Cybersecurity Engineer

About the Role

The Cybersecurity Engineer will be responsible for the day-to-day operation, administration, maintenance, deployment, and technical support of the organisation's cybersecurity platforms and infrastructure. The role focuses on ensuring the availability, stability, performance, and security of cybersecurity technologies supporting security monitoring and detection capabilities. The engineer will work closely with Cybersecurity Operations, DevOps, infrastructure teams, vendors, and other stakeholders to resolve technical issues, implement changes, maintain platform health, and support continuous improvement of the cybersecurity environment. The role also involves providing technical guidance to junior engineers and participating in after-hours standby and maintenance activities where required.

Key Responsibilities

• Provide day-to-day operational support and administration of cybersecurity platforms, including SIEM, SOAR, Threat Intelligence Platform (TIP), security analytics, and related security technologies.
• Monitor the health, availability, performance, and capacity of cybersecurity platforms and proactively identify and resolve operational issues.
• Perform routine system health checks, housekeeping, maintenance, and administrative activities to ensure platform reliability and operational readiness.
• Perform the deployment, configuration, and implementation of cybersecurity platforms, components, integrations, and approved changes across the production environment in accordance with established procedures.
• Troubleshoot and resolve technical issues relating to cybersecurity platforms, including performing initial diagnostics, root-cause analysis, and corrective actions.
• Manage and maintain the lifecycle of security log sources, including onboarding, configuration, modification, monitoring, troubleshooting, and decommissioning.
• Perform operational data engineering activities, including log/data extraction, transformation, parsing, enrichment, and loading, to support security monitoring and analytics.
• Monitor the health and status of log ingestion and data pipelines and troubleshoot issues such as missing, delayed, malformed, or incomplete security data.
• Plan, test, coordinate, and implement system, application, and security patches, version upgrades, and configuration changes in accordance with established change management procedures.
• Support the implementation and maintenance of new security platform features, integrations, rules, configurations, and enhancements.
• Work closely with Cybersecurity Operations, DevOps, infrastructure teams, vendors, and technology partners to resolve operational issues and implement approved changes.
• Fulfil and manage Service Requests, Incident Requests, and Change Requests relating to cybersecurity platforms.
• Monitor service levels and ensure operational issues are tracked, progressed, and resolved within the required timelines.
• Escalate complex or unresolved technical issues to relevant Subject Matter Experts (SMEs), vendors, or support teams, and coordinate with them through to resolution.
• Review and maintain operational and technical documentation, including standard operating procedures, configuration records, technical runbooks, troubleshooting guides, and knowledge articles.
• Provide technical guidance, task assignment, and support to junior engineers where required.
• Review technical work and operational requests submitted by junior engineers to ensure compliance with established procedures and technical standards.
• Prepare and submit operational reports and provide updates on platform health, incidents, service requests, and outstanding issues.
• Participate in scheduled maintenance activities, disaster recovery/business continuity exercises, and after-hours standby support where required.
• Identify opportunities to improve operational processes, platform stability, monitoring coverage, and engineering efficiency.

Requirements

• Diploma or Bachelor's Degree in Cybersecurity, Information Technology, Computer Science, Computer Engineering, or a related discipline.
• Minimum 5 years of relevant experience in cybersecurity operations, cybersecurity engineering, security infrastructure, or enterprise security platform support.
• Hands-on experience in the operation, administration, maintenance, deployment, and troubleshooting of cybersecurity technologies in an enterprise environment.
• Strong working experience with SIEM platforms such as Splunk, IBM QRadar, Microsoft Sentinel, or equivalent.
• Experience supporting one or more of the following technologies would be advantageous: Security Orchestration, Automation and Response (SOAR), Threat Intelligence Platforms (TIP), Security analytics platform, Log management and data ingestion platforms, Endpoint or network security technologies
• Good understanding of security log collection, ingestion, parsing, normalization, and data pipelines.
• Good working knowledge of Linux operating systems and networking fundamentals.
• Proficiency in Regular Expressions (Regex) for log parsing, filtering, and data transformation.
• Working knowledge of scripting and automation using Python, PowerShell, Bash, or similar languages would be advantageous.
• Experience with system patching, version upgrades, configuration management, incident troubleshooting, deployment, and change management.
• Experience working with enterprise IT service management processes, including Incident, Problem, Change, and Service Request Management.
• Strong analytical and troubleshooting skills, with the ability to systematically diagnose and resolve technical issues.
• Good communication and documentation skills, with the ability to work effectively with internal teams, clients, vendors, and technical stakeholders.
• Ability to work independently, take ownership of operational issues, and manage multiple priorities in a production environment.
• Strong interest in cybersecurity and willingness to continuously develop technical knowledge.
• Willingness to participate in after-hours standby, maintenance, and support activities when required.