Security Engineer

ROLE AND RESPONSIBILITIES

• Lead complex security alert investigations, establish the key lines of enquiry in ambiguous situations, and shape monitoring and detection strategy around attacker trends and emerging threats.
• Create and improve detections for new technologies and threats, and tune detection frameworks to strengthen coverage while keeping false positives low.
• Lead complex or high-impact security incidents, set the response approach, coordinate action across teams, and improve response processes and tooling after incidents.
• Advise the business on access, exceptions, architecture and technology choices that reduce security risk while supporting productive work.
• Architect, implement and support security systems, selecting effective approaches and ensuring that solutions remain secure, resilient and supportable.
• Develop deep knowledge of client’s technologies and their vulnerabilities; design and implement practical remediations using the security capabilities available in the environment.
• Design scalable automation and integrations that translate complex operational problems into maintainable solutions used across teams.
• Influence technical and business decisions through clear advice; author policy and guidance and communicate effectively with senior stakeholders and the wider business.
• Mentor engineers, provide specialist consultancy and create resources that help others develop their security capability.
• Shape security awareness using data and insight, and draft clear communications for colleagues and, where appropriate, clients.
• Own key vendor relationships, including account management, renewals, due diligence and evaluation of product capabilities.
• Keep current with security research, vulnerabilities, attack techniques and industry practice, applying new learning to unfamiliar problems and technical direction.
• Maintain confidentiality, provide a clear and fair service to colleagues and clients, and undertake reasonable duties consistent with the seniority of the role.

KEY SKILLS AND EXPERIENCE

Essential

• Substantial hands-on experience in security engineering or operations, including leading complex investigations and high-impact incident response.
• Strong detection engineering capability across SIEM, IDS and multiple telemetry sources, with sound judgement on coverage and alert quality.
• Experience architecting, implementing and supporting security controls, and remediating vulnerabilities in complex IT environments.
• Ability to design maintainable scripts, automation and system integrations that deliver reliable operational outcomes at scale.
• Sound risk judgement in access and exception decisions, with the ability to advise on architecture and technology choices.
• Excellent written and verbal communication, including policy and guidance, senior stakeholder engagement and business-wide messaging.
• Proven ability to mentor others, provide practical security consultancy and develop useful technical resources.
• Experience shaping security awareness with metrics and feedback, and managing vendors through evaluation, due diligence and renewals.
• Ability to build deep expertise in an organisation’s tools and estate quickly and apply new threat and vulnerability knowledge to technical decisions.

Desirable

• Experience with Splunk or comparable monitoring and detection platforms.
• Breadth across endpoint, network, identity, web, data protection and vulnerability management controls.
• Relevant security qualifications or equivalent demonstrable expertise.

KEY OBJECTIVES/KPIS

• Objectives and measures are agreed through the performance review and aligned with