Jobs at NCC Group

Generates new business opportunities, develops sales plans, builds client relationships, manages accounts, presents solutions, negotiates contracts, closes deals, and achieves revenue targets. The role includes lead generation, networking, Salesforce record management, and collaboration with senior business development and account management professionals.

Manage and investigate escalated security incidents, conduct deeper analysis and threat hunting, assess business impact, and recommend remediation. Prioritize and classify alerts, refine alert policies, maintain SOC tools and documentation, prepare incident reports, and mentor Junior SOC Analysts. The role also supports process improvement, automation, and coordination across the security operations team.

Leads the European Network and NDR Engineering team, overseeing service delivery, operational support, resource allocation, incident escalation, continuous improvement, and customer outcomes. Provides line management, coaching, workforce planning, performance oversight, recruitment support, and technical capability development. Collaborates with SOC, project, portfolio, service delivery, and engineering teams, while participating in an out-of-hours call rota.

Develop and maintain secure, scalable full-stack JavaScript applications extending the ServiceNow ITSM platform. Responsibilities include requirements gathering, application development, API integrations, secure coding, testing, documentation, technical debt reduction, and ongoing support. The role collaborates with ServiceNow administrators, engineers, and business stakeholders in a cybersecurity-focused managed services environment.

Provide user support for Salesforce, Workday, and bespoke business applications. Resolve and document incidents, investigate defects using database queries, maintain knowledge-base articles, produce reports, schedule report distribution, escalate issues, and identify automation opportunities. The role also supports system implementations, training, service-level adherence, and collaboration with technical teams and business users.

Supports SEO, GEO, and AEO activity through keyword and competitor research, website audits, CMS content optimization, publishing, and performance reporting. The role identifies improvements across crawlability, metadata, internal linking, structured data, page experience, and AI-enabled search visibility. It also provides search-led recommendations to content teams, uses AI-assisted tools with human review, and monitors evolving search trends and algorithm changes.

Supports the implementation, monitoring, maintenance, and improvement of cybersecurity tools, controls, and configurations. Investigates security alerts and incidents alongside SOC and digital forensics teams, contributes to security technology and process development, and performs business-as-usual and project tasks. The role supports cyber risk management and secure operation of internal technology services.

Operates and improves global IT infrastructure and platforms across on-premises, cloud, virtualized, and containerized environments. Responsibilities include monitoring services, responding to alerts and incidents, troubleshooting, maintaining documentation, supporting deployments and integrations, and contributing to backup, security, business continuity, and disaster recovery. The role requires Microsoft and Linux administration, AWS knowledge, networking, backup systems, and infrastructure support, with automation and infrastructure-as-code skills preferred.

Conduct hypothesis-driven threat hunting to identify sophisticated adversaries across customer environments. Analyze adversary tactics, techniques, and procedures using threat intelligence, MITRE ATT&CK, and risk models. Automate hunts with scripting, notebooks, and security tools; collaborate with detection engineers to develop high-fidelity detections; document methodologies; and present findings and risk impacts to stakeholders.

Coordinates global research operations, including article publication, content management, vulnerability disclosure tracking, collaboration administration, knowledge management, reporting, and commercial research tracking. Maintains accurate records, research systems, inventories, and publication workflows while supporting distributed teams. Identifies process improvements, reduces manual effort, and provides clear status updates to technical and non-technical stakeholders.

Designs and delivers Microsoft security solutions for clients, including Sentinel environments, SOAR automation, Defender XDR, threat hunting, incident response, Purview, and DLP. The role includes KQL-based detection engineering, Azure cost optimization, client workshops, architecture design, stakeholder reporting, security strategy, pre-sales support, and mentoring colleagues. Professional fluency in Dutch and English is required.

Leads and develops a program management team in Manila while supporting hands-on delivery. Responsibilities include process improvement, workload planning, coaching, onboarding, operational escalations, performance reporting, workforce administration, stakeholder communication, and cross-functional collaboration. The role drives KPIs, OKRs, service quality, documentation, and continuous improvement across geographically distributed teams.

Designs and assures OT cybersecurity architectures for critical infrastructure clients across energy, water, manufacturing, rail, and other operational environments. Responsibilities include discovery, requirements, network segmentation, secure remote access, architecture documentation, technology evaluation, implementation assurance, testing, and acceptance. The role leads client workshops and supports practice development. Active UK SC clearance is essential, with approximately 20% national client-site travel.

Lead end-to-end delivery of complex technology and business transformation projects across Agile teams. Responsibilities include planning, governance, reporting, risk and dependency management, stakeholder alignment, Agile ceremony facilitation, backlog prioritization, roadmap development, and continuous improvement. The role also requires hands-on Scrum Master and Product Owner experience, leadership of multidisciplinary teams, and ensuring delivery meets strategic objectives, quality standards, and customer needs.

Monitor global systems for threats, vulnerabilities, and indicators of compromise. Analyze security alerts using Microsoft XDR, Splunk, and related detection tools; investigate and respond to incidents; provide remediation recommendations and customer reports; escalate threats; maintain SOC procedures; and mentor junior analysts. The role operates on a 24/7, four-on-four-off shift pattern with 12-hour shifts.

Monitor global systems for threats, analyze security alerts, investigate and escalate incidents, recommend remediation, document procedures, produce service reports, and mentor junior analysts. The role supports 24/7 XDR services using Microsoft security tools, Splunk, EDR, IDS, and IPS technologies while contributing to SOC process improvements and customer protection.

Owns strategic relationships with 1–2 global telecommunications accounts, serving as executive sponsor and trusted advisor. Leads multi-year account planning, renewals, cross-sell, upsell, contract negotiations, solution positioning, forecasting, and quota attainment of £5M–£10M annually. Coordinates Pre-Sales, Customer Success, Product, Delivery, Operations, Legal, Finance, and Marketing teams to drive account growth, retention, expansion, and customer advocacy.

Designs, develops, tests, and maintains Splunk SOAR playbooks, Python automations, API integrations, and automated incident response workflows. Integrates SOAR with security, cloud, SIEM, and ITSM platforms while troubleshooting connectors and improving automation coverage and response times. Acts as a Splunk SOAR subject matter expert, supports MXDR deployments, translates customer requirements into scalable solutions, and advises technical and business stakeholders on security operations.

Owns relationships and growth strategy for 1–2 high-value global telecommunications accounts. Responsibilities include executive stakeholder management, multi-year account planning, renewals, cross-selling, upselling, contract negotiations, solution selling, forecasting in Salesforce, and coordinating cross-functional teams. The role carries a £5M–£10M annual quota and requires deep telecommunications expertise, strategic leadership, commercial fluency, and understanding of cybersecurity services.

Conduct network security research and assess client solutions to validate their security fundamentals. Develop innovative solutions, create technical reports, contribute to client tooling and shared knowledge, and mentor less experienced team members. The role also involves leading and growing technology capability areas, planning research topics, and applying expertise in network protocols, operating systems, programming, reverse engineering, debugging, and source-code review.