ai engineer

software engineer

devops engineer

analytics engineer

platform engineer

security operations engineer

<div><h2 class="jobSectionHeader">Description</h2>
<div>
The Principal Microsoft Defender XDR, IRM &amp; Deception Engineer, working within the Global Information and Cyber Security Defence (ICSD) function, is the technical leader for enterprise cyber deception and unified detection and response across the Microsoft security ecosystem. The role focuses on building, operating, and continuously evolving an enterprise-grade Insider Risk Management (IRM) and deception programme - including honeypots, honeytokens, decoy users, decoy devices, deceptive credentials, and breadcrumbs - fully integrated with Microsoft Defender XDR (Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps), Microsoft Sentinel, and Microsoft Security Copilot.

The role exists to detect adversaries earlier in the kill chain by deceiving attackers into engaging with high-fidelity traps, while delivering unified detection, automated investigation, and response across endpoint, identity, email, and cloud workloads. It combines deep deception engineering expertise with hands-on Defender XDR mastery and the use of Agentic AI to drive proactive, intelligence-led, and largely autonomous security operations.

The Role:
<ul>
<li>Deception Engineering Leadership<ul>
<li>Own and lead the enterprise cyber deception programme end-to-end, including strategy, architecture, deployment, operations, and continuous improvement.</li>
<li>Design, deploy, and operate a layered deception fabric across on-premises, hybrid, and multi-cloud environments using honeypots, honeytokens, decoy accounts, decoy devices, deceptive files / shares, and breadcrumbs.</li>
<li>Act as the technical authority for deception engineering and Microsoft Defender XDR across the enterprise.</li>
</ul></li><li>Honeypots, Honeytokens, Decoys &amp; Breadcrumbs<ul>
<li>Design and operate the full deception asset lifecycle, ensuring high-fidelity, low-noise detections that are realistic, attacker-grade, and resilient to evasion.</li>
<li>Deploy and manage Microsoft Defender for Identity deceptive accounts, deceptive devices, and honeytoken accounts across Active Directory and Microsoft Entra ID.</li>
<li>Build and maintain a portfolio of deception assets, including:<ul>
<li>Honeypot systems (low-, medium-, and high-interaction) across on-prem, Azure, AWS, GCP, and OCI</li>
<li>Honeytoken credentials, API keys, OAuth tokens, secrets, and SaaS accounts</li>
</ul></li><li>Decoy users, decoy devices, decoy shares, decoy files, and decoy databases<ul>
<li>Plant attacker-grade breadcrumbs across endpoints, identities, and cloud workloads, including:</li>
<li>Saved credentials, browser cookies, RDP and SSH artefacts</li>
<li>LSASS-resident credentials and cached tokens on selected lures</li>
<li>Fake Kerberos service accounts and SPNs to bait Kerberoasting and AS-REP roasting</li>
</ul></li><li>Continuously evolve deception techniques, lure design, and trap placement aligned to current attacker TTPs, red-team findings, and breach intelligence.</li>
<li>Govern the deception programme with clear standards for asset realism, segmentation, monitoring, and safe operation (no production impact).</li>
<li>Validate deception coverage through red-team, purple-team, and breach-and-attack simulation (BAS) exercises.</li>
</ul></li><li>Microsoft Defender XDR Leadership<ul>
<li>Lead the design, implementation, and optimisation of Microsoft Defender XDR across endpoint, identity, email, and cloud-app workloads.</li>
<li>Integrate all deception signals (honeypot, honeytoken, decoy, breadcrumb) into Defender XDR and Microsoft Sentinel as first-class, high-fidelity detections.</li>
<li>Define and enforce a unified detection and response strategy across the Microsoft security stack.</li>
</ul></li><li>Defender for Identity &amp; Identity Deception<ul>
<li>Lead operation and optimisation of Microsoft Defender for Identity (MDI) to detect identity-based attacks, including:<ul>
<li>Credential theft, Kerberoasting, AS-REP roasting, Pass-the-Hash, and Pass-the-Ticket</li>
<li>Lateral movement, reconnaissance, and privilege escalation</li>
<li>Misuse of deceptive / honeytoken accounts as early-warning tripwires</li>
</ul></li><li>Integrate MDI, deception, and Microsoft Entra ID signals into Defender XDR, Microsoft Sentinel, and SOAR workflows for unified investigation and response.</li>
</ul>
</li><li>Data Protection, DLP &amp; Insider Risk Management
<ul>
<li>Lead the design and implementation of Microsoft Purview Data Loss Prevention (DLP) policies across endpoints, cloud apps, and collaboration platforms</li>
<li>Define and enforce data protection controls to prevent unauthorised data exfiltration and misuse</li>
<li>Leverage Microsoft Insider Risk Management (IRM) to detect risky user behaviour, including data leaks, policy violations, and insider threats</li>
<li>Correlate DLP, IRM, and identity signals with Microsoft Defender XDR to provide unified incident context</li>
<li>Collaborate with Risk, Compliance, and Legal teams to align DLP and insider risk controls with regulatory and business requirements</li>
<li>Continuously optimise detection use cases combining identity, data, and behavioural analytics</li>
</ul></li><li>Endpoint, Email &amp; Cloud App Detection<ul>
<li>Lead detection engineering across the Defender XDR stack, ensuring deception assets are continuously monitored alongside production telemetry:</li>
<li>Microsoft Defender for Endpoint (MDE) - EDR policies, ASR rules, and decoy-device monitoring</li>
<li>Microsoft Defender for Office 365 (MDO) - anti-phishing, Safe Links, Safe Attachments, and honeytoken inboxes</li>
<li>Optimise automatic attack disruption, automated investigation and response (AIR), and self-healing capabilities to:<ul>
<li>Disrupt in-progress attacks at machine speed, including deception-triggered intrusions</li>
<li>Reduce analyst workload through high-confidence automation</li>
<li>Improve coverage for ransomware, BEC, and identity-based attacks</li>
<li>Ensure consistent telemetry ingestion and detection parity across Windows, macOS, Linux, mobile, and deception assets.</li>
</ul></li></ul></li><li>Multi-Cloud Deception &amp; Detection (AWS, GCP, OCI)<ul>
<li>Extend the deception programme and Defender-style detection capabilities consistently across AWS, GCP, and OCI, including:</li>
<li>Cloud honeypots, decoy IAM roles, and honeytoken cloud credentials / API keys</li>
<li>Control-plane, workload, container, and Kubernetes threat detection</li>
<li>Cross-cloud identity and access misuse detection</li>
<li>Ensure consistent detection, deception, and response coverage across hybrid and multi-cloud environments.</li>
</ul></li><li>Automation, Agentic AI &amp; Continuous Improvement<ul>
<li>Drive automation of deception deployment, detection, investigation, and response workflows using Microsoft Sentinel SOAR, Logic Apps, and Microsoft Security Copilot.</li>
<li>Define KPIs and metrics covering deception engagement, detection coverage, and response maturity.</li>
<li>Continuously improve detection, hunting, and deception capabilities to align with emerging threats and adversary tradecraft.</li>
</ul></li><li>Stakeholder Engagement &amp; Technical Leadership<ul>
<li>Lead and grow a team of Defender XDR and Deception Engineers, setting technical direction, standards, and delivery priorities.</li>
<li>Partner with SOC, CTI, Identity, Cloud, and Engineering teams to embed deception and Defender XDR detection into all enterprise platforms.</li>
<li>Provide mentorship and leadership to deception engineers, detection engineers, threat hunters, and SOC analysts.</li>
<li>Communicate deception strategy, detection coverage, residual risk, and security improvements to senior stakeholders.</li></ul></li></ul> 


