Participating in the Security Operations support rota, including out-of-hours on-call support
Assessing, triaging, and investigating security alerts from the SOC and other sources to determine relevance, severity, and required actions
Supporting incident response activities, including containment, eradication, and recovery
Contributing to the development and testing of security incident response plans
Documenting investigations, remediation activities, and lessons learned
Maintaining the security tooling estate, including EDR, vulnerability management, SIEM, DLP, email security, and web security solutions
Supporting the secure configuration, monitoring, and protection of assets, networks, cloud workloads across AWS and Microsoft Azure, and emerging AI services
Maintaining awareness of emerging threats, vulnerabilities, and industry developments

Relevant operational experience as a security engineer, analyst, or similar role within a complex organisation handling sensitive or highly confidential data
Experience assessing, triaging, and investigating security alerts, threats, and incidents
Supporting incident response activities (containment, eradication, and recovery)
Proactive threat hunting
Refining detection rules, playbooks, and tooling configurations based on investigation trends and emerging threats
Strong experience with leading security technologies, such as EDR, SIEM, DLP, BEC protection, and vulnerability management tooling
Experience supporting a range of security functions, such as identity and access management (including access reviews, PAM, MFA and SSO), data security controls (including data classification, DLP, and encryption); and application security activities (including secure design reviews, SAST, DAST, software composition analysis, and vulnerability triage and remediation)

Information Security Engineer

Key skills