Jobs at NCC Group

Build, deploy, secure, monitor, and maintain Python application extensions, CLI tooling, and automations for Threat Intelligence platforms. Integrate backend systems, create tooling to support analysts and engineers, identify automation opportunities, and provide DevOps-focused support for cloud-native environments.

Produce actionable threat intelligence across the full lifecycle: track threat actors, analyse malware and C2 infrastructure, map activity to MITRE ATT&CK, develop detections (YARA), support DFIR/SOC, build tooling and automate workflows, and communicate findings to technical and non-technical stakeholders.

Monitor systems for threats, analyze security incidents, provide incident remediation, and mentor junior team members in a Security Operations Center.

Act as the customer's technical owner for security services, quantify security maturity via the TAM Score, build a 12-month technical roadmap, deliver QBRs, provide reactive ticket-based support, drive proactive improvements (tuning, automation), create technical deliverables (playbooks, analytics, workbooks), and advise on defensive security gaps and mitigation services.

The Senior Python Developer is responsible for designing, developing, and maintaining software systems using Python. This role includes mentoring junior developers, ensuring code quality, and collaborating with cross-functional teams to meet project requirements.

Design, develop, and implement custom ServiceNow applications; gather requirements from stakeholders; customize and integrate ServiceNow with external systems; perform testing and ensure coding standards; document solutions and provide ongoing support; collaborate with admins and IT teams to deliver scalable ServiceNow solutions.

Lead a global team to build, maintain and improve detection logic across MXDR technologies (EDR, NDR, SIEM). Set strategy, manage senior detection engineers, collaborate with TI/DFIR/Red Team, ensure high-fidelity detections with low false positives, apply data science to improve detection and SOC efficiency, and provide transparent client coverage reporting.

Monitor, detect, investigate, and respond to security events using Splunk Enterprise Security. Triage incidents, perform log analysis and event correlation, assist threat hunting and vulnerability remediation, escalate significant incidents, and maintain incident documentation and SOC playbooks.

Lead governance for cyber security projects across IT/OT, ensuring project governance, budget control, risk management, stakeholder engagement, and delivery of security capabilities to meet regulatory and business objectives.

Hands-on senior OT cybersecurity engineer/consultant delivering OT network/security architecture, low-level designs, firewall and segmentation specifications, client technical workshops, vendor evaluations, and project deliverables while mentoring junior staff and contributing to practice standards.

Design, build and maintain Splunk-based SOAR automations and playbooks to detect, investigate and respond to cyber threats. Partner with Incident Response to develop use cases, validate automation behaviour, produce analytics, document changes, perform QA, and mentor junior engineers.