TryHackMe Ltd

TryHackMe Ltd is seeking experienced incident responders to join the Content Engineering team. In this remote role, you will turn your real-world incident response expertise into cybersecurity training material, collaborate on high-quality content, and develop realistic lab scenarios. Key qualifications include significant industry experience, strong communication skills, and relevant certifications. Enjoy benefits such as flexitime, a training budget, and annual company retreats while contributing to shaping future cybersecurity professionals.

The Role We're looking for experienced incident responders and blue team practitioners to join our Content Engineering team. Your job is simple in concept: take what you know from real world IR work and turn it into world class training content. You'll take your years of real world experience and teach your peers and the next generation. Job Responsibilities Research, design, and develop defensive cyber security training material with supporting hands on lab exercises (such as virtual machines and datasets for analysis). Draw on your real world IR experience to build realistic, scenario driven labs that reflect how attacks actually unfold in enterprise Windows environments. Develop and configure virtual machines and sample datasets for realistic cybersecurity labs. Collaborate closely with your team by sharing expertise, reviewing each other's work, and raising the quality bar collectively. Take charge of planning and designing portions of the content development roadmap. Collaborate with the Head of Content Engineering to continuously improve the content development process. Analyse industry trends in tooling and techniques and recreate them as teachable content. Strategically plan, review, and schedule content with our blue team content engineering team. Technical Skills & Experience To be considered for this opportunity, you must have significant hands on relevant cyber security industry experience in roles such as Incident Responder, Threat Hunter, Digital Forensics Investigator or L3 SOC Analyst. You should also demonstrate: Proven, hands on experience responding to real incidents in Windows environments. Triaging compromised endpoints, analysing forensic artefacts, and reconstructing attacker timelines from initial access through to impact. Solid grounding in Windows forensics and artefact analysis - event logs, registry hives, NTFS artefacts, and memory/disk forensics - with the ability to extract attacker activity from both live systems and forensic images. Working knowledge of offensive techniques used against Windows and Active Directory environments, including credential dumping, privilege escalation, Kerberos based attacks, and lateral movement, and critically, how to detect them in forensic artefacts, contain them during live response, and prevent recurrence. Hands on familiarity with attacker tooling and tradecraft - fileless execution, living off the land techniques (LOLBins), common exfiltration methods, and ransomware deployment patterns - including the TTPs of active APT groups and ransomware as a service operators. Experience with DFIR collection tooling such as EZ Toolset, Velociraptor, KAPE, or equivalent with an understanding of how to conduct IR at scale across enterprise environments. Strong verbal and written English communication skills, essential for conveying complex technical concepts. Preferred Skills (nice to have) Any experience creating training content, writing documentation, or explaining technical concepts to others either formally or informally Deeper expertise in one or more specialist areas: Active Directory attack paths (Kerberoasting, DCSync, ADCS), memory forensics (MemProcFS, Volatility), or advanced NTFS analysis Creating challenges for capture the flags (CTFs) Experience leading, coaching, or mentoring others Certifications such as GIAC Certified Incident Handler (GCIH), GIAC Certified Enterprise Defender (GCED), Security Analyst Level 2 (SAL2), Certified Forensic Analyst (GCFA) Benefits & Perks 100% Remote - In a fully digital world, work from anywhere you want! Flexi Time - Choose your own hours as long as you have at least 4 hours of overlap with the UK timezone (from 8am - 6pm) Tools - a dedicated work laptop + any accessories you need to do your best work. Swag Pack - start your TryHackMe journey with a branded swag bundle! Personal Development - £2,500 training budget to acquire certifications, and more. Company Retreat - an annual company retreat, fully paid for by us! Lunch on us - whether you're a pizza lover, salad obsessed or a big sushi fan, TryHackMe will cover the cost of your lunch order during our recurring company virtual lunches. Health Insurance - if you're in a country that doesn't have public health care. Enhanced Maternity & Paternity - an enhanced package on top of statutory requirements. 401k / Pension - TryHackMe makes it easy to save money for your retirement.

