Security Engineer

Security Engineer required for a global legal firm. This role offers a split between Threat Detection Engineering and Security Engineering, helping to enhance the firm's SIEM capability while implementing and supporting a range of enterprise security technologies.

Working closely with infrastructure, cloud and security teams, you'll improve threat visibility, strengthen security controls and help mature the organisation's overall security posture.

The Role

You'll be responsible for developing and optimising SIEM capabilities, building detection use cases, onboarding log sources and improving security monitoring. Alongside this, you'll engineer, implement and support security technologies across endpoint, identity, cloud and network environments, contributing to the continual improvement of the wider security estate.

Key Responsibilities

Threat Detection Engineering

• Optimise SIEM performance, data ingestion and detection capabilities.
• Onboard new log sources across cloud, network, endpoint and application environments.
• Develop and tune detection rules, dashboards and alerting aligned to MITRE ATT&CK.
• Implement SOAR automation to improve detection and response.
• Support incident investigations and continuously improve detection effectiveness.

Security Engineering

• Implement, support and optimise security technologies across endpoint, identity, cloud, email and network security.
• Design and enhance security controls and platform integrations.
• Develop automation using Scripting and APIs.
• Support vulnerability management, security hardening and operational improvements.
• Work with technical teams to embed security best practice.

Skills & Experience

• Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, Elastic, ArcSight, LogRhythm or Exabeam.
• Strong detection engineering experience, including log onboarding, correlation rules and threat detection.
• Experience supporting enterprise security technologies such as Microsoft Defender, EDR/XDR, IAM, cloud security or vulnerability management.
• Good understanding of Windows, Linux, Azure, AWS or GCP, networking and security architecture.
• Knowledge of MITRE ATT&CK, threat hunting and SOAR.
• Scripting skills using Python, PowerShell or similar.
• Excellent communication and stakeholder management skills.

Desirable

• Microsoft Defender Security Suite.
• DLP, IAM or Zero Trust technologies.
• Threat intelligence and threat hunting.
• SaaS, IaaS and PaaS security.
• Business continuity, disaster recovery and data privacy.