security operations engineer

Infosys

<div>In the assigned Job Role of Technology Consultant 2, your Area Of Responsibility will be as below: 
<ul><li>Contribute to the requirements elicitation process by documenting assigned parts of business requirements, in line with guidance provided
</li><li>Facilitate software application design discussions, and document design decisions to guide the technical team towards building software solutions
</li><li>Participate in coding and integrate new features or updates into existing applications, with a focus on maintaining system stability
</li><li>Conduct code reviews, do changes to the codebase and maintain code repositories
</li><li>Implement test strategies, analyse results, and coordinate bug fixes to uphold the software quality standards
</li><li>Develop user training programs, documentation, and support frameworks to ensure a smooth transition to new software applications
</li><li>Actively participate in resolving production issues and recommend preventive strategies to enhance system reliability
</li><li>Maintain detailed records of code, testing techniques, and support activities to enrich the knowledge base and assist other similar projects</li></ul> 

Your contribution to the team: 
<ul><li>A collaborative spirit and excellent communication skills.
</li><li>The ability to handle end to end SDLC phases from requirement gathering to implementation.
</li><li>A knack for translating complex requirements into actionable development tasks.
</li><li>A passion for design and hands-on coding experience
</li><li>A proactive approach to testing, troubleshooting, and refining our applications.
</li><li>The ability to work with cross-functional teams and do software integration.</li></ul></div>

Security Operations Center Engineer

Popular, Inc.

<div>General Description 


The Cybersecurity Engineer serves as a Cybersecurity Subject Matter Expert (SME), providing cybersecurity guidance, technical direction, and support across enterprise projects and initiatives. The role is responsible for ensuring that cybersecurity requirements, controls, and best practices are effectively integrated into technology solutions and business processes. 
The Cybersecurity Engineer is responsible for designing, engineering, and implementing security solutions to protect enterprise systems, applications, data, and infrastructure across cloud, on premise, and hybrid environments. This role focuses on building and integrating security controls, enabling secure architecture, and ensuring that security requirements are embedded across technology platforms and business initiatives. 
The Cybersecurity Engineer plays a key role in advancing modern security capabilities through the design and development of AI driven security solutions to enhance detection, response, and overall security operations. The position is expected to leverage automation and artificial intelligence to improve efficiency, scalability, and effectiveness across daily cybersecurity operations and processes. 

Essential Duties and Responsibilities 

<ul>
<li>Design, engineer, and implement security controls and solutions across cloud (AWS, Azure, GCP) and on premise environments in alignment with regulatory requirements and organizational standards.</li>
<li>Build and maintain secure enterprise architectures, ensuring security is fully integrated across infrastructure, applications, identity systems, and data platforms.</li>
<li>Develop and implement security engineering solutions to address vulnerabilities, improve control effectiveness, and strengthen the overall security posture.</li>
<li>Design and implement automation and orchestration capabilities to improve efficiency, consistency, and scalability of cybersecurity operations.</li>
<li>Design and develop AI driven security solutions to enhance detection, analytics, and response capabilities against evolving cyber threats.</li>
<li>Engineer and implement AI based capabilities that automate day to day cybersecurity activities, reduce manual effort, and improve operational efficiency.</li>
<li>Develop solutions that augment analyst decision making by providing intelligent insights, prioritization, and contextual analysis of security events.</li>
<li>Continuously optimize security processes and workflows by leveraging AI and automation to improve scalability, consistency, and overall effectiveness of cybersecurity operations.</li>
<li>Develop and validate security policies, standards, and technical controls aligned to industry frameworks such as NIST, CIS, MITRE ATT&amp;CK, and OWASP.</li>
<li>Engineer and integrate security tools and platforms, including SIEM, EDR, IAM, cloud security, and data protection technologies.</li>
<li>Collaborate with cross functional teams to ensure secure design and implementation of enterprise systems, applications, and technology solutions.</li>
<li>Identify, assess, and mitigate security risks through engineering solutions, architecture improvements, and control enhancements.</li>
<li>Research and evaluate emerging security technologies and innovations, including advanced automation and AI capabilities, and recommend adoption where appropriate.</li>
<li>Support the development and execution of the enterprise cybersecurity roadmap, ensuring alignment with business objectives, regulatory requirements, and evolving risk landscapes.</li></ul> 

Education 


Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or related field, or equivalent experience. 

