Top Cyber Security Jobs in Glasgow

Lead security incident response and digital forensic investigations, act as Incident Commander, monitor and analyze security events, build scripts and automated workflows (Python), use SIEM and cloud (AWS/GCP) tooling, mentor engineers, coordinate cross-team remediation, participate in on-call rota aligned to UK/EMEA hours.

Leads the architecture and delivery of GitLab’s static analysis engine and evaluation tooling. Owns program modeling, vulnerability detection quality, SAST rules, AI-assisted development guardrails, and benchmark validation. Sets technical direction, mentors engineers, coordinates complex initiatives, contributes to research and open source, and participates in on-call rotations. The role requires deep program analysis, application security, systems programming, performance optimization, containerized CI/CD, and experience building trustworthy LLM tooling.

Lead product security vulnerability cases from intake through assessment, remediation, customer communication, and responsible disclosure. Coordinate engineering, product, quality, legal, communications, customers, and researchers; manage CVE workflows, security advisories, milestones, risks, and escalations. Improve PSIRT procedures, governance, templates, audit readiness, and regulatory preparedness for requirements such as the EU Cyber Resilience Act.

Leads security engineering and testing across platforms and services, setting testing methodologies, scopes, tools, and reporting standards. Performs penetration testing, source-code security assessments, threat modeling, and cloud and web application security reviews. Partners with agile teams to embed continuous security practices, mentors junior engineers, manages team performance, and communicates security risks to technical and nontechnical audiences.

Supports IAM audit and compliance activities by coordinating evidence collection, reviewing control documentation, tracking findings and remediation, conducting control testing and access reviews, and preparing audit-readiness metrics. Uses Excel, Microsoft Copilot, AI tools, and automation to analyze data, improve evidence quality, identify risks, and strengthen security control maturity.

Acts as a trusted security advisor across the organization, translating business priorities and cyber risks into practical controls, assurance activities, and risk management plans. Partners with product, engineering, and operational teams to embed secure-by-design principles, support compliance, audits, reporting, and incident response, and communicate recommendations clearly to senior and non-technical stakeholders.

Lead information security projects across third-party security, governance, and vulnerability management. Represent Security in company-wide projects, identify and manage risks, develop security policies and procedures, mentor Security Analysts, monitor emerging threats, and collaborate with audit and risk teams to assess security controls. The role is a 12-month fixed-term position with UK-based remote or London work options.

Monitor and triage security alerts across operational technology environments, investigate suspicious activity, support incident response and evidence gathering, and escalate confirmed incidents. The role also contributes to vulnerability management, threat intelligence, detection engineering, SOC playbooks, audit documentation, and continuous process improvement. Collaboration with managed security providers, cyber operations teams, and operational stakeholders is required, with potential on-call duties in a safety-critical infrastructure environment.

Design and review software security architectures for embedded SoC products, perform threat and risk assessments, define security requirements and mitigations, support SDL and compliance (including CRA), and drive security best practices across product teams.

Own security and compliance governance across engineering, translating standards into practical controls and production code. Manage ISO 27001, SWIFT, FPS, SOC 2 and audit activities; maintain risks, controls, evidence, and remediation. Improve release management, incident reviews, backup and restore testing, disaster recovery, operational resilience, and third-party governance. Automate control checks and evidence collection while partnering with engineering, auditors, risk teams, and leadership.

Build and maintain mobile runtime application security capabilities, including RASP shields, anti-tampering, code hardening, secure storage, attestation, and applied cryptography. Develop Python backend services and APIs for threat telemetry, consoles, SIEM integration, and observability. Collaborate on CI/CD, testing, QA, vendor evaluations, product roadmaps, and technical pre-sales. The role requires ownership across the product lifecycle and practical expertise across mobile security, backend engineering, cloud, and delivery infrastructure.

Provides Tier 3 escalation and advanced security analysis for MDR and MXDR customers. Responsibilities include investigating endpoint alerts, reconstructing attack chains across cloud, identity, email, network, and endpoint environments, responding to active breaches, threat hunting, researching emerging threats and malware, developing hunting queries and threat alerts, and engaging with customers from SOC analysts to executives. Requires strong security operations expertise, multilingual communication, scripting, operating systems, networking, and incident response capabilities.

Provides 24/7 threat detection and response for managed security clients. Analyzes complex endpoint security events, investigates incidents, tunes detection and blocking technologies, improves monitoring processes, supports DFIR teams, and handles escalations. The role includes customer interaction, analyst mentoring, documentation, rotating weekend and on-call coverage, and requires fluent German and English while being based and legally authorized to work in the UK.

