We are looking for a hands-on Security Operations Engineer to own and evolve our security posture across infrastructure, endpoints, and internal systems. You will be the primary driver of day-to-day security operations — from managing protective tooling to responding to incidents and coordinating audits. This is a high-ownership role with direct impact on how the company detects, responds to, and prevents security threats. Responsibilities: - **Security Systems Management** Own the configuration, maintenance, and continuous improvement of security tooling across the organization — including DLP (Data Loss Prevention), MDM (Mobile Device Management), SIEM, and endpoint protection platforms. Ensure policies are enforced, coverage is complete, and tooling stays current with evolving threats and business needs. - **Incident Management** Act as the first responder for security incidents: triage alerts, investigate root causes, coordinate containment and remediation, and produce clear post-mortem reports. Build and refine runbooks and playbooks to reduce response time and improve team readiness over time. - **Infrastructure Security** Partner with DevOps and Engineering teams to embed security across cloud infrastructure, Kubernetes workloads, CI/CD pipelines, and network layers. Conduct regular reviews of IAM policies, secrets management, network segmentation, and access controls to identify and close gaps before they become incidents. - **Audit & Penetration Testing** Coordinate internal and external security audits, manage relationships with pentest vendors, and track remediation of findings through to closure. Conduct ongoing vulnerability assessments and support compliance activities (SOC 2, ISO 27001, PCI DSS, or equivalent) by maintaining evidence and responding to auditor requests.

• You’ll lead major security incidents from detection through remediation, coordinating containment, analysing attacker activity, and supporting clients through critical decision‑making. • You’ll proactively hunt for threats using advanced KQL analytics, enhance SIEM/EDR detections, tune rules, and develop signatures aligned to MITRE ATT&CK. • You’ll perform malware triage and behavioural analysis, using reverse‑engineering tools when needed to support investigations and strengthen detection coverage. • You’ll produce clear, high‑quality investigation reports, timelines, and intelligence summaries that translate technical findings for a range of audiences. • You’ll contribute to SOC playbooks, mentor junior analysts, support onboarding of new customers, and help evolve SOC processes and tooling. • You’ll participate in the 24×7 on‑call rota to provide expert support during critical incidents.

• Act as the final escalation point for security incidents, conducting deep-dive investigations and forensic analysis. • Develop, implement, and enhance security monitoring and threat-hunting processes. • Lead incident response efforts, including containment, eradication, and recovery from security breaches. • Conduct threat intelligence analysis and proactively identify emerging security threats. • Tune and optimize security tools such as SIEM, IDS/IPS, endpoint protection, and vulnerability management solutions. • Collaborate with internal teams and external vendors to improve security architecture and processes. • Provide guidance and mentorship to L1 and L2 SOC analysts. • Develop and maintain security policies, playbooks, and incident response procedures. • Ensure compliance with industry regulations and security best practices. • Conduct red teaming exercises and penetration testing simulations.

• Monitor security alerts from SIEM, IDS/IPS, and endpoint security tools. • Investigate and triage security incidents, escalating them as necessary to L2 and L3 analysts. • Perform log analysis to detect anomalies and potential security breaches. • Assist in vulnerability scanning and security assessments. • Document incidents, findings, and recommendations in security reports. • Collaborate with senior SOC analysts to enhance threat detection and response capabilities. • Stay updated on emerging cybersecurity threats and trends. • Support the development of security awareness training for employees.