Security Incident Response Engineer - Central Government

Role: Security Incident Response Engineer REF 102047
Contract Length: 6 months
Location: Hybrid/Warrington – 2 days per week in the office
IR35: Outside
Pay Rate to Intermediary: Market Rate
Security Clearance: SC requested

Spinwell is recruiting for a Security Incident Response Engineer for an excellent opportunity within the public sector.

RESPONSIBILITIES OF THE SECURITY INCIDENT RESPONSE ENGINEER

• ServiceNow SIR Workflow Design & Development
  • Review existing processes and define required workflows in SIR, including:
  • Incident triage
  • Escalation paths
  • Case handling lifecycle
  • Evidence management
  • Integration with CSOC tooling
• Build, test, and refine workflows to ensure alignment with:
  • Cyber Operations requirements
  • Incident Management frameworks
  • NCSC-aligned cyber incident processes
• Platform Configuration & Enhancement
  • Configure and customise the SIR module including:
  • Forms, fields, templates, and worknotes
  • Automated routing and case assignment
  • Severity/classification schemes
  • Response templates and guided response actions
  • Identify missing capabilities and design platform enhancements.
  • Work with ServiceNow platform owners to ensure changes meet governance and architectural standards.
• Systems Integration & Automation
  • Support integration of SIR with:
  • SIEM/SOC tools
  • Threat intelligence feeds
  • Security Orchestration, Automation and Response (SOAR) modules
  • Email ingestion and ticket creation workflows
  • ITSM processes (Change, Problem, Incident)
  • Develop automations that reduce manual effort and improve response times.
• Data, Reporting & Dashboards
  • Define and implement:
  • Operational dashboards for CSOC analysts
  • Performance metrics and KPIs for Senior management
  • Compliance and audit-ready reporting
  • Workflow analytics to drive continuous improvement
  • Ensure visibility of incident trends, response times, and workflow bottlenecks.
• Documentation, Playbooks & Supporting Materials
• Build existing cyber response processes into SIR-based guided workflows where appropriate.
• Create:
  • User guides
  • SOPs / process documentation
  • Technical configuration documentation
  • Data flow diagrams
  • Integration maps
• Ensure all documentation supports long‑term maintainability.
• Training, Knowledge Transfer & BAU Handover
  • Deliver hands-on training sessions for Cyber Operations staff.
  • Provide detailed handover materials for:
  • ServiceNow platform support
  • Cyber Operations teams
  • Process owners
  • Support the embedding of SIR into BAU operations.

  SKILLS/EXPERIENCE OF THE SECURITY INCIDENT RESPONSE ENGINEER

• Experience with ServiceNow, particularly SecOps
• Cyber security / incident response experience
• Stakeholder engagement

If you are a Security Incident Response Engineer, apply now or send your CV to Spinwell!

We welcome all applications regardless of background, in line with our commitment to diversity, equality and inclusion.

Applying to this or any other vacancy advertised by Spinwell Ltd constitutes an agreement for Spinwell Ltd to hold your details for 24 months for the purpose of assessing suitability for the advertised position and to make you aware of any other positions deemed suitable of which You will make you aware by means of either email, text or phone. In line with GDPR regulations you are able to request your details be removed from the company data at any time by emailing us