</div><h2 class="jobSectionHeader">Qualifications</h2>
<div>
What you'll bring:

Required Skills &amp; Experience:
<ul>
<li>Proven experience designing and operating enterprise cyber deception programmes (honeypots, honeytokens, decoy users, decoy devices, breadcrumbs) at scale.</li>
<li>Extensive hands-on experience operating and engineering Microsoft Defender XDR (MDE, MDI, MDO, MDA) in large enterprises.</li>
<li>Deep expertise across the Microsoft security stack, including:<ul>
<li>Microsoft Defender for Identity (MDI) deceptive accounts, deceptive devices, and honeytokens</li>
<li>Microsoft Sentinel (analytics rules, workbooks, hunting, SOAR)</li>
<li>Microsoft Security Copilot, automated investigation &amp; response, and attack disruption</li>
<li>Microsoft Defender for Cloud Apps and Defender for Cloud</li>
</ul></li><li>Hands-on experience with:<ul>
<li>Open-source and commercial deception / honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception)</li>
<li>Advanced KQL for detection engineering and threat hunting at scale</li>
<li>Detection-as-code, CI/CD of detection content, and security content management</li>
</ul></li><li>Strong knowledge of adversary tradecraft and frameworks:<ul>
<li>MITRE ATT&amp;CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain</li>
<li>Experience leveraging Agentic AI, Microsoft Security Copilot, or AI/ML in security operations (detection, hunting, IR, automation).</li>
</ul></li><li>Proven experience leading incident response across identity, endpoint, email, and cloud domains.</li>
<li>Strong scripting / automation experience (PowerShell, Python, or equivalent).</li>
<li>Deep understanding of Zero Trust architecture and identity-centric defence.</li></ul> 


Preferred Qualifications:
<ul>
<li>Experience contributing to red-team / purple-team exercises and breach-and-attack simulation (BAS) programmes.</li>
<li>Microsoft certifications:<ul>
<li>Microsoft Certified: Security Operations Analyst Associate (SC-200)</li>
<li>Microsoft Certified: Azure Security Engineer Associate (AZ-500)</li>
<li>Microsoft Certified: Cybersecurity Architect Expert (SC-100)</li>
<li>Industry certifications (CISSP, GCIA, GCFA, GCIH, OSCP, or equivalent)</li>
<li>Cloud certifications across AWS, GCP, or OCI</li></ul></li> 
</ul>
What we offer:

Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.

