Cyber Defence Specialist

I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC.” - CyberOne Consultant

About CyberOne

CyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio—across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.

Job Title: Cyber Defence Specialist

Location: Remote

Employment Type: Full time

Reports to: Senior SecOps Lead

Schedule:Rotational Shift

The Role:

The Cyber Defence Specialist provides specialist technical expertise across security operations centre, major incident response, and organic threat hunting. Acting as the technical escalation point for Senior Cyber Defence Analysts, the role investigates advanced adversary activity. The specialist works closely with Incident Response team to translate investigation and threat hunting findings into improvements to CyberOne's cyber defence capabilities.

Responsibilities

• Act as the Level 3 technical escalation point for complex incidents requiring specialist investigation beyond Level 2 analysis.

• Handle the specialist technical investigation of major incidents and advanced adversary activity, working under the Incident Response Lead during formal response engagements.

• Determine incident scope, attack paths, persistence mechanisms, and affected assets through detailed analysis of available security telemetry.

• Provide technical recommendations for containment, eradication, and recovery in accordance with agreed customer authorisation and response procedures.

• Conduct organic threat hunting across customer environments, driven by new threat intelligence, threats identified by CyberOne, and post-incident findings or detection gaps, to identify previously undetected threats, determine scope and impact, and validate detection coverage.

• Provide investigation findings and technical recommendations to Engineering and Detection Engineering teams on visibility gaps, detection logic, and response workflows, with resolution and implementation remaining the responsibility of those teams.

• Document specialist investigation findings, technical recommendations, and lessons learned to support incident reporting and service improvement.

• Provide technical guidance to Level 1 and Level 2 analysts and maintain specialist investigation playbooks and knowledge articles.