About TryHackMe TryHackMe is scaling its GTM motion across Sales, Account Management, Customer Success, and Marketing. To support ambitious revenue targets, we are strengthening our Revenue Operations function with a role focused on data infrastructure, automation, and reporting enablement. This role partners closely with Sales, CS, AM, Marketing, Data, and RevOps leadership to ensure teams have reliable data, scalable systems, and actionable insights-so they can execute effectively against revenue goals. This is a hands-on, collaborative role designed to accelerate execution, reduce friction, and support revenue-driving initiatives across the business. The Challenge As TryHackMe grows, our GTM teams need stronger operational support to keep pace with complexity and scale: Data infrastructure must be continuously improved to support forecasting, performance tracking, and decision-making Automation and workflows need refinement to reduce manual effort and improve speed-to-action Reporting foundations require ongoing iteration to support leadership, Sales, CS, and AMs Cross-system data consistency is critical as HubSpot, ChurnZero, Tableau, Snowflake, and enrichment tools evolve This role helps ensure RevOps initiatives translate into practical, usable systems that teams can rely on day-to-day. Responsibilities Support reporting and analytics by building and maintaining dashboards that surface clear GTM insights for Sales, CS, AM, and leadership Partner with Data and RevOps leadership to maintain and improve data pipelines across HubSpot, ChurnZero, Tableau, and Snowflake Design and maintain automation in HubSpot and related tools to improve funnel flow, forecasting accuracy, and CRM hygiene Enable GTM teams with clean data structures, consistent definitions, and reliable reporting Support forecasting and revenue tracking initiatives for New Business, Renewals, and Expansion Improve data quality and consistency through audits, validation rules, and workflow logic Document processes and system logic to ensure transparency, adoption, and scalability Collaborate cross-functionally with Sales Ops, CS Ops, Marketing Ops, and Data to translate requirements into operational solutions Assist with ad-hoc analysis and enablement as revenue priorities evolve What We're Looking For Required Skills & Experience Strong hands-on experience with HubSpot (workflows, properties, lifecycle stages, reporting, integrations) Working knowledge of ChurnZero for CS reporting, renewals, and expansion tracking Experience supporting Tableau dashboards and structured reporting outputs Comfort working with data models and pipelines in partnership with Data / Analytics teams Strong understanding of B2B SaaS revenue mechanics (pipeline, forecasting, NRR, GRR, expansion) Ability to collaborate closely with non-technical stakeholders and translate needs into operational solutions Organized, delivery-focused, and comfortable operating across multiple workstreams Attributes We Value Collaborative mindset - you enable others to succeed rather than working in isolation Execution-oriented - you focus on practical improvements that unblock teams Data-conscious - you care deeply about accuracy, definitions, and consistency Clear communicator - able to explain systems and data simply Adaptable and proactive - comfortable iterating as GTM priorities change AI-aware - uses AI and automation thoughtfully to accelerate outcomes Nice to Have Experience with Clay, Pocus, Gong, or similar GTM tools Exposure to cybersecurity or edtech GTM motions Experience supporting both Sales and Customer Success workflows Familiarity with enrichment, intent data, and buyer journey tracking What Success Looks Like Within the first 30 days: Supported improvements to existing dashboards and reporting workflows Helped stabilize data consistency across core GTM systems Delivered automation or workflow improvements that reduce manual effort Partnered with RevOps leadership on priority initiatives Within 60-90 days: Reporting and forecasting workflows are more reliable and trusted by teams GTM teams experience faster execution due to cleaner data and automation Documentation and system logic are easier for teams to understand and adopt Revenue teams are better supported in hitting New Business and Expansion targets Why This Role Matters This role ensures that RevOps strategy translates into execution. By strengthening data infrastructure, automation, and reporting: Sales can prioritize and forecast more confidently CS and AMs can manage renewals and expansions more effectively Leadership can make decisions based on consistent, trusted data Revenue growth scales without unnecessary operational overhead

TryHackMe Ltd is looking for a role that focuses on enhancing data infrastructure, automation, and reporting within their Revenue Operations team. This hands-on position requires collaboration with Sales, Customer Success, and Marketing teams to ensure reliable data and effective execution of revenue goals. The ideal candidate will improve dashboard reporting, data quality, and automation processes, enabling teams to make informed decisions and drive revenue success.

TryHackMe Ltd is seeking a contractor in the UK to develop AI systems for their innovative Live Breach product in cybersecurity. The role focuses on building and owning an autonomous LLM-powered attacker agent capable of real-time adaptability during cybersecurity exercises. Essential skills include strong Python engineering and experience with LLMs and adversary emulation frameworks. The position offers remote work with occasional travels to London for build sprints.

TryHackMe Ltd is seeking a Revenue Operations professional focused on data infrastructure, automation, and reporting. This hands-on role involves improving data pipelines and maintaining dashboards for Sales and Customer Success teams. The ideal candidate should have experience with HubSpot, ChurnZero, and Tableau, alongside strong B2B SaaS revenue mechanics knowledge. Collaboration with cross-functional teams will be crucial to ensure effective execution against revenue goals, supporting growth without operational overhead.

TryHackMe Ltd is seeking an AI Engineer to develop an autonomous LLM-powered agent for their Live Breach product. This role involves building AI systems and ensuring they function autonomously during simulated cyber incidents. Key responsibilities include collaborating on prompt engineering and integrating adversary emulation tooling. Essential skills required are strong Python proficiency, experience with LLM agents, and knowledge of cybersecurity concepts. The position allows for remote work with occasional travel to London.