We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.

Equal Opportunity Employer

We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidatehelpdesk@wtwco.com</div></div>

Principal Microsoft Defender XDR & Deception Engineer

Houseful

<div>6 months Initial Contract - Must work from the UK
Alto Software Group (ASG) is a leading B2B SaaS platform serving the UK property industry. We power thousands of estate agency branches and support a significant proportion of UK housing transactions each year.
We are building a data-driven, operationally efficient platform business. AI will be a structural lever in improving internal productivity, reducing operational cost, and enhancing customer experience.
This is a hands-on delivery role responsible for building the automations and AI integrations that embed AI into how we operate.
The Role
We are hiring a contract AI Engineer to build, deploy and maintain AI-enabled automations across our core systems stack. Working with the Principal Engineer and the Head of AI Operations, you will take prioritised automation opportunities from design through to production.
You will deliver against an internal AI roadmap spanning Customer Operations, Marketing, Finance, Education and Training to:<ul><li>Automate high-volume, manual administrative workflows</li><li>Build AI-enabled workflows in Salesforce, Zendesk, HubSpot, Zuora and Thrive LMS</li><li>Turn the Mission Control data platform into an engine for event-triggered automation</li><li>Reduce operational overhead and improve reporting speed and accuracy</li></ul>
Core ResponsibilitiesAutomation Build &amp; Integration<ul><li>Build and maintain automation pipelines using n8n, Zapier/Make and direct LLM API integrations (OpenAI/Anthropic)</li><li>Develop API and webhook integrations across Salesforce, Zendesk, HubSpot, Zuora and Thrive LMS</li><li>Implement workflows such as ticket summarisation, tagging, routing and AI triage</li></ul>
AI Engineering<ul><li>Design and implement RAG pipelines and vector database integrations over internal knowledge</li><li>Develop, test and version prompts; evaluate and improve output quality</li><li>Build event-triggered automations and AI-enabled reporting on Mission Control</li></ul>
Quality, Security &amp; Handover<ul><li>Apply sound engineering standards: error handling, logging and monitoring of automations in production</li><li>Ensure GDPR-compliant, secure handling of customer and company data</li><li>Document solutions clearly and hand over to internal teams for ongoing operation</li></ul>
What Success Looks Like (First 6 Months)<ul><li>Priority automation workflows live, stable and monitored in production</li><li>Measurable reduction in manual effort in targeted workflows</li><li>Reliable integrations across the core systems stack</li><li>Clear documentation enabling internal teams to operate and extend what you build</li></ul>
Required ExperienceTechnical<ul><li>Proven delivery of LLM-based automation in production environments</li><li>Strong experience with automation platforms (n8n, Make or Zapier)</li><li>Proficiency in Python and SQL</li><li>Strong API and webhook integration capability</li><li>Experience working with OpenAI/Anthropic APIs and prompt engineering</li><li>Experience building RAG pipelines and working with vector databases</li><li>Experience automating CRM (Salesforce) and support (Zendesk) environments preferred</li></ul>
Delivery<ul><li>Experience operating in B2B SaaS or similar fast-moving environments</li><li>Track record of delivering as a contractor: scoping, building and handing over cleanly</li><li>Comfortable working with non-technical stakeholders to refine requirements</li></ul>
Personal Attributes<ul><li>Delivery-focused and pragmatic</li><li>High agency and accountability</li><li>Structured, with strong attention to reliability and security</li><li>Comfortable working in ambiguity</li><li>Clear communicator with technical and non-technical audiences</li></ul>
Why This Role Matters
AI will be a structural margin lever for ASG. The automations you build will directly reduce operational cost, increase capacity without incremental headcount, and embed AI as core operational infrastructure rather than experimentation.</div>

AI Engineer (Contract)