Preferred Certifications (One or more):
<ul>
<li>CISSP, CISM, CISA, or equivalent advanced cybersecurity certifications</li>
<li>Cloud security certifications such as CCSP, AWS Security Specialty, Azure Security Engineer (AZ 500), or Google Cloud Security Engineer</li>
<li>AI / Machine Learning certifications such as Azure AI Engineer, AWS Machine Learning Specialty, or Google ML Engineer</li>
<li>Certified AI Professional (CAIP) or similar</li>
<li>Security engineering or technical certifications such as Security +, GIAC (GSEC, GCED, GCIH), OSCP, or CEH</li>
<li>Additional certifications in automation, cloud, or emerging technologies are a plus</li></ul> 


Experience 

<ul>
<li>6+ years of experience in cybersecurity or IT.</li>
<li>3+ years in security engineering roles.</li>
<li>Experience across cloud and on-premise environments.</li>
<li>Experience with enterprise security tools and platforms.</li>
<li>Experience with scripting or automation (Python, PowerShell, etc.).</li>
<li>Experience with AI tools.</li></ul> 


Knowledge and Skill 

<ul>
<li>Advanced knowledge of security architecture across cloud, on premise, and hybrid environments, with the ability to design and implement robust, scalable security solutions.</li>
<li>Advanced knowledge of enterprise cybersecurity domains, including Identity and Access Management (IAM), Network Security, Data Protection, Infrastructure Security, Application Security, Vulnerability Management, Endpoint Protection, Cloud Security, Security Operations (Detection and Response), Threat Intelligence, Security Architecture, DevSecOps, Security Automation and Orchestration, and AI driven security capabilities.</li>
<li>Deep expertise in industry frameworks and standards, including NIST, CIS, MITRE ATT&amp;CK, and OWASP, and the ability to apply them to real world security architectures and controls.</li>
<li>Proven experience with automation, orchestration, and AI driven security solutions, including the development and implementation of capabilities that enhance detection, response, and operational efficiency.</li>
<li>Demonstrates a high level of technical acumen with a strong engineering mindset, capable of solving complex security challenges across multiple domains.</li>
<li>Highly analytical and problem solving oriented, with the ability to interpret complex data, identify patterns, and translate findings into actionable security improvements.</li>
<li>Ability to effectively operate and deliver outcomes in complex, matrixed enterprise environments, collaborating across engineering, operations, and business teams.</li></ul> 
Important: The candidate must provide evidence of academic preparation or courses related to the job posting, if necessary.

Our hybrid work model benefit applies to certain positions and is subject to changes based on the organizational needs.

Applicants must be authorized to work for any employer in the United States. This position is not open to applicants who need visa sponsorship or transfer of visa sponsorship at this time.

ABOUT US

Popular is Puerto Rico&rsquo;s leading financial institution and have been evolving since it was founded over a century ago. From a small bank it has developed into a large corporation that offer a wide variety of services and financial solutions to our customers, with presence in the United States, the Caribbean and Latin America.

As employees, we are dedicated to making our customers dreams come true by offering financial solutions in each stage of their life. Our extensive trajectory demonstrates the resiliency and determination of our employees to innovate, reach for the right solutions and strongly support the communities we serve; therefore, we value their diverse skills, experiences and backgrounds.

We reaffirm our commitment to always offer essential financial services and solutions for our customers and communities, including during emergency situations and/or natural disasters. Popular&rsquo;s employees are considered essential workers, whose role is critical in the continuity of these important services even under such circumstances. By applying to this position, you acknowledge that Popular may require your services during and immediately after any such events.

If you have a disability or need more information about requesting an accommodation, please contact us at asesorialaboral@popular.com. This email inbox is monitored for such types of requests only. All information you provide will be kept confidential and will be used only to the extent required to provide needed exemptions or reasonable accommodations. Any other correspondence will not receive a response. 


Are you ready for a rewarding career? 


Popular is an Equal Opportunity Employer, including Disability/Vets 
Learn more about us at www.popular.com and keep updated with our latest job postings at www.jobs.popular.com.</div>

Cyber Security Engineer

Help AG, an e& enterprise company

<div>
 Help AG is looking for a talented and experienced Senior Security Engineer, specializing in Sentinel / Defender / Splunk who will be responsible for the creation of procedures, implementation of process development, and maintenance of security systems across client environments. The Security Engineer will work closely with Management, Senior Engineers, Threat Analysts, Solution Architects, other Security Engineers, and clients to complete high profile, critical services to existing Managed Security Service clients. This position is based out in Dubai, UAE and will be responsible for the administration, maintenance, and integration of Splunk, MS Azure Sentinel, Sentinel UEBA, AIP, Defender, CASB, ATA/ATP &amp; Intune for security operations technical engineering, assessment, and recommendations in the areas of real-time security, operational network &amp; identity management system, and applications systems security.
 
