Security Engineer

About This Role

This engineering role focuses on owning and enhancing monitoring and detection capabilities within complex environments. It involves building and tuning detection logic, as well as improving the pipelines that feed security operations, working with modern cloud, detection, and security data technologies.

Responsibilities

• Build and tune detection rules across Splunk SPL, YARA, and EDR platforms
• Map detection coverage against MITRE ATT&CK
• Reduce false positives and improve detection quality
• Test detection rules through replay, load testing, and red-team scenarios
• Work closely with SOC analysts to improve operational detection capability
• Manage log ingestion, routing, filtering, normalisation, and enrichment using Cribl
• Support cloud security data across technologies such as Kinesis, S3, and Amazon Security Lake

Requirements

• Hands-on cloud security experience across AWS, Azure, or GCP
• Strong experience with either Splunk SPL, YARA, and EDR detection engineering, or security data pipelines including Cribl, Kinesis, S3, and Amazon Security Lake
• Understanding of Zero Trust, identity-first security, secrets management, and network segmentation
• Ability to communicate technical security risk to non-technical stakeholders
• Experience working with, or alongside, UK Government or public sector organisations
• SC Clearance required

Benefits

• Opportunity to work on complex public sector security programmes
• Strong technical environment with scope to mentor other engineers
• Exposure to modern cloud, detection, and security data technologies

Important Details

• Work format: remote for the first few months, then hybrid with 2 days onsite per week
• Locations: Bristol, London, Manchester or Swansea

About the Company

Our client is a leading technology organisation delivering secure and resilient digital services into complex UK public sector environments. Their Cyber practice works on large-scale, security-critical programmes, helping organisations embed security directly into modern technology platforms and delivery pipelines.