Oregon Systems

Job Title-DevOps EngineerWork Authorization- Citizen or No SponsorshipJob SummaryWe are seeking a highly skilled DevOps Engineer to join our dynamic technology team. The successful candidate will be responsible for designing, implementing, and maintaining scalable, reliable, and secure cloud and on-premise infrastructure. This role requires a strong understanding of software development lifecycle (SDLC), continuous integration and deployment (CI/CD), system administration, and cloud computing platforms. The DevOps Engineer will collaborate closely with development, QA, and operations teams to streamline processes, optimise system performance, and ensure high availability of services. Experience with a broad range of tools such as Docker, Kubernetes, Terraform, Jenkins, and cloud providers like AWS or Azure is essential.Responsibilities<ul><li>Design, develop, and maintain automated deployment pipelines using tools such as Jenkins, GitLab CI/CD, or TFS.</li><li>Manage containerisation technologies including Docker and Kubernetes to facilitate scalable microservices architectures.</li><li>Implement infrastructure as code (IaC) using Terraform, Ansible, Chef, Puppet or similar tools to provision and manage cloud infrastructure and virtualised environments.</li><li>Monitor system performance and troubleshoot issues using tools like New Relic, Splunk, or Elasticsearch to ensure optimal operation of applications and infrastructure.</li><li>Maintain and optimise cloud environments on AWS, Azure or Google Cloud Platform by managing resources such as S3 buckets, virtual machines, load balancers, and networking components.</li><li>Collaborate with development teams during requirements gathering to design scalable solutions aligned with business needs.</li><li>Ensure disaster recovery plans are in place and tested regularly to minimise downtime during outages or failures.</li><li>Manage configuration management across multiple environments including Linux (CentOS, UNIX) and Windows Server platforms.</li><li>Implement security best practices including firewall configuration, DNS management, incident response procedures and incident management protocols.</li><li>Support software deployment activities across various environments ensuring smooth release cycles while maintaining system stability.</li></ul>Skills<ul><li>Extensive experience with containerisation technologies such as Docker and orchestration tools like Kubernetes.</li><li>Proficiency in scripting languages including Bash (Unix shell), PowerShell, Python, Groovy, Perl or Ruby for automation tasks.</li><li>Strong knowledge of cloud computing platforms including AWS (S3, EC2), Azure or Google Cloud Platform along with cloud infrastructure management tools like Terraform or OpenStack.</li><li>Familiarity with CI/CD pipelines using Jenkins, GitHub Actions or GitLab CI/CD integrated with version control systems such as Git or SVN.</li><li>Experience managing databases such as MySQL, Microsoft SQL Server or Oracle; knowledge of SQL/PLSQL is advantageous.</li><li>Understanding of web servers like NGINX or WebSphere; experience with web services (REST/SOAP) is desirable.</li><li>Knowledge of distributed systems architecture including microservices design patterns and API management.</li><li>Ability to troubleshoot complex software issues related to system performance or deployment failures efficiently.</li><li>Strong grasp of network fundamentals including TCP/IP protocols, DNS configuration and firewall management.</li><li>Familiarity with monitoring tools such as New Relic or Splunk for incident response and system health checks.</li><li>Experience working within SDLC frameworks ensuring quality assurance through automated testing tools and release management processes.</li></ul>This position offers an exciting opportunity for a motivated professional eager to work in a fast-paced environment that values innovation and continuous improvement in technology operations. The ideal candidate will demonstrate excellent organisational skills combined with a proactive approach to problem-solving in complex technical landscapes.Pay: &pound;31,955.47-&pound;95,614.58 per yearWork Location: In person

DevOps Engineer

Cognism

<div><div><h2 class="jobSectionHeader">WHO ARE WE</h2>

Cognism is the leading provider of European B2B data and sales intelligence. Ambitious businesses of every size use our platform to discover, connect, and engage with qualified decision-makers faster and close more deals. Headquartered in London with global offices, Cognism's contact data and contextual signals are trusted by thousands of revenue teams to eliminate the guesswork from prospecting.</div>
The Role

At Cognism, the security of our data, our systems and our clients' systems is a business priority. Information security is embedded in the way we work, and we are driving a culture where the fastest path is the securest path. As the function continues to mature, we are now hiring for a Director of Security Engineering &amp; Operations to report directly to our CISO. In this role you will own and drive the technical security strategy for Cognism's web and data products, as well as our corporate environment. You will be responsible for designing a security programme that protects our most sensitive assets: our data, our data fusion engine and the logic that powers it. As a trusted partner to our R&amp;D leadership team you will help to define and drive the long-term security engineering maturity roadmap, driving alignment across engineering leaders, product leadership and IT. If you're energised by the idea of shaping measurable security processes and controls, from the ground up, aligning engineering around secure-by-design principles, and elevating operational excellence, then this is the role for you. This is a rare opportunity to define the technical security vision for a dataintensive product at a moment where AI, scale, and engineering velocity are creating new and exciting challenges. You will shape how Cognism builds securely for the next decade. 


