> Markdown version of [/jobs/ext/2817841-senior-siem-incident-response-engineer](https://www.wearedevelopers.com/jobs/ext/2817841-senior-siem-incident-response-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior SIEM & Incident Response Engineer

- **Company:** Hypersonica
- **Location:** Greater London, UK
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Audit Trail, Linux, Information Security Management, Intrusion Detection and Prevention, Log Analysis, Security Log, Security Information and Event Management, Software Vulnerability Management, SC Clearance, CIS Benchmarks, Security Orchestration, Automation & Response, Elk Stack
- **Published:** September 10, 2026
- **Apply:** https://www.collegerecruiter.com/job/2840613073-senior-siem--incident-response-engineer

## About the Role

* 3+ years hands-on SIEM deployment & log analysis (preferably ELK Stack, Opensearch, Wazuh, Microsoft Defender); production incident investigation experience.
 * Deep knowledge of Linux & Windows system hardening; hands-on experience with CIS Benchmarks, STIGs, or similar frameworks.
 * Strong scripting for security automation, log parsing, and alerting rule development.
 * Ability to design security controls that balance operational friction with security posture.
 * Security-minded by default: you think in access control, threat detection, and auditability.
 * High autonomy and good judgement. You can investigate incidents end-to-end and elevate appropriately.
 * Practical operator, not a perfectionist. You prioritise getting secure systems in place and improving iteratively., Due to the nature of the work with the UK MOD, applicants must be a British Citizen (or Dual UK national with British citizenship) and eligible for UK Security Clearance (SC) and, where required, Developed Vetting (DV).

## Description

* Own security log analysis, vulnerability management and incident investigation: establish baselines, create alerting rules for critical security events, and drive rapid incident investigation through log correlation.
 * Perform security hardening on systems and applications: define hardening standards, implement configurations, and audit compliance.
 * Investigate security incidents through log analysis and become the on-call responder when something breaks or looks suspicious.
 * Collaborate closely with Information Security Management to ensure compliance with security policies, regulations (Cyber Essentials, DEF STAN 05-138, ISO 27001, Grundschutz++), and customer requirements.
 * Build and maintain comprehensive documentation of SIEM architecture, hardening standards, incident response procedures, and security controls for auditors and the team.


## Related Videos

- [Resilient by Design: Building Robust Architectures in High-Stakes Financial Systems](https://www.wearedevelopers.com/videos/2106-resilient-by-design-building-robust-architectures-in-high-stakes-financial-systems)
- [Add Location-based Searching to Site with ElasticSearch](https://www.wearedevelopers.com/videos/77-add-location-based-searching-to-site-with-elasticsearch)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem)
- [No Keys for the Robot: GitOps as the Control Plane for Autonomous Agents](https://www.wearedevelopers.com/videos/100095-no-keys-for-the-robot-gitops-as-the-control-plane-for-autonomous-agents)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)