Top Cyber Security Jobs in Glasgow

Owns GitLab’s global security awareness and human-risk program, including training, phishing simulations, behavior-change initiatives, security culture campaigns, multimedia content, platform administration, reporting, vendor management, policy support, audit evidence, and remediation tracking. The role requires measurable risk reduction across a globally distributed enterprise and strategic influence across technical and non-technical teams.

Lead security incident response and digital forensic investigations, act as Incident Commander, monitor and analyze security events, build scripts and automated workflows (Python), use SIEM and cloud (AWS/GCP) tooling, mentor engineers, coordinate cross-team remediation, participate in on-call rota aligned to UK/EMEA hours.

Lead end-to-end incident response for high-severity security events across cloud environments, perform DFIR investigations, build detection and automation (including AI-assisted) workflows, partner cross-functionally, produce executive communications and RCAs, maintain runbooks/playbooks, and mentor other engineers within a 24/7 global on-call model.

Manage the EMEA Security Operations Center within a global 24/7 operation. Responsibilities include defining processes, workflows, and playbooks; maintaining shift coverage and quality assurance; coaching analysts; developing training; partnering with Product, Support, and security teams; improving incident response capabilities; tracking objectives and key results; operationalizing new services; and representing the company in public speaking engagements.

Develops offensive-security labs, challenges, ranges, and learning content for a cyber resilience platform. Researches vulnerabilities, tools, red-team tactics, and AI-driven attacks; tests lab functionality; translates technical findings for technical and non-technical audiences; and collaborates with Product teams on platform innovation.

The Staff Infrastructure Security Engineer will lead security initiatives, set architectural patterns, conduct security reviews, and mentor engineers while ensuring security in cloud infrastructures for GitLab.

Lead and grow a distributed engineering organization building customer-facing security capabilities: proprietary scanners, AI/ML detection engines, agentic remediation, vulnerability management, and security foundations. Set vision and roadmap, drive architecture and delivery, partner with product management, establish engineering standards, and represent the group in cross-functional and customer forums.

Build and maintain Ruby on Rails backend features for vulnerability management, including security dashboards, reports, and ingestion pipelines. Improve system performance, reliability, and scalability; collaborate across backend, frontend, product, design, and security teams; review code; address technical debt; and participate in on-call rotations. The role requires relational database experience, distributed-team collaboration, technical problem-solving, and contributions across the stack when needed.

Lead GitLab’s Security Posture Management team within Product Security. Drive governed security capability rollouts across the software estate, establish secure configuration baselines, build software supply chain security, manage risk registers and posture metrics, support audit evidence, and provide customer-zero feedback to Product and Engineering. Hire, coach, and develop the team while representing GitLab’s security practices externally and driving measurable risk reduction in a remote, asynchronous environment.

Lead field-facing AI security strategy for enterprise customers by designing secure LLM/RAG architectures, delivering demos and POVs, advising on data protection and unsanctioned AI usage, and scaling enablement and product feedback across sales, product, and engineering teams.

Senior security researcher responsible for large-scale data collection and analysis, operating and building honeypots, performing vulnerability research and reverse engineering, developing automated tooling and GenAI/LLM workflows, collaborating with intelligence teams, reproducing vulnerabilities, and publishing technical research.

Serve as a technical and customer-focused advisor for Falcon Complete customers: assess Falcon environments, recommend and document security remediations, liaise with support and internal teams, produce service reports, and ensure alignment with Falcon Complete standards and SLAs.

Design, maintain, and extend abuse detection and prevention systems for GitLab's SaaS platform. Serve as a core maintainer of a Ruby on Rails monolith, build anomaly detection and agentic AI mitigations, automate abuse response, collaborate with peer engineering and security teams, and produce runbooks and operational documentation.

