> Markdown version of [/jobs/ext/1961231-internal-cyber-defence-consultant](https://www.wearedevelopers.com/jobs/ext/1961231-internal-cyber-defence-consultant). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Internal Cyber Defence Consultant - **Company:** Ricoh - **Location:** UK - **Contract:** Permanent contract - **Skills:** Encodings, Cyber Security, Digital Forensics, Intrusion Detection and Prevention, Log Analysis, Microsoft Office, Performance Tuning, Red Team (Cyber Security), Zero Trust Network Access, Security Information and Event Management, Software Vulnerability Management, Data Logging, Computer Networking Systems, Cloud Platform System, Data Ingestion, Mitre Att&ck, Information Technology, Cybercrime, Purple Team (Cyber Security), Blue Team (Cyber Security), Security Orchestration, Automation & Response - **Published:** August 7, 2026 - **Apply:** https://www.totaljobs.com/job/defence-consultant/ricoh-job107809415 ## About the Role Technical Expertise * Strong hands-on experience across SIEM, SOAR, EDR and NDR technologies - covering the Microsoft suite. * Zero Trust experience, ideally with zScaler. * Proficiency in detection engineering, alert tuning, log analysis and data correlation * Solid understanding of MITRE ATT&CK, cyber kill chain and threat actor TTPs * Experience conducting or leading incident response and digital forensics investigations * Skilled in threat hunting techniques, anomaly detection and behavioural analytics * Strong knowledge of vulnerability management processes and tooling * Understanding of enterprise networks, cloud environments, endpoints and identity systems Leadership & Interpersonal Skills * Experience guiding virtual or multidisciplinary security teams * Strong communicator, comfortable engaging senior stakeholders across technical and non-technical functions * Able to influence decision-making, challenge assumptions and advocate for necessary security improvements * Skilled at maintaining calm, clarity and leadership during high-pressure security incidents * Capable of building trust, fostering collaboration and promoting continuous improvement Business & Strategic Acumen * Understanding of Ricoh's business context, regulatory environment and operational dependencies * Ability to translate technical risk into meaningful business impact * Awareness of sector-specific risks and organisational priorities * Experience working in or with regulated enterprise environments, * Bachelor's degree in Cybersecurity, Computer Science, IT or related field * Relevant certifications such as GCIH, GCIA, GMON or CISSP * Extensive proven experience in defensive cyber security roles * Proven experience in a leadership or senior operational position * Hands-on experience leading major incident investigations in enterprise environments * Exposure to red/purple team exercises, detection tuning and threat-driven defence ## Description As part of this evolution, we are looking for an Internal Cyber Defence Consultant to strengthen our defensive posture, lead the maturity of our Blue Team capability, and ensure Ricoh remains resilient against an ever-evolving threat landscape. This is a high-impact individual contributor role with virtual leadership responsibilities and working closely with security, technology and business teams across Europe. #RicohEurope What you will be doing The Internal Cyber Defence Consultant will be responsible for shaping and maturing Ricoh's defensive security operations. This includes overseeing detection engineering, incident response, threat hunting, and vulnerability management. You will guide the virtual Blue Team, set the direction for defensive strategy, and ensure security controls, processes, and technologies deliver protection across Ricoh's systems, networks and data. Operating in a complex and fast-paced environment, you will be accountable for the design and continual improvement of detection and response capabilities, while ensuring alignment with industry standards, regulatory requirements and Ricoh's risk appetite. This role blends technical expertise, leadership, analysis and communication, requiring someone who can influence without direct authority and act decisively when incidents occur., Blue Team Leadership & Operations * Leading and coordinating the virtual Blue Team, including SOC analysts, incident responders, threat hunters and defensive engineers * Setting strategic direction, improving processes, and supporting skill development across the defensive capability * Acting as a senior escalation point during investigations and major incidents Threat Detection & Monitoring * Designing, implementing and tuning detection rules across SIEM, SOAR, EDR and NDR platforms * Managing log ingestion, telemetry pipelines and data quality to ensure visibility across all environments * Identifying gaps in logging, coverage or monitoring and driving improvements Incident Response & Readiness * Managing incident response processes, including playbooks, tabletop exercises and post-incident reviews * Leading investigations, coordinating cross-functional teams and ensuring effective containment, eradication and recovery * Embedding lessons learned into future detection, tooling and process enhancements Threat Hunting & Proactive Defence * Conducting hypothesis-driven threat hunts informed by threat intelligence * Identifying stealthy or emerging threats not caught by automated detection * Collaborating with Red Team operators to validate detection gaps and enhance Blue Team response Vulnerability & Exposure Management * Overseeing vulnerability management processes and coordinating risk-based remediation * Working with infrastructure and application teams to prioritise and address high-risk weaknesses * Reporting remediation progress and exposure trends to senior leadership Governance, Reporting & Culture * Ensuring compliance with ISO 27001, GDPR, NIS2 and internal security policies * Providing clear reporting on threat trends, risk indicators, detection maturity and incident metrics * Championing a security-first culture through guidance, awareness and training initiatives ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Progressive Delivery in Kubernetes](https://www.wearedevelopers.com/videos/949-progressive-delivery-in-kubernetes) - [A Brief History of Data Storage](https://www.wearedevelopers.com/videos/974-a-brief-history-of-data-storage) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Leveraging Large Language Models for Legacy Code Translation: Challenges and Solutions](https://www.wearedevelopers.com/videos/1157-leveraging-large-language-models-for-legacy-code-translation-challenges-and-solutions) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)