nttdata.com
nttdata.com • HQ: Tokyo, Toyosu, Japan • Health Care • Cybersecurity • Data Centers & Colocation • Information Technology • Managed IT Services (MSP) • Financial Software & Embedded Finance • IT Consulting & Digital Transformation • Systems Integrators • 5000+ employees • Est. 1988 • Trust A • Hiring 1698, 196 new
HQ: Tokyo, Toyosu, Japan • Health Care • Cybersecurity • Data Centers & Colocation • Information Technology • Managed IT Services (MSP) • Financial Software & Embedded Finance • IT Consulting & Digital Transformation • Systems Integrators • 5000+ employees • Est. 1988 • Trust A • Hiring 1698, 196 new
NTT DATA is a Tokyo system integrator founded in 1988 that spun out of the data communications arm of NTT. It is one of the largest information technology services firms in the world, building banking, public sector and payment systems and operating global consulting and managed services. The company runs the CAFIS payment network used across Japanese retail and banking.
Abhijit Dubey · 代表取締役社長 · decision-maker
No careers mailbox known
Verified live · 2 hours ago Visa sponsor 4 days ago Hiring now · 89%

SOC Team Lead

≈ $79k – $140k per year (Estimated) • Lead • 5+ years exp • In office (Birmingham, United Kingdom) • Staff
Apply
Verified live · 2 hours ago Visa sponsor 1 month ago Long shot · 13%

SOC Analyst Level 1

≈ $39k – $75k per year (Estimated) • Junior • In office (Birmingham, United Kingdom)
Splunk
Incident Management
TCP/IP
Windows
Linux
Azure
AWS
Cybersecurity
Microsoft Sentinel
SIEM
+1
Apply

Babcock International

babcockinternational.com
babcockinternational.com • HQ: London, United Kingdom • Military Logistics • Nuclear Engineering • Military Training • Naval Systems • 5000+ employees • Est. 1900 • Trust A • Hiring 226, 43 new
HQ: London, United Kingdom • Military Logistics • Nuclear Engineering • Military Training • Naval Systems • 5000+ employees • Est. 1900 • Trust A • Hiring 226, 43 new
Babcock International Group is an aerospace, defence and security company headquartered in London that supports critical public-sector programmes in the United Kingdom and abroad. Its businesses provide through-life support for Royal Navy submarines and surface ships at Devonport and Rosyth, nuclear engineering, military vehicle fleet support and pilot training, with operations across Europe, Australasia, Canada and South Africa. Current openings include mechanical and licensing engineers, quantity surveyors, cyber security leads, vehicle mechanics, flying instructors and apprenticeship coaches, concentrated in Plymouth, Bristol, Dunfermline and Helensburgh.
No named decision-maker yet.
Careers mailbox is known
Verified live · 3 hours ago Visa sponsor 4 days ago Hiring now · 88%

Security Operations Manager

≈ $62k – $141k per year (Estimated) • In office (Gloucester, United Kingdom) • Citizenship or vetting required
Apply

Sopra Steria UK

soprasteria.co.uk
soprasteria.co.uk • HQ: London, United Kingdom • Systems Integrators • IT Consulting & Digital Transformation • 201-500 employees • Trust B • Hiring 69, 8 new
HQ: London, United Kingdom • Systems Integrators • IT Consulting & Digital Transformation • 201-500 employees • Trust B • Hiring 69, 8 new
Sopra Steria UK is the British arm of the Sopra Steria group, a technology and consulting company that serves public services and other sectors. It hires procurement managers, DevOps engineers, test analysts, support analysts and sales leads at offices in London, Hemel Hempstead, Farnborough and Newport. The company is headquartered in London, England, United Kingdom.
No named decision-maker yet.
No careers mailbox known
Verified live · 3 hours ago 4 days ago Likely open · 55%

Junior Service Manager - SOC

≈ $43k – $83k per year (Estimated) • Junior • In office (Hemel Hempstead, United Kingdom) • Junior
ServiceNow
Apply