Lead vulnerability management and security testing across IT and OT environments. Coordinate penetration testing and Red Team activities, manage critical vulnerabilities, shape cyber security strategy and roadmaps, and drive cyber resilience initiatives. The role involves guiding tools, processes, and operating models for the Cyber Fusion Centre while collaborating with senior stakeholders, security teams, service providers, and business leaders to protect critical national infrastructure.

Supports a Security Operations Centre through second- and third-line security event analysis, incident response, alert monitoring, phishing campaign management, security tooling maintenance, and information-system reviews. Coordinates third-party security vendors, identifies threat trends, improves secure employee behaviors, and provides technical expertise to the Cyber Incident Response team. The role also partners with Technology Services to strengthen operational security and advises users on security best practices.

Designs and assesses cybersecurity architectures for complex operational technology systems, develops risk management and accreditation processes, conducts IEC 62443 security reviews, and supports secure digital transformation across nuclear and critical infrastructure environments. The consultant also provides technical business development support, maintains regulatory knowledge, and builds stakeholder relationships. Regular client-site travel is required, averaging two to three days per week.

Deliver OT cybersecurity consulting assignments across energy and critical infrastructure environments. Assess cyber risks across OT and IT systems, develop security requirements and architectures, conduct assurance and compliance activities, and produce client-ready reports, roadmaps, and proposals. Build trusted stakeholder relationships, support bids and account growth, and work independently with limited supervision. Candidates should understand OT security, operational resilience, relevant frameworks, and risk assessment approaches, with willingness to travel to client sites.

Drive cloud security sales across Northern Europe: build territory plan and pipeline, lead end-to-end Falcon Cloud Security deals, enable regional account teams, engage technical and executive stakeholders, support post-sale adoption and expansion, and provide product and market feedback. Travel up to 50%.

Performs information security control testing, risk treatment tracking, exception management, user access reviews, audit-ready evidence collection, and compliance reporting. The analyst coordinates risk and compliance activities across IT, digital transformation, procurement, legal, sales, service desk, internal audit, and external stakeholders. The role also improves and automates assurance processes while assessing control effectiveness against frameworks such as ISO 27001 and NIST.

Serve as the technical authority for enterprise customers in data security, owning the technical sales process. Deliver technical presentations, demos, and whiteboard sessions, advise on AI/ML-driven data protection, and drive outcomes through value-based selling with partners and GTM teams.

Triage, investigate, and remediate security alerts using EDR and forensic artifacts. Perform tactical malware analysis, investigate Microsoft M365 activity, assist escalations, contribute to detection engineering, and work on projects to improve SOC outcomes while mentoring and collaborating with teammates.

Execute and manage IT audit activities, assess controls and regulatory compliance (SOX, GDPR, ISO, NIST), run control testing, use GRC tools for evidence tracking, perform IT risk assessments, manage third-party risk, coordinate with auditors and stakeholders, and provide actionable security and compliance insights to leadership.

Designs, deploys, and operates enterprise EDR/XDR and NGAV capabilities across hundreds of thousands of heterogeneous endpoints, servers, containers, virtual environments, and multi-cloud workloads. Responsibilities include behavioral protection, detection authoring, allowlisting, phased deployments, endpoint health monitoring, advanced host forensics, live remediation, SOC escalation support, attack simulation, and Purple Team validation. The engineer partners with application owners and IT teams to reduce false positives, improve coverage, and communicate technical risk.

Leads complex cybersecurity programmes from initiation through delivery, managing governance, budgets, risks, dependencies, compliance, and stakeholder engagement. Coordinates cross-functional business, technology, and security teams to implement security capabilities and controls, including identity and access management, security operations, vulnerability management, cloud security, and regulatory compliance initiatives. Provides executive reporting and drives measurable organisational risk reduction.

Own administration, configuration, and lifecycle management of security tooling. Improve detection quality and reduce false positives, enforce change control and governance, maintain MITRE ATT&CK mapping and coverage analysis, and drive continuous optimisation of security tooling across enterprise, cloud, and network environments.