Job Title: Security Incident Response Engineer – SC
Daily Rate: £100/hr (Ltd– Maximum)
Location: Warrington / Hybrid (2 days/week on site)
Contract Duration: 6 Months
IR35 Status: Outside
Security Clearance: SC

Minimum Requirement:
• experience with ServiceNow, particularly SecOps
• cyber security / incident response experience
• stakeholder engagement
Description:

1. ServiceNow SIR Workflow Design & Development

Review existing processes and define required workflows in SIR, including:
• Incident triage
• Escalation paths
• Case handling lifecycle
• Evidence management
• Integration with CSOC tooling
Build, test, and refine workflows to ensure alignment with:
• Cyber Operations requirements
• Incident Management frameworks
• NCSC-aligned cyber incident processes
2. Platform Configuration & Enhancement

Configure and customise the SIR module including:
• Forms, fields, templates, and worknotes
• Automated routing and case assignment
• Severity/classification schemes
• Response templates and guided response actions
• Identify missing capabilities and design platform enhancements.
• Work with ServiceNow platform owners to ensure changes meet governance and architectural standards.
3. Systems Integration & Automation

Support integration of SIR with:

• SIEM/SOC tools
• Threat intelligence feeds
• Security Orchestration, Automation and Response (SOAR) modules
• Email ingestion and ticket creation workflows
• ITSM processes (Change, Problem, Incident)
Develop automations that reduce manual effort and improve response times.

4. Data, Reporting & Dashboards

Define and implement:
• Operational dashboards for CSOC analysts
• Performance metrics and KPIs for Senior management
• Compliance and audit-ready reporting
• Workflow analytics to drive continuous improvement
Ensure visibility of incident trends, response times, and workflow bottlenecks.

5. Documentation, Playbooks & Supporting Materials

Build existing cyber response processes into SIR-based guided workflows where appropriate.
Create:
• User guides
• SOPs / process documentation
• Technical configuration documentation
• Data flow diagrams
• Integration maps
Ensure all documentation supports long‑term maintainability.

6. Training, Knowledge Transfer & BAU Handover

Deliver hands-on training sessions for Cyber Operations staff.
Provide detailed handover materials for:
• ServiceNow platform support
• Cyber Operations teams
• Process owners
Support the embedding of SIR into BAU operations.

Disability Confident
As a member of the disability confident scheme, CLIENT guarantees to interview all candidates who have a disability and who meet all the essential criteria for the vacancy. In cases where we have a high volume of candidates who have a disability who meet all the essential criteria, we will interview the best candidates from within that group.

Armed Forces Covenant   
CLIENT is proud to support the Armed Forces Covenant and as such, we guarantee to interview all veterans or spouses / partners of military personnel who meet all the essential criteria for the vacancy. In cases where we have a high volume of ex-military candidates / military spouses or partners, who meet all of the essential criteria, we will interview the best candidates from within that group.
If you qualify for the above, please notify us on 0121 794 8181.
We will be in touch to discuss your suitability and arrange your Guaranteed Interview.
Should you require reasonable adjustments at any point during the recruitment process or if there is a more accessible way for us to communicate, please do let me know.

To apply for this role please submit your latest CV or contact Aspect Resources on 0121 794 8181