What success looks like

Within 12 months, you will have:
<ul>
<li>Delivered a unified security engineering roadmap aligned with engineering leadership.</li>
<li>Matured secure SDLC adoption across Web and Data engineering.</li>
<li>Improved MTTD/MTTR through stronger SOC operations.</li>
<li>Invested in and mentored a team with clear ownership, KPIs, and engineering trust.</li>
<li>Reduced engineering friction by creating pragmatic, developerfriendly guardrails</li></ul> 


What You'll Own

Security Strategy &amp; Engineering Integration
<ul>
<li>Define and own Cognism's technical security strategy that seeks to embed security-by-design within our web and data products, our data fusion engine and pipelines, and our corporate landscape. You will drive a strategy that is pragmatic, risk-ranked, and aligned to engineering velocity.</li>
<li>Work directly with product and technology leadership as a strategic partner. You will drive ownership and accountability, clearly agreeing ways of working between your team and product and technology teams.</li>
<li>Set and direct a secure SDLC strategy that engineers engage with, coaching and mentoring our application security engineer with running our threat modelling program, embedding security in CI/CD, and iteratively improving our vulnerability management processes.</li>
<li>Partner with engineering leadership to ensure risk-driven supply chain management across our product, ensuring what we bring in doesn't undermine what we protect.</li>
<li>Work directly with our Director of IT operations to ensure our corporate security posture is mitigating risk and empowering our employees to be as secure as possible, through guardrails that protect unacceptable risk but don't stifle innovation.</li></ul> 


Data &amp; AI Security
<ul>
<li>Partner with our VP of Data Engineering to strengthen the security of our enrichment engine, data pipelines, and warehouse ecosystems.</li>
<li>Direct a strategy that considers security across the full data stack - from ingestion through to the warehouse - with a focus on access governance, data classification, and secrets management as non-negotiables.</li>
<li>Define how Cognism embeds AI securely as LLMs and agentic workflows move deeper into the product and our technology teams' operations.</li>
<li>Partner with our CISO to shape and implement an AI security posture that is embedded in strong security foundations, helping us stay ahead of the threat landscape rather than reacting to it.</li></ul> 


Detection, Response &amp; SOC Partnership
<ul>
<li>Own the strategic relationship with our 24/7 outsourced SOC holding them to a high standard on threat hunting, threat intelligence utilisation, and automated response, not just SLA compliance.</li>
<li>Ensure Cognism has a holistic, well-maintained SIEM that reflects how we operate and improves continuously as the threat landscape evolves.</li>
<li>Build the internal team into a trusted escalation layer, with clear incident response playbooks, rehearsed escalation paths, and a feedback loop that sharpens detection over time.</li></ul> 


Team &amp; Culture 

<ul>
<li>Lead a team of application and infrastructure security engineers, setting the standard for technical excellence and deep partnership with their engineering counterparts.</li>
<li>Build a security culture where developers raise security questions early, understand threat models, and own remediations, not because policy requires it, but because the culture makes it natural.</li>
<li>Be the security leader Cognism's engineers want in the room: credible enough to be trusted, collaborative enough to be included, and strategic enough to make it count.</li></ul> 


What We Need

Leadership &amp; influence
<ul>
<li>Demonstrated experience building security programmes from scratch or transforming them significantly in a product-led, engineering-first company.</li>
<li>A track record of influencing engineering culture and earning trust, not enforcing it.</li>
<li>Experience managing external security partners, (e.g 24/7 Security Operations Centre, penetration testing 3rd parties) and raising their performance through clear accountability, not just contract reviews.</li>
<li>Able to communicate risk in business terms to exec and board audiences, and technical terms to engineers, without losing precision in either direction.</li></ul> 


Technical foundation
<ul>
<li>Strong AppSec expertise (OWASP, API security, SAST/DAST, SDLC) with practical threat modelling experience &ndash; enough to challenge and coach our most senior application security engineers.</li>
<li>Handson understanding of data security, cloud data warehouses, and pipeline integrity &ndash; enough to ensure we are driving the right programme of work across our technology department.</li>
<li>Cloud security fluency with working knowledge of container and Kubernetes security, IAM design, and cloud-native security tooling &ndash; enough to clearly identify, prioritise and challenge solutions for implementing security in our cloud environment.</li>
<li>Working knowledge of AI/LLM security risks: enough depth to assess integrations, define guardrails, and evolve the programme as the technology does.</li></ul> 


Mindset
<ul>
<li>Risk-based by instinct: prioritises based on both technical and business impact</li>
<li>Builder mentality: energised by creating structure where there isn't any, pragmatic about sequencing, and focused on outcomes over coverage.</li>
<li>Genuinely curious about AI, not just its security risks, but its potential to improve how security is done.</li>
</ul><div>
<h2 class="jobSectionHeader">WHY COGNISM</h2>

At Cognism, we're not just building a company - we're building an inclusive community of brilliant, diverse people who support, challenge, and inspire each other every day. If you're looking for a place where your work truly makes an impact, you're in the right spot!

Our values aren't just words on a page&mdash;they guide how we work, how we treat each other, and how we grow together. They shape our culture, drive our success, and ensure that everyone feels valued, heard, and empowered to do their best work.

Here's what we stand for:

 We Own the Outcome Together. 
 We Deeply Understand our Customers. 
 We Celebrate Impact Wherever It Comes From.

