SME - IT security (GB)

Job Summary

Key Responsibilities

• Design, implement, and maintain SIEM use cases, detection rules, correlation logic, dashboards, and monitoring capabilities. • Develop and enhance threat detection content based on emerging threats, attack techniques, and threat intelligence sources. • Build and automate incident response workflows using SOAR platforms to improve operational efficiency and response effectiveness. • Integrate security telemetry from cloud, network, endpoint, application, and identity platforms into centralized monitoring systems. • Conduct proactive threat hunting activities to identify hidden threats, suspicious behaviors, and indicators of compromise. • Collaborate with DevOps and engineering teams to embed security controls within CI/CD pipelines and software delivery processes. • Support incident investigations, root cause analysis, and continuous improvement initiatives to strengthen security operations.
• Design, implement, and maintain SIEM use cases, detection rules, correlation logic, dashboards, and monitoring capabilities.
• Develop and enhance threat detection content based on emerging threats, attack techniques, and threat intelligence sources.
• Build and automate incident response workflows using SOAR platforms to improve operational efficiency and response effectiveness.
• Integrate security telemetry from cloud, network, endpoint, application, and identity platforms into centralized monitoring systems.
• Conduct proactive threat hunting activities to identify hidden threats, suspicious behaviors, and indicators of compromise.
• Collaborate with DevOps and engineering teams to embed security controls within CI/CD pipelines and software delivery processes.
• Support incident investigations, root cause analysis, and continuous improvement initiatives to strengthen security operations.
• Strong experience in SIEM Engineering, including log onboarding, detection rule development, correlation, monitoring, and alert tuning.
• Hands-on expertise in Detection Engineering with the ability to develop use cases aligned to threat intelligence and attack frameworks.
• Experience in Response Engineering and security automation using SOAR platforms and orchestration technologies.
• Proven capability in Threat Hunting, attack analysis, adversary behavior identification, and threat investigation activities.
• Experience integrating and managing Security Telemetry from endpoint, cloud, network, identity, and application security tools.
• Knowledge of Secure CI/CD pipelines, DevSecOps practices, infrastructure-as-code security, and software development lifecycle security.
• Familiarity with scripting languages such as Python, PowerShell, or similar automation technologies and strong understanding of cybersecurity principles. Technical Certification Need to Have and Good to Have Need to Have
• Microsoft Certified: Cybersecurity Architect Expert or equivalent Microsoft Security certification.
• Splunk Core Certified Power User or Splunk Enterprise Security Certified Admin.
• Microsoft Certified Security Operations Analyst (SC-200) or equivalent SIEM/SOC-focused certification.
• CompTIA Security+ or an equivalent foundational cybersecurity certification.
• Demonstrated hands-on experience with SIEM, detection engineering, and security automation platforms in enterprise environments. Good to Have
• GIAC Certified Incident Handler (GCIH).
• GIAC Continuous Monitoring Certification (GMON).
• Certified Information Systems Security Professional (CISSP).
• Certified Cloud Security Professional (CCSP).
• Certified Ethical Hacker (CEH) or equivalent threat-hunting certification.
• Vendor certifications related to SOAR platforms, Sentinel, Splunk Enterprise Security, CrowdStrike, Palo Alto, or cloud security technologies.
• DevSecOps-related certifications covering secure software delivery, CI/CD security, and cloud-native security engineering. Role Details
• Role: Security Engineer
• Function: Cyber Security Office (CSO)
• Hiring Managers: Louise Furniss / Julie Wilson
• Grade: E/F
• Location: UK / Offshore
• Number of Positions: 2
• Duration: 10 Months
• Demand Type: Specialist Cyber Security Requirement

Skill Requirements

Other Requirements