Top Cyber Security Jobs in Glasgow

Designs, develops, tests, and troubleshoots scalable security systems using Java and Python. Creates secure production code, contributes to architecture and design artifacts, analyzes data to improve security applications, and supports resilient cloud security platforms. Requires software engineering, system design, application development, testing, SDLC, agile, and security expertise, with AWS and Python preferred.

Leads OT security monitoring and triage operations, investigates suspicious activity across industrial networks, validates detections, and escalates findings to incident responders and threat hunters. Maintains the Dragos Platform for customers, including asset classification, vulnerability management, detection tuning, and hardening recommendations. Produces incident reports, mentors analysts, collaborates across cybersecurity teams, and develops expertise in ICS protocols, adversary tactics, and industrial threat intelligence. The role includes shift-based coverage and occasional weekend or on-call work.

Lead security incident response and digital forensic investigations, act as Incident Commander, monitor and analyze security events, build scripts and automated workflows (Python), use SIEM and cloud (AWS/GCP) tooling, mentor engineers, coordinate cross-team remediation, participate in on-call rota aligned to UK/EMEA hours.

Lead hands-on product security architecture across GitLab, including design reviews, threat modeling, systemic risk remediation, security standards, prototypes, and reusable developer guardrails. Partner with engineering and product leaders, secure distributed systems and software supply chains, guide AI coding tool security, mentor security engineers, and influence technical direction through proactive architecture and clear communication.

Drives adoption, optimization, and customer success for Splunk’s security platform. Provides technical guidance on Enterprise Security and UBA use cases, configuration, and resilience; resolves complex challenges; collaborates with sales, support, and product teams; develops scalable processes and enablement materials; identifies expansion opportunities; and mentors team members. Requires substantial information security experience, Splunk certifications, SIEM expertise, security certifications, and proficiency across Unix, Windows, Bash, and Python.

Maintain and improve Microsoft Defender for Endpoint, Microsoft Sentinel, security monitoring, endpoint protection, log ingestion, and detection capabilities. Support application onboarding, cloud security controls, audits, incident response, investigations, AI-driven security use cases, and stakeholder collaboration. The role also mentors junior team members and helps maintain operational KPIs, KRIs, and standards.

Provide technical security advice and through-life assurance for Thales IS/IT environments. Deliver security reviews, cloud and incident response guidance, compliance to government standards, risk assessments, CoCo assurance, and security requirements for delivery squads. Maintain security documentation and support continual assurance, training, and remediation across on-premises and cloud systems.

Provides enterprise SOC/MDR security operations support focused on QRadar administration and engineering, log source integrations, troubleshooting, use case development, content tuning, workflow maintenance, and automation. Supports integrations such as CrowdStrike auto-isolation and develops Python scripts for existing automation requirements. Requires extensive hands-on QRadar expertise and significant IT experience.

Supports SOC operations through second- and third-line security incident analysis, response, detection engineering, and escalation. Coordinates third-party security vendors, maintains security tooling, reviews monitoring rules, manages phishing campaigns, analyzes attack trends, and supports cyber incident response. The role also performs security reviews across systems and infrastructure, promotes secure behaviors, and advises stakeholders on operational security, policies, controls, and regulatory requirements in an Azure and Microsoft 365 environment.

Conduct advanced application security research across GitLab’s DevSecOps and AI-powered platforms. Identify and exploit novel, systemic, and chained vulnerabilities; develop proof-of-concept exploits, testing methodologies, and research automation; assess AI attack vectors and open-source dependencies; drive remediation and security improvements; advise engineering teams, contribute to roadmaps, mentor researchers, and share findings with the security community.

Conducts advanced application security research across GitLab’s DevSecOps and AI-powered platforms. Responsibilities include discovering and exploiting systemic vulnerabilities, penetration testing, developing proof-of-concept exploits, researching AI and agentic security threats, building automated research tooling, coordinating remediation, mentoring security professionals, and communicating findings to engineering and security communities.

Lead Samsara’s vulnerability management and application security programs across cloud, firmware, IoT, and corporate systems. Define technical strategy, automate vulnerability detection and response, reduce remediation time, guide engineering teams, mentor security engineers, investigate critical vulnerabilities, and support incident response. The role requires strong AWS, programming, vulnerability management, application security testing, AI/LLM, and security automation expertise.

