> Markdown version of [/jobs/ext/825864-cyber-security-incident-response-engineer](https://www.wearedevelopers.com/jobs/ext/825864-cyber-security-incident-response-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Security Incident Response Engineer

- **Company:** Hydrogen
- **Location:** Welwyn Garden City, UK
- **Contract:** Contract
- **Skills:** Cloud Computing Security, Cyber Security, Runbook, Security Information and Event Management, Mitre Att&ck, Cyber Threat Analysis, Security Orchestration, Automation & Response
- **Published:** June 6, 2026
- **Apply:** https://computerjobs.com/gb/en/mob/job/C5FF579144C8D0FC6D

## About the Role

* CSIRT, SOC or Incident Response experience within a large enterprise environment.
 * Building and improving incident response capabilities, processes, playbooks and runbooks.
 * Supporting tabletop exercises, simulations and cyber readiness activities.
 * Knowledge of frameworks such as NIST, ISO 27035 and MITRE ATT&CK.
 * Experience with security tooling including SIEM, SOAR, EDR/XDR and cloud security platforms.
 * Strong stakeholder management and documentation skills.
 * Ability to drive continuous improvement across cyber incident response and resilience.

## Description

6-month initial contract
Inside IR35
1 day per week onsite in Welwyn Garden City
Day rate highly flexible for the right person

I'm working with a large retail business, and they are looking for a Security Engineer to help build and mature their Cyber Security Incident Response capability.

This is a strategic and hands-on role, working closely with the Cyber Security Incident Manager, SOC, DFIR, Threat Intelligence and Engineering teams to improve the organisation's readiness for high-impact cyber incidents such as ransomware, insider threats and major security breaches.

Key experience required:

 * CSIRT, SOC or Incident Response experience within a large enterprise environment.
 * Building and improving incident response capabilities, processes, playbooks and runbooks.
 * Supporting tabletop exercises, simulations and cyber readiness activities.
 * Knowledge of frameworks such as NIST, ISO 27035 and MITRE ATT&CK.
 * Experience with security tooling including SIEM, SOAR, EDR/XDR and cloud security platforms.
 * Strong stakeholder management and documentation skills.
 * Ability to drive continuous improvement across cyber incident response and resilience.


## Related Videos

- [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure)
- [Technical Documentation - How Can I Write Them Better and Why Should I Care?](https://www.wearedevelopers.com/videos/681-technical-documentation-how-can-i-write-them-better-and-why-should-i-care)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)
- [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management)
- [Bridging AI and Nomad: a Go-based MCP Server for Cluster Control](https://www.wearedevelopers.com/videos/2063-bridging-ai-and-nomad-a-go-based-mcp-server-for-cluster-control)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [A Guide to Green Tech and Green IT Careers](https://www.wearedevelopers.com/magazine/374-a-guide-to-green-tech-and-green-it-careers)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)