Our client is looking for a strong Security Engineer to act as the technical escalation point above their SOC function, taking ownership of complex security incidents and driving investigations through to resolution.
This is a hands-on role focused on incident triage, forensic investigation, threat analysis, and remediation within a large enterprise environment.
You will be responsible for investigating escalated security events, identifying indicators of compromise (IoCs), performing root cause analysis, and improving detection capabilities through engineering and threat-informed defence measures.
Key Responsibilities:
- Investigate and lead the response to security incidents escalated from the SOC team through to containment and remediation
- Perform forensic analysis across endpoints, identities, network, and cloud environments to determine scope, impact, and root cause
- Identify, analyse, and validate indicators of compromise (IoCs), attacker behaviours, and attack pathways
- Develop and optimise detection logic, correlation rules, and KQL queries to improve threat visibility and response effectiveness
- Produce clear technical findings, remediation recommendations, and lessons learned following security incidents
- Partner with security operations, infrastructure, and application teams to strengthen security controls and reduce future risk
Qualifications and Requirements:
- Previous experience in Security Engineering, Incident Response, Digital Forensics, Threat Hunting, or advanced SOC environments
- Strong hands-on experience investigating escalated cyber security incidents within enterprise-scale environments
- Proven ability to conduct forensic analysis and determine root cause across endpoint, identity, network, and cloud technologies
- Experience identifying indicators of compromise (IoCs), mapping attacker activity, and recommending effective remediation actions
- Strong KQL query development skills and experience working with SIEM, EDR, and security monitoring platforms
- Excellent analytical and communication skills, with the ability to present technical findings to both technical and non-technical stakeholders
This role would suit someone who enjoys deep technical investigation, security engineering, and incident remediation rather than traditional alert monitoring or administrative SOC activities.