At Cognism, we are committed to fostering an inclusive, diverse, and supportive workplace. We welcome applications from individuals typically underrepresented in tech, so if this role excites you but you're unsure if you meet every requirement, we encourage you to apply!</div></div>

Director, Security Engineering & Operations

GSMA

<div>Department: Technology
Team: Security
Location: London with hybrid ways of working
Position type: Permanent
What the hiring manager says
This is a hands on engineering role at the heart of GSMA&rsquo;s TISAC platform transformation. You will be responsible for building, evolving, and maintaining the technical backbone that enables cyber threat intelligence sharing for the global telecoms ecosystem. We&rsquo;re looking for a T-ISAC Platform Software Engineer who thrives on solving complex architectural challenges, automating largescale systems, and bringing engineering excellence to a critical industry capability.
You&rsquo;ll work closely with CTI analysts, architecture teams, and platform vendors to deliver a secure, scalable, and resilient T‑ISAC service. If you are passionate about infrastructure, automation, API integrations, platform reliability, and delivering secure-by-design services to a global community, this role is your opportunity to help shape the future of telecom security.
If you thrive on working with cutting-edge intelligence platforms, enjoy mentoring others and want to help mature a global security community, this is an opportunity to truly influence the future of telecom security.
Agwu Nwoke, Industry Security Programme Director
About the Team
The GSMA Industry Security Team is the mobile industry&rsquo;s focal point for the mobile network security. The team is responsible for co-ordinating GSMA member security working groups, leading industry wide security initiatives and engaging with global regulators to ensure security is an enabler and not a barrier to next generation mobile services.
The team is responsible for a number of industry wide Cybersecurity schemes including:<ul><li>
Telecommunications Information Sharing and Analysis Center (T-ISAC).</li><li>
Mobile Co-ordinated Vulnerability Disclosure (CVD).</li><li>
Network Equipment Assurance Scheme (NESAS).</li></ul>
About the GSMA T-ISAC
The Telecommunication Information Sharing and Analysis Centre (T-ISAC) is the cybersecurity threat intelligence community for the telecommunication industry, dedicated to facilitating collaboration and intelligence sharing among mobile network operators, mobile virtual network operators and industry stakeholders. T-ISAC provides GSMA members with critical cyber threat intelligence, fostering a trusted environment where telecommunication stakeholders can proactively address cybersecurity threats and reduce risks through the development of best practices. By uniting telecommunication MNOs, MVNOs, manufacturers, service providers and industry in a shared mission, T-ISAC enhances the mobile ecosystem&rsquo;s resilience against cyber threats. For more information, visit www.gsma.com/T-ISAC.
About the Role
As the Platform Software Engineer for T‑ISAC, you will be responsible for the engineering, operation and continuous improvement of the platforms, tooling and integrations that power the T‑ISAC service.
Key Responsibilities
Platform Engineering &amp; Development
Design, develop and maintain the T-ISAC platform, delivering secure, scalable data workflows, automation capabilities and collaboration tools that support threat intelligence sharing and enrichment.
Service Reliability &amp; Operations
Lead the operational reliability of the T-ISAC platform through proactive monitoring, incident management, performance optimisation and secure-by-design engineering practices.
Integration &amp; Interoperability
Deliver and support integrations, APIs and data exchange capabilities that enable secure, scalable intelligence sharing across members and third-party security platforms.
Platform Roadmap &amp; Technical Strategy
Shape the evolution of the T-ISAC platform by defining future-state architecture, driving technical improvements and evaluating emerging technologies.
Security &amp; Compliance
Maintain a secure and compliant platform through secure engineering practices, automated controls, vulnerability management and adherence to regulatory and governance standards.
Collaboration &amp; Community
Foster collaboration across members, analysts, security teams and industry partners to improve platform adoption, effectiveness and community engagement.
About You
You will bring enthusiasm and ownership to this specialised senior role in cyber threat intelligence analysis, joining a dynamic and ambitious team. Your drive will be key to transforming bold ideas into impactful programmes and seeing them through to successful delivery.
You will have telecoms experience gained from working at an operator, with an operator or within the wider telecom industry.
You will have proven knowledge and expertise in designing, building and operating the core platforms and infrastructure that enable scalable, reliable, secure and efficient software delivery across operations in Intelligence, Cybersecurity, Data Analytics or a related field (equivalent experience will be considered). You will also have experience working with ISACs or other information sharing organisations.
About Your skills
In addition to technical skills, you will have :
Teamwork &ndash; you will be comfortable when working collaboratively in a virtual, distributed team environment.
Communication &ndash; you will have exceptional verbal and written communication skills, with a track record of presenting to executive audiences.
Leadership &ndash; you will have proven leadership and mentoring skills, ideally within an intelligence team.
Analysis &ndash; you will have strong analytical, critical thinking and problem solving skills, with ability to analyse cybersec intelligence.
Essential<ul><li>
Extensive experience of building and implementing intelligence platforms e.g. OpenCTI, MISP.</li><li>
Experience of using collaborative open source tools as part of your analysis and research processes.</li><li>
Understanding of Nation-State Actors, Cyber Crime, Hacktivism and advanced threat actor tactics, techniques and procedures (TTPs).</li><li>
Experience in cybersecurity intelligence, including collection, analysis and dissemination.</li><li>
Professional experience within the telecom industry, whether gained at an operator, in partnership with an operator, or through work in telecom related organisations, vendors, academia or the wider mobile ecosystem.</li></ul>
Preferable<ul><li>
Understanding of mobile data, protocols and technology such as, but not limited to SS7, MOTIF, HRN, IRSF, URLs, GTs.</li><li>
Knowledge of mobile network architectures and services.</li><li>
Understanding of mobile network and services, threat landscape and the common attacks to which they are exposed.</li><li>
Comprehensive understanding of telecommunication industry operations and challenges.</li><li>
Expertise in using and applying the Mitre ATT&amp;CK&reg; framework, MISP, OpenCTI, Meta, EclecticIQ, Governments, Law Enforcement and other COIs (national and international) for threat analysis and strategy development.</li></ul>
We strive to offer a meaningful and inclusive application experience for all candidates. Should you require any accommodations or adjustments due to a disability or for any other reason during the hiring process, please contact talent@gsma.com with your request.
Contract type
Regular
Worker type
Employee<h2 class="jobSectionHeader">
What We Offer</h2>
Working at the GSMA offers you unparalleled access to the mobile industry. We offer a chance to truly shape the direction of mobile, whatever your role. By joining the GSMA, you will be exposed to a fast-paced rapidly evolving environment, working on global solutions, genuinely fascinating and industry-changing projects and a stimulating and dynamic environment designed to enable you to flourish.
In addition to architect-designed offices and competitive compensation, our benefits include fantastic learning &amp; development opportunities, generous holiday allowances, four additional days off for professional development and many others.
To learn more about the GSMA, visit our career site, our LinkedIn page and our Twitter page.
Being You at the GSMA
We care deeply about diversity, equity and inclusivity and aspire to be the best at it. Your well-being and work/life balance is important, so flexi-time and remote working is available to all staff. We're keen to ensure everyone is equal, represented and connected so we particularly encourage applications from all demographics. The sucess of the GSMA year on year will continue to be contributed by people from all walks of life.
GSMA Values
Our values not only drive our culture &ndash; they shape how we work and interact inside and outside our global organisation.
Passionately driven
We approach everything we do with unparalleled capability, tenacity and commitment, knowing that the challenging scale, pace and complexity of our work is what leads to its world-changing impact.
Insightful leaders
We continually develop and engage our expertise, insight and creativity so that we&rsquo;re always ready to respond to the changing landscape with authority, agility and nuance.
Stronger together
We lean on each other so the industry can lean on us, embracing our diversity by actively seeking out perspectives and skill sets beyond our own, fuelling each other&rsquo;s successes and constantly asking how we can help.
Underpinning our values is our collective mindset to show up purposefully as good human beings every day, in every situation. When we&rsquo;re at our best &ndash; we are collaborative, considerate and compassionate to others, and we create a safe space for one another to thrive, assuming positive intent in our colleagues. And if we aren&rsquo;t at our best and the pressure is on &ndash; we feel free to be ourselves but still remain curious, lean into the tough stuff and we are always respectful to others and accountable for the part we play.</div>