Builds, modernizes, and operates Walmart’s enterprise SailPoint IdentityIQ platform. Designs identity lifecycle workflows, access governance, policy controls, integrations, custom connectors, APIs, and automation across directories, HR systems, mainframes, cloud platforms, and enterprise applications. Leads platform upgrades, hardening, monitoring, incident response, high availability, and disaster recovery while ensuring scalability, compliance, and reliability.

Design, implement, and improve security controls across Kubernetes, cloud-native, and datacentre infrastructure. Secure networks and firewalls, integrate DevSecOps controls into CI/CD, lead vulnerability management, build detection/response capabilities, automate security workflows, and support incident response and threat hunting for GPU-accelerated and AI/ML platforms.

Own and evolve GitLab’s authorization systems across its Ruby on Rails monolith and next-generation Rust policy engine. Design fine-grained permissions for users, tokens, roles, and AI agents; secure GraphQL and REST APIs; lead feature-flagged rollouts and migrations; improve performance and reliability; and collaborate across authentication, platform, AI, and modular-service teams in a distributed asynchronous environment.

Monitor and respond to global security incidents, lead incident response lifecycles, conduct threat hunting, manage threat intelligence workflows, and maintain SIEM, EDR, SOAR, alerts, playbooks, and escalation processes. The role participates in on-call rotations, coordinates stakeholders, and drives continuous improvement across preparation, detection, containment, and post-incident activities.

Configure and mature CrowdStrike Falcon Cloud Security and CNAPP capabilities across Kubernetes and Amazon EKS environments. Responsibilities include CSPM, CDR, CWP, CIEM, container security, runtime protection, admission control, security testing, and detection validation. The consultant will collaborate with cloud engineering teams, communicate technical decisions to stakeholders, and support a state government health agency in a primarily remote role with monthly travel.

Lead technical response to security events across Twilio's global cloud infrastructure: triage, contain, remediate, document incidents, build runbooks and automations, drive post-incident improvements, participate in on-call rotation and RCAs, and collaborate with R&D to scale threat mitigation and incident response capabilities.

Lead end-to-end incident response for high-severity security events across cloud environments, perform DFIR investigations, build detection and automation (including AI-assisted) workflows, partner cross-functionally, produce executive communications and RCAs, maintain runbooks/playbooks, and mentor other engineers within a 24/7 global on-call model.

Manage the EMEA Security Operations Center within a global 24/7 operation. Responsibilities include defining processes, workflows, and playbooks; maintaining shift coverage and quality assurance; coaching analysts; developing training; partnering with Product, Support, and security teams; improving incident response capabilities; tracking objectives and key results; operationalizing new services; and representing the company in public speaking engagements.

Build and secure backend systems that execute untrusted user code at scale. Responsibilities include designing sandboxed runtimes, threat detection, incident response, vulnerability management, penetration testing, security reviews, vulnerability disclosure, SOC 2 maintenance, and promoting security practices across engineering. The role requires backend engineering, offensive-security curiosity, runtime isolation experience, on-call participation, and collaboration with an open-source developer tools community.

Lead and grow a distributed engineering organization building customer-facing security capabilities: proprietary scanners, AI/ML detection engines, agentic remediation, vulnerability management, and security foundations. Set vision and roadmap, drive architecture and delivery, partner with product management, establish engineering standards, and represent the group in cross-functional and customer forums.

Develops security requirements, architectures, and designs for complex operational technology systems, especially in nuclear and critical infrastructure environments. Conducts cyber risk assessments and security reviews, implements risk management processes, supports accreditation, and advises on secure digital transformation. The role requires strong IT and OT cybersecurity experience, knowledge of IEC 62443 and related regulatory frameworks, hands-on experience with security technologies and networking, stakeholder relationship management, and regular travel to client sites.

Leads Tide’s Product and Identity Security functions, setting strategy and executing a funded roadmap across application, cloud, AI, architecture, IAM, penetration testing, and vulnerability operations. Manages a distributed global team, remains technically hands-on, partners with executives and engineering leaders, and oversees security enablement, champions programs, incident escalations, metrics, recruiting, and team development.

Designs, builds, and validates bespoke security solutions and automation using enterprise AI tools. Performs STRIDE threat modeling, vulnerability analysis, technical risk assessments, remediation verification, and security control mapping. Ensures compliance with ISO 27001, NIST standards, and the EU Cyber Resilience Act. Develops security architecture documentation, maintains sandbox labs, verifies encryption, access controls, MFA, and logging, and supports pre-sales security tenders and customer evaluations.