Security Engineer

ROLE AND RESPONSIBILITIES

• Lead complex security alert investigations, establish the key lines of enquiry in ambiguous situations, and shape monitoring and detection strategy around attacker trends and emerging threats.

• Create and improve detections for new technologies and threats, and tune detection frameworks to strengthen coverage while keeping false positives low.

• Lead complex or high-impact security incidents, set the response approach, coordinate action across teams, and improve response processes and tooling after incidents.

• Advise the business on access, exceptions, architecture and technology choices that reduce security risk while supporting productive work.

• Architect, implement and support security systems, selecting effective approaches and ensuring that solutions remain secure, resilient and supportable.

• Develop deep knowledge of client’s technologies and their vulnerabilities; design and implement practical remediations using the security capabilities available in the environment.

• Design scalable automation and integrations that translate complex operational problems into maintainable solutions used across teams.

• Influence technical and business decisions through clear advice; author policy and guidance and communicate effectively with senior stakeholders and the wider business.

• Mentor engineers, provide specialist consultancy and create resources that help others develop their security capability.

• Shape security awareness using data and insight, and draft clear communications for colleagues and, where appropriate, clients.

• Own key vendor relationships, including account management, renewals, due diligence and evaluation of product capabilities.

• Keep current with security research, vulnerabilities, attack techniques and industry practice, applying new learning to unfamiliar problems and technical direction.

• Maintain confidentiality, provide a clear and fair service to colleagues and clients, and undertake reasonable duties consistent with the seniority of the role.

KEY SKILLS AND EXPERIENCE

Essential

• Substantial hands-on experience in security engineering or operations, including leading complex investigations and high-impact incident response.

• Strong detection engineering capability across SIEM, IDS and multiple telemetry sources, with sound judgement on coverage and alert quality.

• Experience architecting, implementing and supporting security controls, and remediating vulnerabilities in complex IT environments.

• Ability to design maintainable scripts, automation and system integrations that deliver reliable operational outcomes at scale.

• Sound risk judgement in access and exception decisions, with the ability to advise on architecture and technology choices.

• Excellent written and verbal communication, including policy and guidance, senior stakeholder engagement and business-wide messaging.

• Proven ability to mentor others, provide practical security consultancy and develop useful technical resources.

• Experience shaping security awareness with metrics and feedback, and managing vendors through evaluation, due diligence and renewals.

• Ability to build deep expertise in an organisation’s tools and estate quickly and apply new threat and vulnerability knowledge to technical decisions.

Desirable

• Experience with Splunk or comparable monitoring and detection platforms.

• Breadth across endpoint, network, identity, web, data protection and vulnerability management controls.

• Relevant security qualifications or equivalent demonstrable expertise.

KEY OBJECTIVES/KPIS

• Objectives and measures are agreed through the performance review and aligned with