 
 
 Responsibilities
 
 
 
 <ul>
 <li>
 Design, implement, and support solutions with SIEM (preferably Sentinel) and Microsoft security technologies such as Azure Cloud Access Security Broker, Office 365 Advanced Threat Protection (O365 ATP), Microsoft Defender ATP, and their integrations used to deliver internet-scale intelligence and managed security products.
 </li>
 <li>
 Implement &amp; administer Microsoft Defender (ATP), Azure Cloud Access Security Broker &amp; Azure Threat Protection security products within customer environment Manage and oversee day-today activities of Azure IP platform and ensure adherence to enterprise standards in project execution methodology, requirements gathering, quality assurance, and continuous improvement.
 </li>
 <li>
 Assess customer needs and expectations, design solutions to meet those needs, and then implement the design.
 </li>
 <li>
 Quickly build and solve a problem using a new technology to determine viability.
 </li>
 <li>
 Serve as a primary responder for Managed Security customer systems, taking ownership of client configuration issues and tracking through resolution.
 
 
 </li>
 </ul>
 
 Qualifications &amp; Skills
 
 
 
 <ul>
 <li>
 College degree or equivalent training with experience working in a Security Operations Center, Managed Security, or client network environment.
 </li>
 <li>
 Experience and knowledge of Splunk, Azure M365 &amp; MS cloud security is essential.
 </li>
 <li>
 Security Engineer must possess minimum 5 years of professional experience &amp; Senior Security Engineer must possess minimum 7-8 years of professional experience supporting and maintaining Splunk, Azure M365 System.
 </li>
 <li>
 4-5 years of experience with administering &amp; managing Splunk and Sentinel SIEM including content development.
 </li>
 <li>
 Experience in Use cases creation and Content development on Microsoft Sentinel, Splunk SIEM.
 </li>
 <li>
 Experience in Custom Use cases, Dashboards, Report creation on Microsoft Sentinel, Splunk SIEM.
 </li>
 <li>
 Knowledge of Integration with tools, data connectors for Microsoft Sentinel, Splunk SIEM.
 </li>
 <li>
 Knowledge of Splunk, Sentinel architecture, tables and data in Sentinel.
 </li>
 <li>
 Knowledge of Sentinel workbooks and automation &amp; Splunk Enterprise Security.
 </li>
 <li>
 Professional experience working with networks and network architecture.
 </li>
 <li>
 Information security knowledge in one or more areas such as EDR &ndash; Enterprise end-point security products (e.g., McAfee e-Policy Orchestrator, Virus Scan, Anti-Spyware, Host Data Loss Protection, Endpoint Encryption, etc.).
 </li>
 <li>
 Splunk, Azure Log analytics, or equivalent big data engine experience.
 </li>
 <li>
 Experience with MS Azure Information Protection and technologies, including solution architecture, deployment, management, and support in a large global enterprise.
 </li>
 <li>
 Knowledge of Linux and Windows Operating Systems.
 </li>
 <li>
 Experience with various other SIEM security products such as: Splunk, ArcSight, Nitro, or LogRhythm and infrastructure components such as proxies, firewalls, IDS/IPS, and DLP.
 </li>
 <li>
 Experience working with clients in a service delivery function.
 </li>
 <li>
 Shift flexibility, including the ability to provide after-hours support when needed.
 </li>
 <li>
 Experience working with internal and client ticketing and knowledge base systems for Incident and Problem tracking as well as procedure.
 
 
 </li>
 </ul>
 
 Benefits
 
 
 
 <ul>
 <li>
 Health insurance with one of the leading global providers for medical insurance.
 </li>
 <li>
 Career progression and growth through challenging projects and work.
 </li>
 <li>
 Employee engagement and wellness campaigns activities throughout the year.
 </li>
 <li>
 Excellent learning and development opportunities.
 </li>
 <li>
 Annual flight tickets to home country.
 </li>
 <li>
 Inclusive and diverse working environment.
 </li>
 <li>
 Flexible/hybrid working environment.
 </li>
 <li>
 Open-door policy.
 
 
 </li>
 </ul>
 
 About Us
 
 
 
 Help AG is the cybersecurity arm of e&amp; enterprise (formerly Etisalat Digital) and provides leading enterprise businesses across the Middle East with strategic consultancy combined with tailored information security solutions and services that address their diverse requirements, enabling them to evolve securely with a competitive edge.
 