Provides senior-level security operations support within a 24/7 Threat Detection and Response team. Analyzes complex endpoint security cases, investigates threats, tunes detection and blocking technologies, improves security processes, supports incident response, and mentors analysts. The role serves as a technical escalation point for customers, DFIR teams, and client security teams, with rotating weekend and on-call coverage. Fluency in German and English is required, and the position is UK-based.

Leads EU SOC operations while performing hands-on Tier 2/3 security analysis, incident response, threat hunting, malware and endpoint investigations, and customer escalations. Coaches analysts, coordinates workload, monitors service metrics, supports onboarding, and improves SOC processes. Requires strong cybersecurity experience, customer communication skills, fluent English and German, and expertise in at least two areas such as endpoint security, malware analysis, threat intelligence, incident response, penetration testing, reverse engineering, or digital forensics.

Provides Tier 3 escalation and advanced MDR/MXDR security analysis for global customers. Responsibilities include investigating critical endpoint alerts, reconstructing attack chains across cloud, identity, email, network, and endpoint environments, responding to active breaches, threat hunting, researching malware and adversary tactics, developing hunting queries and threat alerts, and engaging with customers from SOC analysts through executives. The role requires fluent German and English and follows a rotating UK working-day schedule with weekend coverage.

Designs, develops, tests, and troubleshoots scalable security systems using Java and Python. Creates secure production code, contributes to architecture and design artifacts, analyzes data to improve security applications, and supports resilient cloud security platforms. Requires software engineering, system design, application development, testing, SDLC, agile, and security expertise, with AWS and Python preferred.

Maintain and improve Microsoft Defender for Endpoint, Microsoft Sentinel, security monitoring, endpoint protection, log ingestion, and detection capabilities. Support application onboarding, cloud security controls, audits, incident response, investigations, AI-driven security use cases, and stakeholder collaboration. The role also mentors junior team members and helps maintain operational KPIs, KRIs, and standards.

Leads OT security monitoring and triage operations, investigates suspicious activity across industrial networks, validates detections, and escalates findings to incident responders and threat hunters. Maintains the Dragos Platform for customers, including asset classification, vulnerability management, detection tuning, and hardening recommendations. Produces incident reports, mentors analysts, collaborates across cybersecurity teams, and develops expertise in ICS protocols, adversary tactics, and industrial threat intelligence. The role includes shift-based coverage and occasional weekend or on-call work.

Leads secure code reviews across web, mobile, API, embedded, and cryptographic systems; identifies vulnerabilities and provides actionable remediation guidance. Conducts application penetration testing, threat modeling, secure design reviews, and SDLC advisory engagements. Serves as a senior technical client representative, mentors consultants, contributes to AppSec methodologies and research, supports pre-sales, and participates in industry events and published security research.

Provides senior application security architecture leadership with emphasis on API, AI, and agentic systems. Guides secure architecture decisions, threat modeling, secure design reviews, governance, authentication, authorization, cryptography, and cloud-native security. Partners hands-on with engineering teams, assesses existing implementations using security tooling and gateways, establishes policies and standards, mentors developers, and reports security metrics to leadership.

Plans and executes full-scope red team and adversary emulation operations, including phishing, C2, privilege escalation, lateral movement, EDR/XDR evasion, Active Directory and cloud compromise, and social-engineering scenarios. Develops custom offensive tooling, collaborates with Blue Teams to validate detections, documents attack chains, and provides remediation guidance. Requires 5+ years of offensive security experience, advanced scripting skills, and recognized offensive security certifications, with bug bounty or CTF achievements preferred.

Lead hands-on product security architecture across GitLab, including design reviews, threat modeling, systemic risk remediation, security standards, prototypes, and reusable developer guardrails. Partner with engineering and product leaders, secure distributed systems and software supply chains, guide AI coding tool security, mentor security engineers, and influence technical direction through proactive architecture and clear communication.

Leads the strategic direction, growth, and delivery of an information security consultancy practice. Responsibilities include managing and mentoring teams, overseeing ISO 27001 and Cyber Essentials engagements, advising clients on governance, risk, compliance, AI security, and emerging technologies, developing methodologies, supporting proposals and business growth, and communicating risks to senior stakeholders.

Lead and mature Mozilla's ISMS and compliance programs (ISO 27001 and SOC 2 Type 2). Manage SoA, risk treatment, audits, policy lifecycle, gap remediation, internal audits, and cross-functional control ownership while advising security leadership on certification readiness and compliance strategy.