Security Engineer

Description

You will implement, run and keep improving enterprise security controls across endpoint, network, identity, cloud and data, working inside the company's layered defense-in-depth program.

You work independently on security engineering projects, look into security events and exposures, build automation, and work with other teams to improve visibility, resilience and day-to-day effectiveness.

You will also help with detection and response, system hardening, threat hunting and exposure reduction, and broaden your knowledge of the whole security stack.

Responsibilities

• Set up, configure and maintain controls at the perimeter, network, host, application, identity and data layers, and confirm each layer stays effective.
• Work with other teams to deploy controls properly and align them with recognised industry frameworks.
• Check that telemetry from every layer reaches the central analytics platforms, supporting 360-degree visibility and good attack surface coverage.
• Track how well controls perform and find ways to improve visibility, coverage and detection.
• Take part in security assessments, control validation exercises and purple-team activities.
• Help fix security gaps, vulnerabilities and control weaknesses.
• Recommend tools, configurations and operational changes.
• Help keep overlapping defenses in place so attackers cannot get past one layer or rely on a single point of failure.
• Deploy, configure and administer EDR and XDR platforms.
• Build and maintain endpoint and image hardening baselines, configuration standards and application control baselines.
• Monitor endpoint telemetry and confirm it feeds the central analytics platform or SIEM with useful context and cross-domain correlation, making sure SIEM coverage is adequate.
• Work with other teams to close security events, exposures, vulnerabilities and alerts within agreed SLAs.
• Investigate endpoint alerts and incidents to root cause: triage, collect forensic artifacts such as memory, disk and logs, rebuild timelines, and contain and eradicate threats.
• Analyse security telemetry to surface anomalous and malicious behaviour and escalate it to the right stakeholders.
• Run structured hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
• Record hunt hypotheses, outcomes and recommendations.
• Help investigate vulnerabilities, zero-days, alert telemetry, threat intelligence feeds, and notices from partners and customers, and decide how exploitable each is and whether it exposes the company.
• Keep up with the threat landscape, adversary TTPs and new vulnerabilities, judging how they affect the company's technology and direction.
• Build and tune detection rules, correlation logic and alerting use cases in approved platforms.
• Turn successful hunts, exposure analysis, purple-team findings and alerts into lasting automated detections, containment logic and wider coverage.
• Build and maintain SOAR workflows that automate enrichment, triage, containment and routine response.
• Help implement SOAR playbooks, automated response and detection engineering.
• Write scripts and tooling in supported languages such as Python, PowerShell or Bash.
• Measure how automation affects detection, containment and response times, and keep improving it to reduce threat actor dwell time.
• Help evaluate and put AI and ML capabilities to work for semantic anomaly detection, behavioural analytics, alert triage and prioritisation.
• Help deploy and run data classification, discovery and data security posture management across cloud and on-premises stores.
• Deploy and tune data loss prevention controls across endpoints, network, email, cloud and SaaS.
• Help feed data-related telemetry into central monitoring and detection.
• Monitor data security alerts and investigate possible data protection concerns.
• Investigate key risk indicators for data access and exfiltration, and their integration into central analytics via the SIEM.
• Support vulnerability and exposure programs through validation, prioritisation and remediation.
• Help identify attack surface gaps across endpoint, identity, cloud, network and data domains.
• Check that compensating controls and mitigations are in place and working.
• Take part in exposure assessments and attack surface analysis.
• Contribute to risk-based prioritisation and remediation recommendations.

Requirements

• Working familiarity with enterprise security across network, endpoint, identity, cloud and data domains.
• Basic knowledge of common security benchmarks and frameworks such as MITRE and NIST.
• Proficiency in at least one of Python, Bash or PowerShell, applied to containerised services, CLI commands and/or security use cases.
• Experience investigating security alerts, incidents or suspicious activity.
• Able to explain technical findings clearly to both engineering peers and non-technical stakeholders.
• Preferred: a bachelor's degree in computer science or information security, or equivalent experience, or a security certification such as CompTIA Security+, CompTIA Network+ or ISC2 SSCP.
• Preferred: basic knowledge of AWS, Azure or GCP.
• Preferred: hands-on enterprise security engineering focused on detection and response, red teaming or ethical hacking.
• Preferred: hands-on experience with tools such as EDR, XDR, SIEM, CNAPP, CSPM and CWP, and intermediate knowledge of security technologies across all OSI layers.
• Preferred: exposure to threat modelling, threat hunting, digital forensics and/or detection engineering, and writing automation scripts and rules for enforcement or observability.
• Preferred: familiarity with AI-enabled SecOps, such as UEBA, ML-based alert prioritisation or AI-assisted threat hunting.
• Preferred: working knowledge of the software development lifecycle, software engineering practices or infrastructure as code.
• Preferred: experience supporting SOC 2, ISO 27001 or HIPAA compliance and audit requirements from a technical control perspective.
• Required skills: cybersecurity, cyber threat intelligence, information security, intrusion detection, network security, security architecture design, security audit, security engineering, security operations and vulnerability management.

Conditions

The role is hybrid or remote.

The expected salary range is $90,000 to $134,000.

The final offer depends on experience, skill set, qualifications and internal pay equity. Offers at the top of the range are unlikely, leaving room for pay to grow later.

The company is committed to competitive, fair and equitable pay.

Benefits

• Total compensation includes a competitive base salary, an annual performance bonus and long-term incentives.