The Role
As a Security Engineer, you will play a key role in designing, optimising, and maintaining security telemetry pipelines while supporting SOC operations and detection engineering activities.
You'll work with cloud-native technologies, SIEM platforms, and security data tooling to improve visibility, detection capability, and operational resilience across complex environments.
Key Responsibilities
- Manage and optimise security log ingestion pipelines using Cribl and cloud-native technologies.
- Support the collection and processing of AWS security telemetry, including CloudTrail, VPC Flow Logs, GuardDuty, EKS audit logs, and IAM activity.
- Build and maintain security data models, field extractions, and data normalisation standards aligned to OCSF.
- Troubleshoot ingestion and pipeline performance issues across services such as SQS, S3, and Splunk.
- Develop and enhance SIEM detection logic and support the tuning of use cases to improve alert quality.
- Work closely with SOC analysts to improve detection coverage and reduce false positives.
- Help implement secure data handling practices, including encryption, access controls, and least-privilege principles.
- Contribute to the optimisation of security data storage and tiering strategies across cloud environments.
Skills & Experience
Essential
Strong experience within Security Engineering, SOC Engineering, SIEM Engineering, or Detection Engineering roles.
Hands-on experience with AWS security services and cloud-native security monitoring.
Proven experience developing and supporting Splunk detection rules and SPL queries.
Experience with security data pipelines and log management technologies.
Knowledge of S3, SQS, Kinesis, and cloud-based logging architectures.
Understanding of security frameworks such as Zero Trust and identity-centric security models.
Excellent communication and stakeholder management skills.
Desirable
Experience with Cribl.
Azure and/or Google Cloud Platform exposure.
Knowledge of OCSF data schemas and security data normalisation.
Previous experience working within UK Government or wider public sector environments.
What's on Offer?
- £450 per day
- Outside IR35
- 9-month initial contract
- Hybrid working - only 1 day per month onsite in London
- Opportunity to work on large-scale cloud security and SOC transformation initiatives
- Collaborative environment with experienced cyber security professionals
- High-profile programme delivering security services that support critical public sector operations