Principal Engineer - #2167713

Cyber Incident Response Principal Engineer - Contract

Sheffield (2-3 days a week)

Join Global Cybersecurity Operations and Intelligence (GCO&I) as a Principal Engineer driving the evolution of Incident Response automation and orchestration. This role combines deep IR expertise with strong engineering capability — applying AI/ML and modern data engineering to accelerate collection, triage, enrichment, investigation, and response decisioning, all within a controlled, auditable framework.

What you'll do:

• Lead the continued evolution of incident response and forensic capabilities, with a strong emphasis on automation and engineering delivery
• Design integrations and workflows that reduce manual IR effort and shorten time-to-contain
• Build and maintain automation pipelines connecting detections, enrichment, investigation steps, evidence capture, and response actions
• Translate IR playbooks into automated workflows — decision trees, conditional branching, approvals, safeguards, and rollback
• Develop bespoke tooling and solutions to solve unique IR problems
• Build AI-assisted capabilities to speed up triage and investigations (alert clustering, entity resolution, log summarisation, enrichment recommendations)
• Develop and maintain LLM-enabled analyst-assist tooling (summaries, guided investigations, draft IR reports, playbook suggestions) with strong auditability, prompt safety, and data handling controls
• Apply ML techniques to improve signal quality (anomaly detection, prioritisation scoring), ensuring outputs remain explainable and operationally usable
• Establish evaluation methods for AI features (precision/recall, time saved, false-positive reduction, robustness testing)
• Support identification and implementation of new detections, tightly coupling engineering output to detection and response outcomes
• Develop detailed processes and procedures enabling repeatable, reliable, automated response to cyber security events

What you'll bring:

• Deep Incident Response experience combined with strong software/platform engineering capability
• Hands-on experience building automation and orchestration for security operations (SOAR-type workflows)
• Practical experience applying AI/ML to security use cases, with a strong grasp of explainability, auditability, and safe deployment
• Experience with modern data engineering approaches for collection, enrichment, and triage pipelines
• Understanding of cyber incident response, forensic investigation, and detection engineering
• Ability to translate playbooks into automated, auditable workflows with proper safeguards
• Strong engineering delivery mindset — comfortable building bespoke tooling from the ground up

Ideal for: a hybrid IR practitioner-engineer who's as comfortable designing automation pipelines and evaluating AI model performance as they are understanding the operational realities of incident containment and response.