Security Incident Response Engineer
| Job Type | Contract |
| Location | Warrington/ Hybrid |
| Area | North West, UK |
| Sector | Defence & Nuclear |
| Salary | £100 Per Hour |
| Start Date | July 3rd, 2026 |
| Advertiser | Priyanka Dubey |
| Job Ref | 7559-PSR1JP00102047 |
| IR35 | Outside |
| Security Clearance | SC |
- Description
- The Client:
A Government client is looking for a Security Incident Response Engineer to join them on a 6 month contract. This position will be based in Warrington/ Hybrid.
Job Summary:
Key essentials:
- Experience with ServiceNow, particularly SecOps.
- Cyber security / incident response experience.
- Stakeholder engagement.
1. ServiceNow SIR Workflow Design & Development
Review existing processes and define required workflows in SIR, including:
- Incident triage.
- Escalation paths.
- Case handling lifecycle.
- Evidence management.
- Integration with CSOC tooling.
- Build, test, and refine workflows to ensure alignment with:
- Cyber Operations requirements.
- Incident Management frameworks.
- NCSC-aligned cyber incident processes.
2. Platform Configuration & Enhancement
Configure and customise the SIR module including:
- Forms, fields, templates, and worknotes.
- Automated routing and case assignment.
- Severity/classification schemes.
- Response templates and guided response actions.
- Identify missing capabilities and design platform enhancements.
- Work with ServiceNow platform owners to ensure changes meet governance and architectural standards.
3. Systems Integration & Automation
Support integration of SIR with:
- SIEM/SOC tools.
- Threat intelligence feeds.
- Security Orchestration, Automation and Response (SOAR) modules.
- Email ingestion and ticket creation workflows.
- ITSM processes (Change, Problem, Incident).
- Develop automations that reduce manual effort and improve response times.
4. Data, Reporting & Dashboards
Define and implement:
- Operational dashboards for CSOC analysts.
- Performance metrics and KPIs for Senior management.
- Compliance and audit-ready reporting.
- Workflow analytics to drive continuous improvement.
- Ensure visibility of incident trends, response times, and workflow bottlenecks.
5. Documentation, Playbooks & Supporting Materials
Build existing cyber response processes into SIR-based guided workflows where appropriate.
Create:
- User guides.
- SOPs / process documentation.
- Technical configuration documentation.
- Data flow diagrams.
- Integration maps.
- Ensure all documentation supports long term maintainability.
6. Training, Knowledge Transfer & BAU Handover
- Deliver hands-on training sessions for Cyber Operations staff.
- Provide detailed handover materials for:
- ServiceNow platform support.
- Cyber Operations teams.
- Process owners.
- Support the embedding of SIR into BAU operations.
An active SC clearance is required for this role. At a minimum, candidates must be eligible and willing to undergo security clearance. Due to the short-term nature of the contract and the urgency of the requirement, the client may prioritise applicants who already hold active SC clearance and meet all essential criteria.
Our Company:
Malikshaw Interim & Executive is a specialist provider of talent management solutions helping our clients transform the delivery of our public services. As an Equal Opportunities Employer, we combine providing the best talent with delivering diverse, inclusive workforces and particularly encourage applications from candidates who are likely to be underrepresented. These include people from Black, Asian and minority ethnic backgrounds, disabled people, LGBTQI+ people, and women.
How to Apply:
Please apply through the link provided to send your application directly to the Recruiter managing this assignment.
Disability Confident:
As a member of the disability confident scheme, the Client guarantees to interview all candidates who have a disability and who meet all the essential criteria for the vacancy. In cases where we have a high volume of candidates who have a disability who meet all the essential criteria, we will interview the best candidates from within that group.
Armed Forces Covenant:
As a member of the Armed Forces Covenant, the Client guarantees to interview all veterans or spouses / partners of military personnel who meet all the essential criteria for the vacancy. In cases where we have a high volume of ex-military candidates / military spouses or partners, who meet all of the essential criteria, we will interview the best candidates from within that group.
If you qualify for any of the above, please notify us on your covering letter and your recruiter will confirm if the client is a member. We will then be in touch to discuss your suitability and arrange your Guaranteed Interview.
Should you require reasonable adjustments at any point during the recruitment process or if there is a more accessible way for us to communicate, please do let me know.
- Experience with ServiceNow, particularly SecOps.
