Role Overview:

Will be responsible for the design, implementation, administration, optimization, and support of cybersecurity solutions across customer environments. The role requires strong technical expertise in deploying, integrating, configuring, and maintaining security platforms while ensuring optimal performance, visibility, and protection.

The engineer will work closely with cross-functional teams and customers to deliver high-quality managed security services, support security operations, and contribute to strategic cybersecurity initiatives.

Responsibilities

Security Platform Administration

• Deploy, configure, administer, and maintain enterprise endpoint and network security platforms.
• Perform platform health checks, upgrades, troubleshooting, and lifecycle management.
• Configure security policies, detection rules, indicators of compromise (IOCs), indicators of attack (IOAs), and security baselines.
• Optimize security configurations to minimize false positives while maintaining effective detection coverage.
• Support endpoint containment, threat remediation, forensic investigations, and incident response activities.
• Manage platform onboarding, offboarding, access controls, role-based access control (RBAC), and security policies.
• Integrate security platforms with SIEM, SOAR, identity management, and threat intelligence solutions.

Network Security Monitoring

• Deploy, configure, administer, and maintain network detection and monitoring platforms.
• Configure sensors, traffic monitoring, packet capture, metadata collection, and supporting infrastructure.
• Tune detection rules and behavioral analytics to improve threat visibility.
• Investigate suspicious network activities, including lateral movement, command-and-control communications, ransomware, insider threats, and credential abuse.
• Integrate network security platforms with SIEM, SOAR, endpoint security, and threat intelligence solutions.
• Perform platform health monitoring, upgrades, capacity planning, and performance optimization.

Engineering and Integration

• Design and implement integrations between endpoint security, network security, SIEM, SOAR, threat intelligence, directory services, identity management, and IT service management platforms.
• Develop automation workflows using APIs and scripting to improve operational efficiency.
• Create and maintain architecture diagrams, technical documentation, standard operating procedures (SOPs), and operational runbooks.
• Support customer onboarding, migration, deployment, and platform integration projects.
• Validate telemetry collection, data quality, and event visibility across integrated security platforms.

Threat Detection and Security Operations

• Collaborate with security operations and incident response teams to investigate and respond to security incidents.
• Conduct threat hunting using endpoint, network, and security monitoring data.
• Develop and enhance detection use cases aligned with the MITRE ATT&CK framework.
• Participate in purple team exercises, adversary emulation, and continuous improvement initiatives.
• Recommend security enhancements based on emerging threats, threat intelligence, and incident findings.

Operational Responsibilities

• Perform platform upgrades, patching, backup validation, and preventive maintenance.
• Monitor platform health, licensing, storage, and overall performance.
• Maintain technical documentation, SOPs, and knowledge base articles.
• Provide technical mentoring and guidance to junior engineers and security operations analysts.
• Participate in after-hours maintenance and critical incident support when required.

Qualifications and Skills

• Minimum 5-7 years of experience in cybersecurity engineering or security operations.
• At least 4 years of hands-on experience administering enterprise endpoint security platforms.
• At least 3 years of experience administering network detection and response platforms.
• Experience supporting enterprise security platforms within a Security Operations Centre (SOC) or Managed Security Services (MSS) environment.
• Working knowledge of SIEM platforms, including data onboarding, alert tuning, dashboard development, correlation rules, and security investigations.
• Familiarity with security monitoring tools, query languages, log normalization, and data connector troubleshooting.
• Experience integrating security platforms with identity management, threat intelligence, automation, and incident management solutions.

Technical Knowledge

• Endpoint security and protection.
• Network security and traffic analysis.
• Security incident response and investigation.
• Threat hunting and detection engineering.
• MITRE ATT&CK framework.
• IOC/IOA management.
• Malware analysis and remediation.
• Windows and Linux security.
• Directory services and identity management.
• Networking fundamentals, including TCP/IP, DNS, VPNs, and firewalls.
• REST APIs and security platform integrations.
• PowerShell and/or Python scripting.
• Security automation and orchestration.
• SIEM data onboarding, correlation rules, dashboards, and alert tuning.

Preferred Certifications

• Relevant endpoint security and network security platform certifications.
• SIEM and security operations certifications.
• Cloud security and security engineering certifications.
• Recognized cybersecurity certifications such as CISSP, GCIH, GCED, CySA+, Security+, or equivalent.

Benefits

• Health insurance through a leading medical insurance provider.
• Career progression and growth opportunities through challenging projects.
• Employee engagement and wellness initiatives throughout the year.
• Learning and professional development opportunities.
• Inclusive and diverse working environment.
• Flexible and hybrid working arrangements.
• Open-door communication policy.

Salt is acting as an Employment Agency in relation to this vacancy.