 
 Present in the Middle East since 2004, Help AG was strategically acquired by e&amp; (formerly Etisalat Group) in 2020, hence creating a cybersecurity and digital transformation powerhouse in the region.
 
 
 Help AG has firmly established itself as the region's trusted IT security advisor by remaining vendor-agnostic, trustworthy, independent, and maintaining its focus on all aspects of cybersecurity.
 
 
 With best of breed technologies from industry-leading vendor partners, expertly qualified service delivery teams and a state-of-the-art consulting practice, Help AG delivers unmatched value to its customers by strengthening their cyber defenses and safeguarding their business.
</div>

Senior Security Engineer - Microsoft Defender Suite & Sentinel

<div>
 Help AG is looking for a talented and experienced Security Engineer &ndash; NGFW &amp; DDOS who will be responsible for the creation of procedures, implementation of process development, and maintenance of security systems across internal and client environments. The Security Engineer will work closely with Management, Senior Engineers, Threat Analysts, Solution Architects, other Security Engineers, and clients to complete high profile, critical services to existing Managed Security Service clients. Expertise in technologies such as Arbor Peakflow, Arbor APS/AED, Fortinet Firewalls, Palo Alto firewalls &amp; Panorama, Cisco ASA and Firepower Firewalls, Juniper Firewalls, F5 (LTM) is highly recommended.
 
 
 
 Responsibilities
 
 
 
 <ul>
 <li>
 Act as L1 for DDOS &amp; Firewall technologies for Help AG customers.
 </li>
 <li>
 Able to monitor, operate, maintain, and troubleshoot IP Networks and interconnected Network Security technologies
 </li>
 <li>
 Provide timely response to all incidents, outages, and performance alerts.
 </li>
 <li>
 Takes responsibility in handling incidents and escalate timely to SME teams.
 </li>
 <li>
 Calling and Notifying customers and different stakeholders&rsquo; teams to provide faster resolution and updates.
 </li>
 <li>
 Should be working in a 24*7 support team.
 
 
 </li>
 </ul>
 
 Qualifications &amp; Skills
 
 
 
 <ul>
 <li>
 Bachelor&rsquo;s degree in computer science, information technology, or a related field.
 </li>
 <li>
 Should have at least 3+ years demonstrable industry experience.
 </li>
 <li>
 Should have expert and in-depth knowledge of Complex IP Networks.
 </li>
 <li>
 Should have solid understanding of Network Security technologies, data center traffic flow and advanced troubleshooting techniques.
 </li>
 <li>
 Should have Network Operations / Security Operations experience.
 </li>
 <li>
 Should have fair understanding of ITIL change management, problem management and incident management.
 </li>
 <li>
 Should have experience to work under pressure and with strict SLA&rsquo;s.
 </li>
 <li>
 Sound understanding of common services (web, mail, FTP, DNS, etc.), network vulnerabilities and network attack patterns.
 </li>
 <li>
 Experience with many/all the following security controls:
 </li>
 <ul>
 <li>
 Firewalls
 </li>
 <li>
 Intrusion Prevention Systems
 </li>
 <li>
 Antimalware
 </li>
 <li>
 Two factor Authentication
 </li>
 <li>
 Sandboxing
 </li>
 <li>
 Virtual Private Networks
 </li>
 <li>
 Firewall Rules Auditing
 </li>
 </ul>
 <li>
 Should have demonstrable experience of working in extreme pressure and customer facing environments.
 </li>
 <li>
 Self-motivated and a professional attitude.
 </li>
 <li>
 Excellent Customer facing skills.
 </li>
 <li>
 Excellent communication and listening skills.
 </li>
 <li>
 Excellent teambuilding, customer service, and interpersonal skills.
 </li>
 <li>
 Must possess good decision-making skills, be very organized and detail oriented.
 </li>
 <li>
 Skills in handling technical conflicts, organizational challenges, planning and implementation challenges.
 </li>
 <li>
 Judgment, decision making, cooperation, sensitivity to others, technical problem-solving, system troubleshooting, and business writing.
 
 </li>
 </ul>
 
 Benefits
 
 
 
 <ul>
 <li>
 Health insurance with one of the leading global providers for medical insurance.
 </li>
 <li>
 Career progression and growth through challenging projects and work.
 </li>
 <li>
 Employee engagement and wellness campaigns activities throughout the year.
 </li>
 <li>
 Annual Flight tickets to home country.
 </li>
 <li>
 Excellent learning and development opportunities.
 </li>
 <li>
 Flexible/Hybrid working environment.
 </li>
 <li>
 Inclusive and diverse working environment.
 </li>
 <li>
 Open door policy
 
 
 </li>
 </ul>
 
 About Us
 
 
 
 Help AG is the cybersecurity arm of e&amp; enterprise (formerly Etisalat Digital) and provides leading enterprise businesses and governments across the Middle East with strategic consultancy combined with tailored information security services and solutions that address their diverse requirements, enabling them to evolve securely with a competitive edge.
 
