About the role
We are seeking an experienced Security Engineer to design, implement, and continuously enhance enterprise security monitoring, detection, response, and automation capabilities. The role focuses on building scalable SIEM and SOAR platforms, developing advanced detection content, integrating security telemetry across IT/OT/Cloud environments, and enabling automated security operations through secure DevSecOps practices.
The candidate will have responsibilities across the following functions:
SIEM Engineering:
- Design, deploy, and optimise SIEM platforms and security monitoring architectures.
- Onboard and normalise logs from enterprise, cloud, OT/IoT, and security technologies.
- Develop use-case-driven dashboards, reports, and monitoring frameworks.
- Improve log ingestion quality, data retention, and operational efficiency.
Detection Engineering:
- Develop and maintain threat detection use cases aligned with MITRE ATT& CK.
- Build detection rules, correlation searches, behavioural analytics, and threat indicators.
- Continuously tune detections to reduce false positives and improve coverage.
- Validate and measure detection effectiveness through adversary simulations.
Response Engineering and SOAR:
- Design and implement automated response workflows and playbooks.
- Integrate SIEM, SOAR, EDR, IAM, Ticketing, and Threat Intelligence platforms.
- Develop automated containment, enrichment, investigation, and remediation actions.
- Improve incident response processes through orchestration and automation.
Threat Hunting:
- Lead proactive threat hunting activities across enterprise environments.
- Analyse attacker tactics, techniques, and procedures (TTPs).