Jobs at NCC Group

Lead vulnerability research and exploit development across platforms and architectures, deliver reliable exploits, provide tactical reverse-engineering support, publish and present findings, mentor colleagues, and collaborate with multidisciplinary teams to protect clients and advance security research.

Design, develop, and implement custom ServiceNow applications; gather requirements from stakeholders; customize and integrate ServiceNow with external systems; perform testing and ensure coding standards; document solutions and provide ongoing support; collaborate with admins and IT teams to deliver scalable ServiceNow solutions.

Lead a global team to build, maintain and improve detection logic across MXDR technologies (EDR, NDR, SIEM). Set strategy, manage senior detection engineers, collaborate with TI/DFIR/Red Team, ensure high-fidelity detections with low false positives, apply data science to improve detection and SOC efficiency, and provide transparent client coverage reporting.

Build, deploy, secure, monitor, and maintain Python application extensions, CLI tooling, and automations for Threat Intelligence platforms. Integrate backend systems, create tooling to support analysts and engineers, identify automation opportunities, and provide DevOps-focused support for cloud-native environments.

Produce actionable threat intelligence across the full lifecycle: track threat actors, analyse malware and C2 infrastructure, map activity to MITRE ATT&CK, develop detections (YARA), support DFIR/SOC, build tooling and automate workflows, and communicate findings to technical and non-technical stakeholders.

Hands-on senior OT cybersecurity engineer/consultant delivering OT network/security architecture, low-level designs, firewall and segmentation specifications, client technical workshops, vendor evaluations, and project deliverables while mentoring junior staff and contributing to practice standards.

Administer and maintain endpoint security platforms (Tanium & SentinelOne), deploy and manage Tanium modules, monitor performance, build dashboards and reports, perform audits and compliance checks, troubleshoot endpoint visibility/patching/deployments, integrate endpoint tools with IT/security systems, and provide training and support.

Monitor, detect, investigate and respond to security alerts using Splunk Enterprise Security. Triage incidents, perform log analysis and event correlation, assist threat hunting and vulnerability remediation, escalate significant incidents, and maintain incident documentation and SOC use cases/playbooks.

Monitor, detect, investigate, and respond to security events using Splunk Enterprise Security. Triage incidents, perform log analysis and event correlation, assist threat hunting and vulnerability remediation, escalate significant incidents, and maintain incident documentation and SOC playbooks.

Design, build and maintain Splunk-based SOAR automations and playbooks to detect, investigate and respond to cyber threats. Partner with Incident Response to develop use cases, validate automation behaviour, produce analytics, document changes, perform QA, and mentor junior engineers.