 
 Present in the Middle East since 2004, Help AG was strategically acquired by e&amp; (formerly Etisalat Group) in Feb 2020, hence creating a cybersecurity and digital transformation powerhouse in the region.
 
 
 Help AG has firmly established itself as the region's trusted IT security advisor by remaining vendor-agnostic, trustworthy, independent, and cybersecurity focused. With best-of-breed technologies from industry-leading vendor partners, expertly qualified service delivery teams and a state-of-the-art consulting practice, Help AG delivers unmatched value to its customers by strengthening their cyber defenses and safeguarding their business.
</div>

Security Engineer – NGFW & DDOS

Applied Computing

<div>About Applied Computing
Applied Computing was founded in 2024 to build Orbital, a physics-informed foundation model for energy operations. We&rsquo;re live across oil and gas,refineries, and petrochemicals, working towards our mission: sustainableabundance for a growing planet.
The hydrocarbon industry keeps the world running. But its complexity has left operators tied to legacy systems, making critical decisions on less than 10% of available data.
We built Orbital to change that. It&rsquo;s a foundation model built specifically for energy that lets companies use AI at scale, harnessing all of their operational data and optimising in real time for any metric. Decisions get faster, operations get safer, and carbon intensity falls.
We&rsquo;ve raised over $32 million, including one of the largest seed rounds for an AI company in the UK. We&rsquo;re just getting started.
The Role
Security here is not a compliance function with a budget and a slide deck. We take compliance seriously and it is woven into how the team operates. It is an engineering problem that needs solving every day, by someone who gets stuck in.
Our security team is small and honest about it. A hands-on CISO, a Compliance Manager, a Lead Security Researcher who spends his time on the offensive side, and a junior engineer who was the IT lead six months ago and is now doing the best work of their career. We need someone to sit in the middle of that and pull it forward.
The work is real and the ambition is high. We are maturing our DevSecOps capability, driving continuous improvement across our cloud posture, and targeting SOC 2 Type 2 certification within three to six months. Nobody is going to hand you a roadmap. You will help build it.
If that sounds like the kind of problem you want to own, read on.
Key Responsibilities
DevSecOps &amp; Secure SDLC<ul><li>
Design and implement security gates within CI/CD pipelines using GitHub Actions and related tooling</li><li>
Define and enforce secure coding standards and automated checks across development workflows</li><li>
Work closely with engineering teams to embed security early in the development lifecycle without becoming a blocker</li><li>
Champion a shift-left security culture across the organisation</li></ul>
Cloud Security<ul><li>
Own and maintain the cloud security posture across AWS (primary),Azure (development), and M365</li><li>
Use Wiz to continuously monitor, prioritise, and remediate cloud security findings</li><li>
Develop and enforce cloud security standards, IAM policies, and guardrails</li><li>
Identify and close gaps in cloud architecture before they become incidents</li></ul>
Vulnerability Management<ul><li>
Lead the vulnerability management programme, triage, prioritise, track and remediate across the estate</li><li>
Manage the intake of security findings from internal and external sources and ensure nothing falls through the cracks</li></ul><ul><li>
Produce clear, actionable remediation guidance for engineering and infrastructure teams and where needed, roll up your sleeves and raise the PR yourself</li><li>
Track and report on risk reduction over time to the CISO</li></ul>
Mentoring &amp; Team Development<ul><li>
Provide day-to-day mentoring and technical guidance to the junior security engineer</li><li>
Review their work, share your thinking, and help them develop both technically and professionally</li><li>
Contribute to a team culture where curiosity is valued and problems are solved collaboratively</li></ul>
Essential Experience<ul><li>
Hands-on experience with Terraform for infrastructure as code and security configuration management</li><li>
Proficiency with Microsoft Sentinel - building detections, managing alerts, and investigating incidents</li><li>
Working knowledge of Wiz or a comparable cloud security posture management tool</li><li>
Strong understanding of DevSecOps principles and practical experience integrating security into GitHub-based CI/CD pipelines</li><li>
Solid AWS security experience - IAM, security groups, logging,monitoring, and remediation</li><li>
Familiarity with M365 and Azure security configurations</li><li>
Experience delivering against SOC 2 and/or ISO 27001 requirements in a hands-on engineering capacity</li><li>
Proven ability to manage and prioritise a vulnerability backlog under real-world constraint</li></ul>
What We Are Looking For
The technical skills matter. So does everything else. We need someone who does not wait to be told what the problem is. Someone who is curious enough to go looking, confident enough to say what they find, and grounded enough to triage a ticket pile on a Tuesday morning without treating it as beneath them. The role will move between housekeeping and high-stakes projects in the same week.
The junior engineer on the team needs more than a colleague. They need someone who will invest in them, not just review their work but help them think differently. If mentoring energises you, that matters here.
Our Lead Security Researcher already owns the offensive side of AI and ML security. What we need is someone who can hold the defensive line, securing model pipelines, understanding prompt injection risks, thinking about supply chain exposure in AI systems. It is not a requirement for this role.
But if youhave been in that space, you will hit the ground running.
What Success Looks Like
30 Days
You know where the bodies are buried. You have mapped the cloud posture,walked the pipelines, understood the compliance gap, and formed a view on what needs to happen first. You are not still finding your feet, you are alreadycontributing.
60 Days
Your mark is already visible. The DevSecOps capability is stronger, vulnerability management has a process that people follow, and the SOC 2 Type 2 workstream is moving with momentum. The junior engineer is already doing things they were not doing before you arrived.
6&ndash;12 Months
SOC 2 Type 2 is done. Not in progress, done. The cloud posture is measurably stronger, and you can prove it. Security is part of how the engineering team works, not something that happens to them after the fact. You have raised the floor, and you are still raising it.</div>

