Cyber Security Engineer

Salary: £? - ? per year

Requirements

• Strong coding and scripting background, including PowerShell, Python and Regex
• Proven ability to work with APIs, including HTTP/S headers and responses, JSON objects
• Proven experience with proxy administration and changes
• Experience with Windows (SMB) and *Nix (NFS) remote storage
• Experience with IIS (Windows Web Server) configuration and Active Directory/LDAP authentication
• Experience applying certificates, software updates and supporting end-of-life refresh activity
• Experience with VMware/Hyper-V virtual machines and virtual switches
• Experience setting up, implementing and maintaining cyber security tooling
• Experience creating, testing and maintaining AI or machine learning technologies to help optimise workflows or playbooks
• Experience with SIEM technologies

Responsibilities

• Support the Cyber Security Capability Manager in ensuring we meet the challenges and demands of countering the cyber threat
• Work with other UK Cyber Security members on back-end refresh, playbook scripting, fault finding, tool upgrades, capability implementation, tool integration, data source onboarding and investigation activity
• Lead the technical aspects of ensuring cyber security appliance efficiency to support alert tuning, network visibility and log ingesting into relevant toolsets
• Advise on the implementation of new tools and lead the updating and expansion of existing capabilities
• Ensure the availability, readiness and resilience of cyber security toolsets within in-scope environments
• Account for the effective mapping and topology of SOC toolsets, including integrations and feeds between solutions
• Enrich the visibility and optimisation of SOC tools through data modelling and tuning
• Maintain the primary SOC toolsets, ensuring availability, functionality and optimisation
• Manage the daily muster and availability of all cyber security technologies within in-scope environments
• Track product lifecycle accurately and advise management on EOL/EOS roadmaps
• Support the coordination, planning and execution of SOC appliance upgrades
• Support new capability implementation and integration to existing solutions across all cyber security pillars
• Implement cyber security tool changes and configuration, ensuring efficient reporting into CAB and control boards
• Lead playbook scripting activities, ensuring they are documented and tested, including fault finding and review of false positives
• Act as the SME on SOC connectivity and visibility across all in-scope networks and infrastructure
• Lead back-end refresh activity on cyber security appliances, including certificate updates, patch releases and software updates
• Attend DEX CAB and collate all impacting activities on cyber security alerting
• Attend DEX incident and issue red teams in support of root cause analysis and advise on cyber security changes that may impact other services
• Collaborate closely with DEX back office to maintain availability and efficiency of cyber security tools and recover any service outages or disruption
• Support SOC investigation activity using a wide variety of security platforms, creating custom searches, advanced queries or scripts to find the root cause or IOC of an alert

Technologies

• AI
• Active Directory
• HTTP
• Hyper-V
• Support
• JSON
• LDAP
• Machine Learning
• Network
• NFS
• PowerShell
• Python
• Security
• SMB
• VMware
• Web
• Windows

More

We are a world-class defence organisation based in Stevenage, Hertfordshire. This is a 24-month subcontractor opportunity for a Cyber Security Engineer within our Cyber Security Operations Centre (SOC) in Digital Excellence (DEX) UK. The role is onsite five days per week, 37 hours per week, with overtime paid at time and a quarter for hours worked over 37 per week. The contract is inside IR35 and initially starts on SC Security Clearance, with DV Security Clearance required later on.

last updated 36 week of 2026