T-ISAC Platform Software Engineer

ONNEC Group

<div>ONNEC is now the UK&rsquo;s largest pure play physical IT infrastructure, network, and connectivity companies, with expertise throughout the data centre, office, and smart building environments.
We are recruiting for an experienced Focal Network Engineer to join our team in providing technical engineering duties on our projects and support contracts. The Focal Network Engineer will have a hybrid role in supporting managed service customers and undertaking project work.
Candidates must aspire to achieve a minimum level accreditation of Cisco CCNP Routing &amp; Switching (or other Enterprise vendor) and have demonstrable experience in technical design, configuration and fault finding.
Required Knowledge / Experience:
<ul><li>Experience of Enterprise networking deployment across Routing, Switching, Wireless and Security hardware platforms.</li>
<li>Good working understanding of Network Server builds to deliver DHCP/DNS/AD services across both physical and virtual machines.</li>
<li>Appreciation of the Azure global cloud computing platform</li>
<li>VRF/VLAN/IP Configuration</li>
<li>PRTG configuration and monitoring experience</li>
<li>Firewall policies, access lists and rule sets creation and modification.</li>
<li>Capable of converting high level network designs to low level network designs.</li>
<li>Vendor licensing registration/generation.</li>
<li>Maintains personal knowledge of vendor technology developments.</li>
<li>Familiarisation with Cisco suite of networking products including Nexus, Catalyst, Meraki, DNA and Prime</li>
<li>Essential minimum level accreditation of CCNP Routing &amp; Switching.</li>
<li>Clear and concise report writing.</li>
</ul>
Additional duties:
<ul><li>On-call standby rota to support 24x7 customers</li>
<li>Evaluation of supported estate for End of Life and End of Service notifications</li>
<li>Monitor and communicate technical bulletins for vendors especially around security.</li>
<li>Support requirements for out of hours customer BAU activities including PPM and Black Building tests.</li>
<li>Halo Service Desk configuration and monitoring</li>
<li>Proactive regular review and update of networking credentials for the support base</li>
</ul>
Desirable
<ul><li>Understand third party IP applications/concepts i.e., BMS, Lighting Controls, CCTV etc.</li>
<li>Cisco Software Defined Networking (DNA) configuration and deployment experience</li>
</ul>
If you feel you have the required skills and experience, click apply now to be considered as our Focal Network Engineer &ndash; we&rsquo;d love to hear from you!</div>