Security Engineer

ByDesign Secure

This role is delivered within secure environments. Candidates must be eligible for UK Security Clearance (SC and DV) and hold UK Citizenship.Opening: Join the MissionAt ByDesign Secure, we design and deliver secure-by-default digital platforms for high‑assurance environments. We are currently building a new secure cloud platform based on Google Distributed Cloud (GDC) and are looking for a Security Engineer (SIEM) to lead the design and implementation of its security monitoring and observability capabilities.This role offers the opportunity to build a SIEM capability from the ground up, influence security architecture decisions, and directly support SOC operations protecting critical public‑sector services.About the OpportunityAs a Security Engineer (SIEM) at ByDesign Secure, you will be responsible for building and enhancing our security monitoring and detection capabilities across complex environments. You will design and maintain SIEM use cases, onboard and normalise data sources, and continuously tune detections to improve threat visibility and response.Working closely with incident response and platform teams, you will turn security data into actionable insight, helping to strengthen detection coverage, reduce noise, and advance the organisation&rsquo;s overall security maturity.Role Purpose<ul><li>As a Security Engineer, you will be responsible for designing, building, and operating the Security Information and Event Management (SIEM) and security observability stack for a new GDC‑based platform.</li><li>You will:</li><li>Define how security logs, metrics, alerts, and telemetry are collected, processed, retained, and visualised.</li><li>Establish a cloud-native SIEM tool and monitoring capability.</li><li>Integrate cloud‑native monitoring with existing on‑premise SOC tooling.</li><li>Enable SOC analysts by providing reliable, actionable security insights.</li><li>You will work closely with cloud engineers, security architects, SOC teams, and external vendors to ensure the solution meets security, operational, and compliance requirements.</li></ul>What You&rsquo;ll Be DoingSIEM Architecture &amp; Design<ul><li>Work with security and solution architects to design the end‑to‑end SIEM architecture for a secure Google Distributed Cloud (GDC) environment.</li><li>Define log, event and telemetry standards across platform, infrastructure, Kubernetes, and application layers.</li><li>Decide which data sources are monitored locally versus forwarded to an existing on‑prem SIEM.</li></ul>SIEM Implementation &amp; Integration<ul><li>Deploy Elastic SIEM using standard or shared Kubernetes clusters where appropriate.</li><li>Configure secure log forwarding from GDC components to an on‑prem SIEM over dedicated, encrypted network links.</li><li>Integrate cloud audit logs, Kubernetes logs, workload logs, and security tooling into Elastic and on‑prem platforms.</li></ul>Detection Engineering &amp; SOC Enablement<ul><li>Implement detections‑as‑code, version‑controlled and automated through CI/CD pipelines.</li><li>Create and tune detection rules, alerts, and dashboards for SOC analysts.</li><li>Align detections with threat intelligence and playbooks (e.g. Mandiant‑aligned SOC workflows).