Senior Security Engineering

Role Overview – XSOAR/SOAR Engineer

Working within a dedicated Security Operations function, this position focuses on delivering both project-based consultancy and technical engineering support.

You will be involved in a variety of engagements ranging from automation development and SIEM integrations to cloud security assessments and vulnerability programme improvements. Typical work includes building SOAR playbooks, integrating log sources, developing detection rules, and enhancing security visibility across environments.

Roughly half of your time will be customer-facing, delivering Professional Services engagements. The remainder will be spent contributing to internal engineering initiatives, innovation efforts, and continuous improvement of tooling and processes.

This role is well-suited to someone with a SOC or security engineering background who enjoys working across different technologies and environments, and who is confident engaging directly with stakeholders as a trusted technical advisor—particularly within cloud-first environments such as Azure.

Key Responsibilities

Delivery

• Lead and deliver engagements across SOAR, SIEM, XDR, and vulnerability/exposure management platforms
• Perform cloud security reviews and health checks, particularly within Azure environments
• Design and implement XSOAR playbooks, integrations, and automation workflows
• Develop and maintain log parsers, normalisation processes, and correlation rules
• Deploy and optimise SIEM/XDR solutions tailored to customer needs
• Enhance vulnerability management processes using platforms such as Rapid7, Tenable, or Qualys
• Conduct exposure and attack surface assessments using relevant tooling
• Produce clear and structured technical documentation following project delivery

Collaboration

• Work closely with internal engineering teams to share knowledge and improve practices
• Support onboarding and escalation activities for customer environments
• Contribute to technical design discussions and future roadmap planning
• Mentor team members and promote knowledge sharing across the function

Continuous Improvement

• Identify opportunities to automate and streamline security operations
• Develop reusable playbooks, integrations, and frameworks
• Contribute to internal labs, testing environments, and service delivery enhancements

Skills & Experience

Essential:

• At least 1 year of experience in a SOC environment, or 3+ years in infrastructure/networking roles with security exposure
• Experience analysing and triaging security alerts
• Understanding of attacker techniques, tactics, and procedures (TTPs)
• Ability to identify indicators of compromise across systems and networks
• Hands-on experience with SIEM, EDR, or XDR platforms
• Familiarity with ITSM/ticketing tools (e.g. ServiceNow, JIRA, Salesforce)
• Knowledge of system logs, authentication events, and process activity across Windows and Unix-like systems
• Understanding of key network protocols such as DNS, HTTP, SMB, and LDAP
• Ability to interpret and correlate logs from multiple sources
• Awareness of frameworks such as MITRE ATT&CK

Desirable:

• Experience with Microsoft Sentinel or similar SIEM platforms
• Familiarity with XDR tools such as Defender, CrowdStrike, or SentinelOne
• Querying experience using KQL, XQL, or similar languages
• Exposure to threat intelligence concepts
• Basic scripting or coding capability (any language)

Additional Details

• Location: Remote-based within the UK, with occasional office visits
• Clearance: Eligibility for UK security clearance (SC) preferred