About this role
Role summary/purpose of job
We are seeking a passionate Security Specialist with hands-on experience in working with all aspects of Azure, M365, and preferably Google Cloud Platforms (GCP). Aside from infrastructure, the candidate should have experience and working knowledge of SIEM and vulnerability management platforms. The role will cover elements of cyber incident response, so a background in supporting a wider incident response function is a necessity.
Key Responsibilities
Cloud Security Assessment & Advisory
•
Assess the security configurations of Azure IaaS and Google Cloud environments, including infrastructure.
•
Provide recommendations based on industry best practices and emerging security threats.
•
The ability to provide Cyber Incident Responders subject matter expertise in Cloud security when required.
Defender & Security Monitoring Advisory
•
Evaluate and optimise the use of Azure Defender and other security monitoring tools in Azure and Google Cloud.
•
Offer guidance on improving threat detection, monitoring, and response for cloud-based resources.
Access Control & Conditional Access
•
Assess and improve Conditional Access policies and identity management strategies, enforcing zero trust and least privilege principles.
•
Provide expert advice on configuring and managing identity and access management (IAM) solutions for secure cloud environments.
Compliance & Governance
•
Ensure cloud environments meet regulatory and internal governance requirements.
•
Conduct periodic security audits and risk assessments, offering actionable recommendations.
Security tooling engineering and maintenance
•
Day to day maintenance of various security tools including SIEM and vulnerability scanning toolsets.
•
Manage upgrades, configuration changes and feature enhancements.
Support the Cyber Incident Response team
•
Provide support on all types of cyber incident response as part of the wider cyber response function.
•
Use tooling such as SIEM, EDR, IdP
Key Requirements
•
Experience in an IT engineering capacity.
•
Hands-on experience administering Azure security environments.
•
Strong experience managing compute, network, and storage resources across cloud and hybrid environments.
•
Extensive knowledge of Azure services, Microsoft Defender, Conditional Access, and Google Cloud security tools.
•
Strong understanding of SIEM platforms, vulnerability management tools, and supporting infrastructure.
•
Broad knowledge of core IT domains, including infrastructure, software development, databases, cloud platforms, and identity and access management (IAM).
•
Strong engineering background with expertise in Windows Server, endpoint platforms, macOS, and Linux.
•
Strong knowledge of information security frameworks, including NIST and relevant NIST 800-series publications.
•
Hands-on experience with SIEM technologies, including data ingestion, monitoring, alerting, and integration with security operations processes.
•
Proficiency in Terraform and infrastructure-as-code (IaC) best practices.
•
Excellent written and verbal communication skills, with the ability to explain technical concepts to both technical and non-technical audiences.
Desirable Certifications
•
Relevant cloud and security certifications, such as
•
Microsoft Certified: Azure Security Engineer Associate
•
Google Professional Cloud Security Engineer
•
Other equivalent cloud security certifications
Department Overview
Formed in 2014, the Information Security Group (ISG) focuses on delivering operational and strategic information / cyber security and business continuity. The group is independent of IT. Operationally the Information Security Committee and Conduct and Risk Committee oversee the group. The Chief Global Information Security Officer reports into the General Counsel and Global Risk Partner.
The ISG department is based mainly in the firm’s London and Manchester offices.
Inclusion
Freshfields is an equal opportunities employer and all applications received by the firm will be considered on the basis of their merit alone. We welcome applications from all suitably qualified individuals regardless of background. All offers of employment will be conditional on the candidate having/securing the right to work in the UK in the role in question and providing the firm with evidence of that right (as required by the Immigration, Asylum and Nationality Act 2006) prior to employment commencing.
Freshfields is a Ban the Box employer. We ask applicants to disclose criminal convictions only if and when a conditional job offer is made. A conviction does not automatically lead to withdrawal of the offer: we make decisions on a case-by-case basis and take a number of relevant factors into account (e.g. the role you are applying for and the circumstances of the offence). You would have the opportunity to discuss the matter with us before we make a decision.
About cyber security & digital forensics roles for ex-police
Cyber security, digital forensics and incident-response roles. DMIs, cybercrime investigators and digital forensics officers bring evidential discipline and investigative judgement that DFIR and security teams struggle to hire.
See all cyber security & digital forensics jobs in London →Why this fits a police background — match score 90/100
- Incident command & response
- Risk & threat assessment
- Working to legislation & regulation
- Security operations
What cyber security & digital forensics roles pay ex-police
Advertised UK ranges, editorial estimates reviewed July 2026
| Digital forensics analyst | £32,000–£45,000 |
| DFIR consultant | £45,000–£65,000 |
| Senior forensics / IR specialist | £60,000–£80,000 |
| Threat-intelligence specialist | £55,000–£80,000 |