</li></ul>Observability &amp; Troubleshooting<ul><li>Support monitoring of logs, metrics, and security signals to aid both security response and operational debugging.</li><li>Enable Platform Admins and Application Operators to self‑serve diagnostics while maintaining security boundaries.</li></ul>Documentation &amp; Guidance<ul><li>Produce clear guidance for:</li><li>Platform Administrators configuring SIEM integrations</li><li>Application teams onboarding workloads and logs</li><li>SOC analysts using dashboards, alerts, and queries</li><li>Contribute to runbooks, operational procedures, and incident response documentation.</li></ul>Security &amp; Compliance<ul><li>Ensure logging and monitoring meet UK Government and high‑assurance security requirements.</li><li>Support audits, assurance activities, and continuous improvement of the monitoring posture.</li></ul>What You&rsquo;ll BringEssential Skills &amp; Experience<ul><li>Strong experience as a Security Engineer, Detection Engineer or SIEM Engineer.</li><li>Hands‑on experience designing or operating SIEM solutions in cloud or hybrid environments.</li><li>Practical knowledge of Elastic SIEM / Elastic Stack, including:</li><li>Indexing and ingest pipelines</li><li>Detection rules and alerts</li><li>Dashboards and visualisations</li><li>Experience working with Kubernetes environments and their logging/monitoring patterns.</li><li>Familiarity with secure log forwarding, encryption, and network‑restricted environments.</li><li>Ability to work closely with SOC teams and translate security requirements into technical implementations.</li></ul>Cloud &amp; Platform Knowledge<ul><li>Experience with Google Cloud Platform (GCP) or Google Distributed Cloud (GDC).</li><li>Understanding of cloud audit logs, identity logs, and platform‑level telemetry.</li><li>Experience deploying tools through cloud marketplaces or CI/CD pipelines.</li></ul>Ways of Working<ul><li>Comfortable working in high‑assurance, regulated environments.</li><li>Strong documentation and communication skills.</li><li>Able to work independently and take ownership of complex security integrations.</li></ul>Bonus Points For<ul><li>Existing UK Government Security Clearance (SC or above)</li><li>Hands‑on experience with Elastic Cloud on Kubernetes (ECK).</li><li>Experience implementing detections as code using Git, CI/CD, and infrastructure‑as‑code.</li><li>Knowledge of threat frameworks.</li><li>Familiarity with UK Government security standards and assurance processes</li></ul>Clearance Requirements:<ul><li>This role requires either an existing Security Clearance (SC level) or for one to be passed before commencement. There must be a willingness to undergo Developed Vetting (DV)</li></ul>Work Location: Hybrid remote in LondonJob Types: Temporary, Fixed term contractJob Types: Fixed term contract, TemporaryPay: &pound;625.00 per dayApplication question(s):<ul><li>Do you currently hold active UK SC clearance? </li><li>Do you hold UK nationality? (Required due to client security restrictions) </li><li>Are you eligible and willing to undergo UK SC/DV clearance for this role? (Applications without this cannot be considered)</li><li>Does your delivery approach allow for on-site presence in London when required (typically around 3 days per week)?</li></ul>Work Location: Hybrid remote in London

