Cyber Security Engineer

Role overview

Key responsibilities

• Design, implement and maintain cyber security solutions to reduce business risk and support compliance with policies and standards.
• Identify security requirements through risk and business impact assessments with business units, project teams and risk specialists.
• Help deliver the cyber security roadmap and controls supporting relevant frameworks and certifications.
• Embed secure-by-design principles in projects, providing guidance, standards, templates and security baselines.
• Assess threats, vulnerabilities and control techniques; recommend remedial action and support critical incident response with Cyber Operations.
• Maintain policies, standards and processes; evaluate technologies, suppliers and security services and advise security leadership.

Essential requirements

• Relevant cyber security engineering qualifications or equivalent practical experience.
• Enterprise infrastructure experience, including Windows and Microsoft Azure cloud or hybrid environments, and hands-on Microsoft E5 security toolset experience.
• Experience implementing and supporting security technologies including SIEM, EDR, firewalls, vulnerability management, identity and access management, encryption and related controls.
• Working knowledge of recognised security frameworks such as Essential Eight, NIST Cybersecurity Framework, ISO 27001 or Cyber Essentials.
• Understanding of information risk and ability to translate business and project needs into proportionate security controls.
• Clear communication of security and risk to technical and non-technical audiences; structured problem-solving, including during incidents.

Desirable requirements

• Security testing and vulnerability management experience, including penetration testing or code review, is desirable.
• Experience improving IT security policies, processes and standards, and audit, compliance or governance experience, including GDPR or DISP knowledge, is desirable.
• Relevant certifications such as CISSP, CISM, CISA or CRISC, or equivalent professional development and experience, are desirable.

About Laing O'Rourke