{"id":3393650,"url":"https://alion.io/job/sir-robert-mcalpine-ltd-senior-cloud-incident-response-consultant","title":"Senior Cloud Incident Response Consultant","company":{"id":687349,"name":"Sir Robert McAlpine Ltd","domain":"srm.com","url":"https://alion.io/company/srm-3","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":88,"open_postings":11,"ghost_share":0,"stale_share":0.273,"repost_share":0,"time_to_fill_p50_days":124,"computed_at":"2026-11-06T05:58:05Z"}},"role":"DevOps","role_family":"DevOps","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":72000,"max_usd":145000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":61},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab CI","optional":false},{"name":"Kubernetes","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Terraform","optional":false}],"status":"live","first_seen_at":"2026-10-28T10:39:08Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-11-06T18:09:23Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":8},"description":"WHO WE ARE \nS-RM is a global intelligence and cyber security consultancy. Since 2005, we’ve helped some of the most demanding clients in the world solve some of their toughest information security challenges. \nWe’ve been able to do this because of our outstanding people. We’re committed to developing sharp, curious, driven individuals who want to think critically, solve complex problems, and achieve success. \nBut we also know that work isn’t everything. It’s about the lives and careers it helps us build. We’re immensely proud of this culture and we invest in our people’s wellbeing, learning, and ideas every day.\nWe’re excited you’re thinking about joining us.\nWORKING IN CYBER AT S-RM \nOur Cyber Security division is the fastest-growing part of S-RM. Demand for our Advisory, Ethical Hacking and Incident Response practices has never been higher, and the threat landscape keeps changing.\nWe are building a team to keep pace, one that responds quickly, innovates and keeps improving. We also don’t believe there is a typical cyber security professional. Our people include intelligence analysts, technical specialists, software developers, investigators and risk managers, so you will always be working alongside different perspectives and expertise that help you learn and grow.\nIf that sounds like your kind of team, we would like to hear from you.\nTHE ROLE \nOur Incident Response Consultants are central to the success of our Cyber Security consulting practice. As a Technical Lead, you will bring deep cloud expertise to a senior, client-facing delivery role, leading the response to incidents in cloud environments.\nYou will work across the full lifecycle of security incidents to help clients respond and recover. That includes incidents affecting cloud platforms, identity systems, CI/CD pipelines and software delivery environments, alongside traditional scenarios such as ransomware, business email compromise and intrusion investigations.\nOur Incident Response Associates are a critical part of our Cyber Security division’s success.\nYou will lead and deliver technical investigations for clients, including:\nLeading technical incident response engagements from first contact through to closure\nActing as the primary technical resource on response cases, applying your own expertise and guiding colleagues on the project team\nLeading cloud-based investigations across AWS, Azure and GCP, including:\nCompromised cloud identities, access keys, APIs and control planes\nCloud log, audit trail and telemetry analysis (CloudTrail, Entra ID, Azure Activity Logs, GCP Cloud Audit Logs and similar)\nAbuse of CI/CD pipelines, source code repositories, secrets and software supply chains\nInfrastructure-as-Code and automated deployment workflows\nContainers and Kubernetes environments\nOverseeing host- and network-based investigations, including triage and containment, system recovery and remediation support, evidence collection and forensic analysis, and malware and root cause analysis\nInvestigating a wide range of incident types, including:\nCloud account and tenant compromise\nUnauthorised access and data breaches in cloud environments\nRansomware and extortion incidents\nBusiness Email Compromise (BEC)\nSoftware supply chain and pipeline compromise\nDeveloping and sharing domain expertise. We will support you to deepen your technical knowledge and share it across the wider team through internal initiatives, training and capability development\nParticipating in an on-call rotation, providing 24x7x365 incident response coverage for our clients\nOther features of the role include:\nVariety of casework: no day will be the same. Our team responds to a huge variety of incidents for both public and corporate clients.\nRange of opportunities: you will have opportunities to broaden your security awareness into testing and advisory projects, in addition to deepening your incident response expertise.\nFlexible working practices: responding to incidents can be intense, high-pressure work. We are mindful of our team’s work/life balance and offer flexible working options to support your wellbeing.\nWHAT WE'RE LOOKING FOR \nCandidates with the following qualifications and experience are likely to succeed as Incident Response Associates at S-RM. \nThat said, if you don’t think you meet all of the criteria below but still are interested in the job, please apply. Nobody checks every box-we’re looking for candidates that are particularly strong in a few areas and have some interest and capabilities in others.