Security Engineer (SIEM) – SC Eligible – Government Projects

UK Biobank

Description Help secure one of the world's largest health research resources. At UK Biobank, security isn't simply about protecting systems; it's about safeguarding one of the world's most important biomedical research resources. Our platforms support researchers across the globe, helping advance the understanding of disease, prevention, and treatment. Protecting that data, the services that support it, and the people who rely on it is fundamental to everything we do. We're looking for two Information Security Engineers to join our growing Security team, helping strengthen and evolve our security capabilities across cloud, infrastructure, applications, and emerging technologies. Working closely with operational teams, governance specialists, external security providers, and technology teams, you'll support security operations; incident response; application, data, cloud and on-premise security; vulnerability management; governance; and emerging technologies. Can you do it? As an Information Security Engineer, you'll play a key role in protecting UK Biobank's data, services, and technology estate. Working closely with operational teams, governance specialists, external security providers, and technology teams, you'll support security operations, incident response, threat detection, vulnerability management, cloud security, and security tooling. This role offers exposure across a broad range of security disciplines rather than specialising in a single area. From investigating security incidents and maintaining security tooling through to supporting cloud security controls, AI-related technologies, and wider transformation programs, you'll be involved in shaping and improving security across the organisation. You'll also contribute to UK Biobank's Data &amp; Technology Transformation Programme, helping introduce new technologies and security capabilities that strengthen protection while enabling colleagues and researchers to access services securely and efficiently. For security professionals who enjoy variety, ownership, and working across multiple domains, this is a rare opportunity to broaden your experience while contributing to a genuinely meaningful mission. You will be responsible for: <ul><li>Participating in the Security Operations support rota, including out-of-hours on-call support, assessing, triaging, and investigating security alerts from the SOC and other sources to determine relevance, severity, and required actions.</li><li>Supporting incident response activities, including containment, eradication, and recovery, while contributing to the development and testing of security incident response plans and documenting investigations, remediation activities, and lessons learned.</li><li>Maintaining the security tooling estate, including EDR, vulnerability management, SIEM, DLP, email security, and web security solutions, ensuring services remain healthy, effective, and optimally configured.</li><li>Supporting the secure configuration, monitoring, and protection of assets, networks, cloud workloads across AWS and Microsoft Azure, and emerging AI services while helping embed security controls and guardrails.</li><li>Maintaining awareness of emerging threats, vulnerabilities, and industry developments, using insight to support risk assessments, security improvements, awareness initiatives, and a positive security culture across the organisation</li></ul>To be successful, you will have: <ul><li>Relevant operational experience as a security engineer, analyst, or similar role within a complex organisation handling sensitive or highly confidential data, including experience in an out-of-hours on-call rota and operating within environments aligned to ISO/IEC 27001 and Cyber Essentials Plus.</li><li>Experience assessing, triaging, and investigating security alerts, threats, and incidents; supporting incident response activities (containment, eradication, and recovery); proactive threat hunting; and refining detection rules, playbooks, and tooling configurations based on investigation trends and emerging threats.</li><li>Strong experience with leading security technologies, such as EDR, SIEM, DLP, BEC protection, and vulnerability management tooling.</li><li>Experience supporting a range of security functions, such as identity and access management (including access reviews, PAM, MFA and SSO), data security controls (including data classification, DLP, and encryption); and application security activities (including secure design reviews, SAST, DAST, software composition analysis, and vulnerability triage and remediation).</li></ul>Working hours are 35 hours per week, Monday to Friday, with some flexibility, 2 days onsite with hybrid working available. Located in Greater Manchester (supporting both Cheadle and Manchester Science Park locations). The team is planning to introduce an on-call support rota. Participation is expected to be approximately 1 week in every 4 as the function continues to grow and mature. Our passion for diversity and equality means creating a work environment for all employees that is welcoming, respectful, engaging, and enriched with opportunities for personal and professional development. We actively welcome applications from people with disabilities, long-term health conditions, neurodivergent candidates, and those with diverse thinking styles. We are committed to making reasonable adjustments throughout our recruitment process and in the workplace so that everyone can perform at their best. If you require any adjustments during the recruitment process, please contact Tommy Wilson Jobs@ukbiobank.ac.uk so we can support you. Your Wellbeing Matters to Us Our wellbeing score on Indeed is rated as 77%, (High) reflecting how people experience working here day-to-day. Colleagues often highlight a strong sense of purpose, supportive team culture, and the opportunity to grow. There&rsquo;s a real focus on learning, flexibility, and feeling valued, whether that&rsquo;s developing new skills, contributing ideas, or building a career within Information Security. Benefits ️26 Days&rsquo; Annual Leave &ndash; Plus Bank Holidays Holiday Buy Scheme Birthday Leave USS Pension Scheme Healthcare Cash Plan Enhanced Family Leave Cycle to Work Scheme Season Ticket Loan Professional Subscriptions Training &amp; Development Opportunities ️ Free On-Site Gym ️Subsidised Canteen Lunches Free Car Parking ️Employee Discounts Portal Employee Assistance Programme Annual Flu Vaccination ️Life Assurance Cover #LI-Hybrid The job advert closing date may change, so early applications are encouraged About UK Biobank UK Biobank is a large-scale biomedical database and research resource containing in-depth genetic and health information from half a million UK participants. The database, the largest and most comprehensive of its kind in the world, is anonymised and made widely accessible by UK Biobank to global researchers who use it to find new scientific discoveries about common and life-threatening diseases &ndash; such as cancer, heart disease and stroke which strike in mid-later life. UK Biobank is an innovative organisation with over 350 staff across four sites in the UK that fosters an engaging environment and supports the development of our staff. Our dedicated teams work alongside the world's leading biomedical scientists in our joint mission to improve public health. Job Type: Full-time Pay: &pound;60,000.00-&pound;70,000.00 per year Work Location: In person

Information Security Engineer

Search 10000+ Security operations engineer jobs near you this July. New roles added regularly across leading industries. Apply today.