Cyber Defence Engineer

Plannedlink; West Midlands; On-site; GBP 60,000 - 90,000; Full time

Job summary

Plannedlink in the West Midlands, United Kingdom is seeking a Cyber Defence Engineer to join a growing security team responsible for testing, deployment, maintenance, configuration and troubleshooting of the SOC’s technology stack (hardware and software). The engineer will also assist with data pipelines and the development of system signatures and the professional growth of the team.

The role requires deep knowledge of cyber security, data analytics, and SIEM platforms, with a focus on

Qualifications

• Minimum 5 years of relevant security engineering experience.
• Experience with enterprise ICS/network architectures.
• Experience with data-intensive distributed applications.
• Experience maintaining SIEM platforms such as Elastic.
• Strong analytical and problem-solving skills.
• Ability to lead junior SOC engineers.
• Knowledge of cyber defence policies and regulations.

Responsibilities

• Perform system administration for cyber defence applications.
• Manage system/server resources and performance.
• Diagnose and resolve incidents affecting operability.
• Coordinate with Cyber Defence and CTI Analysts on data flows and signatures.
• Manage data from enterprise networks and sources.
• Develop data management standards and policies.
• Analyze data to provide actionable recommendations.
• Update SOC leads on investigations.
• Document SOC processes for training.

Skills

Networking basics

Big data technologies

SIEM platforms

Elastic

IDS/IPS

Packet capture

Signatures development

Mentoring

Cybersecurity policies

Tools

VMware

Hyper-V

Job description

West Midlands, United Kingdom | Posted on 21/03/2025

The Cyber Defence Engineer will join agrowing security team responsible for the testing, implementation, deployment,maintenance, configuration and troubleshooting of the SOC’s technology stack(hardware and software). The engineer will also assist with the continueddevelopment and maintenance of data pipelines and signature updates and theprofessional development of the system engineering team.

Tasks:

• Perform systemadministration on specific cyber defence applications and systems to includeinstallation, configuration, maintenance, troubleshooting, backup, andrestoration.
  
• Manage system/serverresources including performance, capacity, availability, serviceability, andrecoverability.
  
• Diagnose and resolvecustomer reported system incidents, problems, and events to ensure continuingoperability.
  
• Coordinatewith Cyber Defence and CTI Analysts in the management and administration theupdating of ingested data flows, cyber use cases and signatures for specialisedcyber defence applications in response to new or observed threats.
  
• Manage the compilation,cataloguing, distribution, and retrieval of data from a range of enterprisenetworks and data sources.
  
• Implement and develop datamanagement standards, policies, requirements, and specifications.
  
• Analyse data sources toprovide actionable recommendations and facilitate data-gathering methods.
  
• Provide updates to the SOC Leads (Line Management,Team Leaders) on current SOC investigations and findings.
  
• Share knowledge, skills,and experience, by documenting SOC processes to aid to aid SOC maturity and trainingof new members of the data engineering team.
  

Requirements

Knowledge:

• A demonstrablenetworking background – experience in system administration.
  
• Knowledge of big datatechnologies and ecosystems (e.g. Apache NiFi).
  
• Knowledge of currentmarket and emerging tools in data analytical and SIEM platforms.
  
• Knowledgeof network security implementations (e.g., IDS, IPS, EDR), including theirfunction and placement in an enterprise network.
  
• Knowledgeof intrusion detection systems and signature development.
  
• Knowledge of front-endcollection systems, including network traffic collection, filtering, andselection.
  
• Knowledge of cyber security threats,vulnerabilities, and privacy principles.
  
• Working knowledge inconfigurating collection sensors for enterprise networks.
  
• Knowledgeof system administration concepts for operating systems such as but not limitedto Linux, Android, and Windows operating systems.
  
• Knowledge of cyberdefence and information security policies, procedures, and regulations.
  
• Knowledge of networksecurity architecture concepts including topology, protocols, components, andprinciples.
  
• Knowledgeof cyber incident response frameworks and handling methodologies.
  
• Knowledge of data backup andrecovery.
  

Skills/Experience:

• Must-have – circa5 years + relevant experience.
  
• Must-have experience withEnterprise ICS/network architectures and technologies.
  
• Must-have experience withframeworks and technologies that support data-intensive distributedapplications.
  
• Must-have experience withmaintaining and administrating data analytical and SIEM platforms such asElastic.
  
• Must-have experience with problemsolving and analytical skills and able to collect information, analyse, report,and advise on evidence-based changes.
  
• Skillto apply cybersecurityand privacy principles to organizational requirements (relevant toconfidentiality, integrity, availability, authentication, non-repudiation).
  
• Stakeholder management – Expert ability tocommunicate to all levels of the organisation on technical, and non-technicallevel.
  
• Experience using hostand network-based IDS/IPS
  
• Experience using packetcapture solutions.
  
• Skill indeveloping and deploying signatures.
  
• Abilityto provide technical and service leadership to junior SOC Engineers(mentor/coach).
  

DesirableQualifications/Certifications

• Red Hat SystemAdministration I & II (RH124/RH134).
  
• Knowledge of virtualisation technologiessuch as VMWare and HyperV.
  
• Proventrack record and experience in developing cyber security policies andprocedures, as well as successfully producing deliverables to meetorganisational objectives.
  
• Abilityto work calmly and effectively under pressure and have a can-do attitude.
  
• Broadcyber certifications or equivalent such as Cyber Foundation Pathway, CompTIA(N+, S+, CySA+), SANS (GSEC, GCIH, GMON, GCDA), Systems Administrations (ActiveDirectory), CISCO (CCNA, CCNP) and risk management.
  

Working knowledge of Defence Joint Service Publications (440, 441,604).