Focal Network Engineer

Voxquill

<div>I'm looking for our founding engineer!
 
The person who takes a live, paying fintech product and makes it truly ours.
We build receipt-and-proof automation for the self-employed: the app quietly finds your receipts (email, bank feeds, camera roll, texts), sorts them, matches them to your bank transactions, and produces accountant-ready exports. It's live on iOS and Android, it's SOC 2 certified, and people are paying for it. The model works.
I need one person who treats this codebase as theirs, ships fast, and owns the platform end-to-end. This is a founding engineer role with a real path to CTO.
Your first job is to take the keys.
 
Move the platform off the agency's Azure into ours, take custody of production, and the headline deliverable.
 
Build the automated test suite this codebase never had, with a CI/CD pipeline where a green build genuinely means &quot;safe to ship.&quot; Then you own the roadmap.
How we build matters as much as what we build.
 
We are not rebuilding an IT shop of tickets and manual QA.
 
Terrapin runs as an AI-native pod: Claude Code and agents do the repetitive work and produce tested, PR-ready changes; you own architecture, review, security, and the hard 20%.
 
AI gives you the velocity, your tests and pipeline are what keep that velocity from turning into breakage!
We want to ship multiple times a week and almost never break anything, and hold our SOC 2 line the whole way. If that model excites you rather than worries you, you're the person.
This is genuinely full-stack.
 
Strong .NET / C# backend on Azure, real ownership of infra, security, and DevOps, and polished mobile (React Native + Expo, iOS and Android); Because the app is the product. Testing isn't someone else's job here. It's the core discipline.
The kind of person whose teammates would describe as:<ul><li>
an owner, not a ticket-taker</li><li>
obsessive about shipping quality fast</li><li>
calm owning production for a product with real money moving through it</li><li>
someone who builds automation instead of doing the same thing twice</li><li>
security-minded by instinct, not as an afterthought</li></ul>
What you'd bring:<ul><li>
Senior+ .NET / C# backend, PostgreSQL, solid API design</li><li>
Real Azure ownership: App Services, networking, Key Vault, identity, CI/CD (Azure DevOps or similar)</li><li>
Strong React Native + Expo mobile, with genuine UI/UX taste</li><li>
Test automation and CI/CD as a way of life &mdash; you write the tests with the code</li><li>
Hands-on building with Claude Code / agent tooling, and doing it safely in a SOC 2 world</li></ul>
Bonus points: fintech / payments background, Plaid experience, or applied LLM work.
And the reason the right engineer will actually stay: receipts are just the wedge. We're building toward a verifiable, tamper-evident record of an economic event. Proof that banks, insurers, and AI agents can consume directly. Stripe is a payment rails. We're building proof rails.
You'd work directly with me every day &mdash; 18+ years in fintech and payments, two exits behind me &mdash; so you own the engineering but never carry the hard architecture, security, or product calls alone.
The details:
 
UK or EU-remote(temporarily), with solid overlap to UK hours and business trips.
We're genuinely open to strong candidates across both. Being open to relocating to the UK down the line is a plus, but not a day-one requirement.
 
Competitive base plus real founding-level equity.
One hard line: you build quality in through tests and CI/CD. We're deliberately leaving the manual-testing, hope-it-works world behind, and a dev who treats testing as optional isn't the hire. Everything else, we can talk about.
If you want founder-level ownership, a CTO trajectory, and an AI-native way of building, and owning a live fintech platform from week one lights you up, let's talk.
Apply and tell me about something you shipped that you're proud of, and one thing you broke and how you made sure it never happened again.</div>

Founding Engineer (Full Stack); Patch to CTO

Explore 70+ Security operations engineer in London this July. Find roles across top companies and apply now to boost your career.