\nWe nurture a culture of equality, diversity and inclusion and we are dedicated to developing a workforce that displays a variety of talents, experiences and perspectives.\nExperience\n5+ years' experience in a technical cloud security, cloud engineering, DevSecOps, platform engineering or security operations role, with hands-on experience of at least one major cloud platform\nDirect experience in a consulting or in-house incident response team is beneficial, but not essential\nCloud and technical skillset\nHands-on experience with AWS, Azure or GCP, including identity and access management, logging and audit trails, and cloud-native security tooling\nExperience with CI/CD platforms (such as GitHub Actions, GitLab CI or Azure DevOps), Infrastructure-as-Code and automation\nStrong technical foundations for investigating a range of incident types, including ransomware and intrusion scenarios\nComfortable using scripting and automation (such as Python, PowerShell or Bash) to support investigations and analysis\nExperience with containers and Kubernetes is advantageous\nApproach\nA strong investigative mindset, with the ability to work through complex problems using limited or incomplete information\nComfortable operating in high-pressure, time-critical client situations\nThreat awareness\nDemonstrable knowledge of cyber threat actors and their tactics, techniques and procedures, particularly those targeting cloud identities, SaaS platforms and cloud-based infrastructure\nCommunication\nAble to communicate technical findings and risk clearly to non-technical client audiences in a professional consulting setting\nQualifications\nCertifications are not required, but cloud and platform certifications are particularly valued, such as AWS, Azure or GCP security and architecture certifications, Kubernetes (CKA/CKS) and Terraform. The following (or similar) are also beneficial: GCFE, GCFA, GCLD, GCIH, EnCE, CFSR, CISSP, GREM, OSCP and Security+.\nThe successful candidate must have permission to work in the UK by the start of their employment.\nOUR BENEFITS \nWe offer thoughtful, balanced rewards and support to help our people do their best work and live their lives outside it, including:\n 25 days holiday per year in addition to bank holidays (+1 day for every year of service up to a maximum of 30 days).\nMatching pension contribution up to 7% (up to a maximum of 14% combined), and financial education\n Life Insurance 4X Annual salary\nParental Support:Fertility treatment leave - 5 days of leave per cycle of treatment per year;\nMaternity leave - 26 weeks of full pay followed by 13 weeks of half pay;\nPaternity leave - 6 weeks of full pay.\n\nVarious Health and Medical Benefits including:Private dental and medical insurance (taxable benefit);\nVirtual GP for you and your family members that live in the same household;\nGym discounts for you and your partner;\nEAP programme for you and your immediate family;\nFree access to the mindfulness app Headspace;\n\nThe successful candidate must have permission to work in the United Kingdom by the start of their employment.\nTHE APPLICATION PROCESS\nWe want to get to know you, and for you to get to know us, to see if we’d be a good fit. We are responsive and respectful of people’s time throughout our hiring process.\nA typical application process includes: \nInitial screening of your application by our recruiting team.\nAn interview to assess your baseline technical skills.\nAn interview to discuss your previous experience and broader competencies.\nAn final interview to determine alignment with the role.\nPlease apply via: Job Application for Senior Cloud Incident Response Consultant at S-RM","description_format":"text","description_chars":8165,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule","Health insurance","Life insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Transportation & Logistics","Transport Infrastructure","Civil & Structural Engineering"],"lifecycle":[{"event":"open","at":"2026-10-28T11:30:16Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":8,"expected_fill_days":124,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-11-06T05:58:05Z"},"pay":null,"html_url":"https://alion.io/job/sir-robert-mcalpine-ltd-senior-cloud-incident-response-consultant","json_url":"https://alion.io/job/sir-robert-mcalpine-ltd-senior-cloud-incident-response-consultant.json","meta":{"generated_at":"2026-11-06T20:22:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4560,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":687349},"rest":"https://alion.io/mcp/rest/get_company?id=687349"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsir-robert-mcalpine-ltd-senior-cloud-incident-response-consultant"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsir-robert-mcalpine-ltd-senior-cloud-incident-response-consultant"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsir-robert-mcalpine-ltd-senior-cloud-incident-response-consultant"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sir-robert-mcalpine-ltd-senior-cloud-incident-response-consultant\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsir-robert-mcalpine-ltd-senior-cloud-incident-response-consultant"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3393650}},{"tool":"search_jobs","arguments":{"company":"srm.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3393650},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}