Darktrace

darktrace.com
darktrace.com • HQ: Cambridge, United Kingdom • Email Security • Network Security • Security Operations • Cybersecurity AI • 1001-5000 employees • Est. 2013 • Trust B • Hiring 65, 9 new
HQ: Cambridge, United Kingdom • Email Security • Network Security • Security Operations • Cybersecurity AI • 1001-5000 employees • Est. 2013 • Trust B • Hiring 65, 9 new
Darktrace is a British cybersecurity company founded in Cambridge in 2013 by mathematicians and former government intelligence staff, built on the idea that a network can be defended by learning its own normal behaviour rather than matching known attack signatures. Its Self-Learning AI builds a live model of how each user, device and workload usually behaves, flags deviations that no signature would catch, and can act autonomously to contain an intrusion in progress. The company listed in London in 2021 and was taken private by Thoma Bravo in 2024 for around five billion dollars, and it protects networks, email, cloud and operational technology for thousands of organisations.
Nicole Eagan · Co-Founder & Chief Strategy Officer · decision-maker
Jack Stockdale · Co-Founder & Chief Technology Officer · decision-maker
Jill Popelka · Chief Executive Officer · decision-maker
Poppy Gustafsson · Co-Founder & former Chief Executive Officer · founder
No careers mailbox known
Visa sponsor 12 days ago Hiring now · 75%

Detection Engineer

≈ $71k – $161k per year (Estimated) • In office (Cambridge, United Kingdom) • Full-Time
GitLab
Kubernetes
Cybersecurity
Darktrace
Apply

Sword Group

sword-group.com
sword-group.com • HQ: Windhof, Luxembourg • IT Outsourcing & Dedicated Teams • Custom Software Development • IT Consulting & Digital Transformation • Est. 2000 • Trust A • Hiring 50, 9 new
HQ: Windhof, Luxembourg • IT Outsourcing & Dedicated Teams • Custom Software Development • IT Consulting & Digital Transformation • Est. 2000 • Trust A • Hiring 50, 9 new
Sword Group is a technology company headquartered in Windhof, Luxembourg and listed on Euronext Paris. It delivers software engineering, data and digital transformation services across Europe and beyond. The group employs several thousand specialists in more than fifty countries.
No named decision-maker yet.
No careers mailbox known
Verified live · 3 hours ago 12 days ago Hiring now · 84%

OT SIEM Engineer

≈ $52k – $119k per year (Estimated) • In office (Glasgow, United Kingdom)
Splunk
Azure DevOps
Git
Azure
CI/CD
Cybersecurity
Microsoft Sentinel
MITRE ATT&CK
IBM QRadar
LogRhythm
SIEM
+2
Apply

Skills these roles ask for

SIEM 16Windows 8Linux 7Splunk 6MITRE ATT&CK 6AWS 4Kubernetes 4Microsoft Sentinel 4IBM QRadar 4Incident Management 4Python 3Azure 3PowerShell 2Crowdstrike 2TCP/IP 2Microsoft Defender 1

Where the roles are

London 15Leeds 5Dundee 3Edinburgh 3Cambridge 2Birmingham 2Manchester 2Bristol 2Swindon 1Walsall 1

Questions

Can a foreigner apply for these roles?

30 of the 34 roles here state no citizenship or security-clearance demand. A role that does says so in its advert, and the card marks it.

Which companies hire most cybersecurity specialists?

Rockstar Games (3), Methods (2), Check Point Software Technologies (2), NTT DATA (2), Lloyds Banking Group (2).

Which roles count as cybersecurity jobs?

Every role whose work is protecting systems and data - SOC and incident response, threat intelligence and forensics, application and cloud security, authorized penetration testing and vulnerability management, identity and access, governance, risk and compliance, security leadership - at any employer. A role is filed under a specialty when its title names one; a "Cybersecurity Engineer" that names none is a cybersecurity engineer's.

How fresh is this?

Every role is re-checked on the employer's own careers board at least every 48 hours, and the page is rebuilt every night.

Source: 34 live postings on employers' careers boardsUpdated 25 Oct 2026MethodologyJSONCC BY-SA 4.0