Jobs at NCC Group

Designs, scopes, demonstrates, and technically sells cybersecurity solutions, including SOC and XDR services. Captures customer requirements, develops architectures, supports proposals and RFPs, communicates technical risk, and advises clients and internal stakeholders. The role requires strong security monitoring expertise, business acumen, stakeholder management, written and verbal communication, and knowledge of security technologies, standards, and industry challenges.

The Principal DFIR Consultant manages a team, responds to incidents, conducts investigations, and provides high-quality technical analysis for clients in the Digital Forensics and Incident Response space.

Ensures the quality, consistency, technical accuracy, and readability of cybersecurity assessment reports. Responsibilities include copy editing, proofreading, translating technical findings and business risks for non-technical readers, maintaining report library content, reviewing client-facing materials, and collaborating with management and internal departments. The role suits experienced proofreaders, copy editors, or pentesters transitioning away from hands-on testing.

The Senior Client Manager will oversee relationships with clients, advising on cyber threats and providing strategic guidance on security measures to protect data and systems.

Monitor security alerts from SIEM/IDS/IPS and other tools, perform initial triage, document incidents and evidence, escalate threats, collaborate with SOC and IT teams, maintain incident response playbooks and SOPs, produce service reports, and support continuous learning and customer-focused security operations.

Design, develop, test, and maintain Splunk SOAR playbooks, Python automations, API integrations, and automated incident-response workflows. Integrate security, cloud, SIEM, and ITSM platforms; troubleshoot connectors; improve automation coverage and reduce response times. Support MXDR deployments, advise customers and internal teams, document engineering standards, and serve as the Splunk SOAR subject matter expert.

Leads complex cybersecurity programmes from initiation through delivery, managing governance, budgets, risks, dependencies, compliance, and stakeholder engagement. Coordinates cross-functional business, technology, and security teams to implement security capabilities and controls, including identity and access management, security operations, vulnerability management, cloud security, and regulatory compliance initiatives. Provides executive reporting and drives measurable organisational risk reduction.

Designs and scales talent development solutions focused on leadership development, succession planning, career growth, high-potential programs, coaching, and organizational capability. Advises senior leaders and HR partners, facilitates leadership workshops, supports transformation and AI adoption, evaluates learning impact through data, and strengthens learning, coaching, and mentoring cultures across the organization.

Leads NCC Group’s mid-year and year-end performance review and OKR cycles. Responsibilities include planning timelines, configuring and testing Workday processes, coordinating communications, resolving queries, monitoring completion, producing reports and dashboards, ensuring data accuracy and governance, managing stakeholders, and improving future performance-management processes.

Generate and qualify new business opportunities through outbound prospecting, inbound lead management, cold calling, email outreach, social selling, and targeted campaigns. Build prospect relationships, nurture qualified leads, track lead progression, report campaign results, and collaborate with Marketing and Sales. The role also involves developing knowledge of cybersecurity consulting solutions and engaging senior stakeholders.

Develops and manages custom security detections for customers using SIEM and EDR environments. Responsibilities include hosting threat workshops, correlating log events, querying Sentinel and Splunk datasets, identifying application abuse patterns, translating threat intelligence into detection opportunities, writing detection pseudo-logic, explaining attack paths, coordinating detection development, gathering customer feedback, and tracking work through ticketing systems.

Provides independent safety consultancy for complex, safety-critical and security-relevant computer-based systems. Responsibilities include reviewing software, system designs, testing, safety cases and assurance arguments; conducting hazard and risk assessments; interpreting standards; developing evidence-based technical positions; writing reports; advising clients; applying analytical techniques; and mentoring junior consultants.

Deliver large-scale IAM and PAM implementations for enterprise clients, including identity lifecycle management, access governance, privileged access, application integrations, JML processes, configuration, testing, troubleshooting, and post-implementation support. Act as a client-facing technical consultant, advise stakeholders, apply best practices, support agile delivery, and identify service optimization opportunities.

Design, build and maintain Azure-based data platform and pipelines (ETL, migrations, data models). Ensure data quality, integrity, monitoring and CI/CD. Support data warehouse, collaborate with analysts, and enable analytics and AI-driven insights across the business.

Lead global benefits strategy execution across regions: translate policy into local programs, manage brokers and renewals, oversee retirement schemes (401(k), superannuation), run US open enrolment, ensure compliance, partner with HR/Finance/Legal, and drive inclusive benefit design and continuous improvement to support colleague attraction, retention and wellbeing.

Lead and operationally manage the Manila Managed Services teams to deliver high-quality, client-facing cyber defence services. Align local teams with global strategy, track KPIs (quality, customer satisfaction, cost), drive continuous improvement, liaise with global stakeholders, and maintain service excellence and operational efficiency.

Monitor, detect, investigate, and respond to security events using Splunk Enterprise Security. Triage incidents, perform log analysis and event correlation, assist threat hunting and vulnerability remediation, escalate significant incidents, and maintain incident documentation and SOC playbooks.

Build, deploy, secure, monitor, and maintain Python application extensions, CLI tooling, and automations for Threat Intelligence platforms. Integrate backend systems, create tooling to support analysts and engineers, identify automation opportunities, and provide DevOps-focused support for cloud-native environments.

Build, deploy, secure, monitor, and maintain Python application extensions, CLI tooling, and automations for threat intelligence platforms. Integrate backend systems, support DevOps and analyst teams, identify automation opportunities, and maintain secure cloud-native tooling (AWS, containers).

Build, deploy, secure, monitor, and maintain Python application extensions, CLI tooling, and automations for Threat Intelligence platforms. Integrate backend systems to break down data silos, provide tooling and support for analysts and engineers, and identify automation opportunities across the department.