IT Security Operations Engineer

Cyber Security Engineer
Location: On-site
Type: Permanent

A well established organisation is looking for a Cyber Security Engineer to join its on-site IT function. This role sits within security operations and will suit someone who enjoys a hands-on mix of monitoring, incident response, Microsoft 365 security, vulnerability management, hardening, and operational security improvement.

You'll be involved in investigating security events across on-prem, cloud, and hybrid environments, supporting remediation activity, improving controls, and helping drive strong day-to-day cyber operations across the business.

What you'll be doing:

• Monitoring and investigating security events across SIEM, EDR/XDR, AV, Microsoft 365 security tools and wider infrastructure
• Responding to incidents, carrying out root cause analysis, and supporting containment and remediation
• Managing and improving Microsoft security controls across Defender, Conditional Access, MFA, Entra ID, identity protection and device compliance
• Tracking vulnerabilities through to closure and supporting patching, hardening, and baseline enforcement
• Supporting governance, risk, and compliance activity including policy improvement, audit evidence, and risk assessments
• Working within ITIL-aligned incident, problem, change, and request processes
• Producing clear SOPs, runbooks, procedures, and operational documentation
• Working with network teams on firewalls, VPNs, proxies, segmentation, and network security reviews

What they're looking for:

• 5+ years in cyber security engineering or operations
• Strong experience across Microsoft 365 security technologies including Defender, Conditional Access, MFA, and Entra ID
• Hands-on exposure to SIEM, EDR/XDR, vulnerability management, patching, and cloud security
• Good understanding of incident response, threat investigation, and operational security processes
• Experience with PowerShell or Python for scripting and automation
• Solid grounding in network security concepts including firewalls, VPNs, IDS/IPS, DNS, and TCP/IP
• Familiarity with ISO27001, GDPR, and audit or compliance support
• Strong communication skills, documentation standards, and a methodical approach

Desirable certifications:

• CISSP, CISM, CEH, SC-200, SC-300, SC-400, AZ-500, MS-102, ITIL Foundation