SME - IT security

Role overview

Key responsibilities

• Design, implement and maintain SIEM use cases, detection rules, correlation logic, dashboards and monitoring.
• Develop detection content based on emerging threats, attack techniques and threat intelligence.
• Build and automate incident response workflows using SOAR platforms.
• Integrate cloud, network, endpoint, application and identity telemetry into centralized monitoring systems.
• Conduct proactive threat hunting for hidden threats, suspicious behaviour and indicators of compromise.
• Work with DevOps and engineering teams to embed security controls in CI/CD and software delivery.
• Support incident investigations, root cause analysis and continuous improvement.

Technical requirements

• Strong SIEM engineering experience, including log onboarding, detection rules, correlation, monitoring and alert tuning.
• Hands-on detection engineering aligned to threat intelligence and attack frameworks.
• SOAR-based response engineering and security automation experience.
• Threat hunting, attack analysis, adversary behaviour identification and investigation capability.
• Experience integrating endpoint, cloud, network, identity and application security telemetry.
• Knowledge of secure CI/CD, DevSecOps, infrastructure-as-code security and software lifecycle security.
• Python, PowerShell or similar scripting capability and strong cybersecurity knowledge.

Certifications

• Required: Microsoft Certified: Cybersecurity Architect Expert or equivalent Microsoft Security certification.
• Required: Splunk Core Certified Power User or Splunk Enterprise Security Certified Admin.
• Required: Microsoft SC-200 or equivalent SIEM/SOC-focused certification.
• Required: CompTIA Security+ or an equivalent foundational cybersecurity certification.
• Good to have: GIAC Certified Incident Handler, GIAC Continuous Monitoring Certification and CISSP.
• Also listed: CCSP, CEH or equivalent threat-hunting certification, vendor certifications for SOAR, Sentinel, Splunk Enterprise Security, CrowdStrike, Palo Alto or cloud security, and DevSecOps-related certifications.

Location and operations

• Role details describe the location as UK / Offshore and state that the position supports UK and offshore cybersecurity operations.