Cyber Security Engineer

Foresters Financial; Greater London; Hybrid; GBP 54,000 - 66,000; Full time

Benefits offered by this job

Discretionary annual bonus

25 days holiday plus bank holidays

Life Assurance

Generous pension scheme

1 day paid charitable workday

Employee Assistance Programme

Job summary

Foresters Financial in Bromley, Kent, is seeking two Cyber Security Engineers to join our hands-on security team. You will monitor security events, investigate incidents, and help strengthen our cyber resilience across endpoints, identities, email, and cloud services.

You will work with Microsoft Defender, Entra ID, Intune, Rapid7 SIEM, and Sophos Antivirus, develop runbooks, and contribute to threat detection, incident response, and security improvements in a collaborative, supportive

Qualifications

• Experience in a Cyber Security Engineer, SOC Analyst, or similar security-focused role.
• Hands-on experience with Microsoft Defender (Endpoint and/or O365 security).
• Experience using Rapid7 SIEM for alerting and investigations.
• Experience managing or supporting Sophos Antivirus or other endpoint protection solutions.
• Strong understanding of cyber threats and incident response processes.
• Ability to analyse logs and endpoint activity to determine scope and root cause.
• Good knowledge of Windows environments and basic networking concepts.
• Strong documentation and reporting skills.
• Familiarity with ISO27001 and NIST CSF.

Responsibilities

• Actively monitor alerts and telemetry across endpoints, identities, email, and cloud services.
• Investigate suspected cyber attacks including malware, phishing, and unauthorised access.
• Lead or support incident response activities per internal policies.
• Escalate incidents and provide timely updates to stakeholders.
• Tune security tools to reduce false positives and improve detection.
• Develop and maintain runbooks and incident response playbooks.
• Collaborate with IT and service desk to resolve security issues.
• Produce clear incident reports for technical and non-technical audiences.

Skills

Cyber security

Incident response

Defender

Rapid7 SIEM

Endpoint protection

Windows

Networking

Documentation

Communication

ISO27001

NIST CSF

Tools

Microsoft Defender

Entra ID

Intune

Sophos Antivirus

Job description

Cyber Security Engineer

up to £60,000

Bromley, Kent

Full-Time

Permanent

We are looking for Two Cyber Security Engineers to play a key, hands‑on role in protecting our organisation from cyber threats.

This is an operational security role, ideal for someone who enjoys investigating incidents, working across multiple security platforms, and making a tangible impact on an organisation’s cyber resilience.

You will sit at the heart of our cyber defence operations, working daily with technologies including Microsoft O365 Defender, Entra ID, Intune, Rapid7 SIEM, and Sophos Antivirus. You’ll be responsible for monitoring security events, investigating suspicious activity, responding to incidents, and continuously improving our security posture.

This is a genuinely hands‑on cyber security role with real responsibility and impact; you will have exposure to a broad security tooling landscape and real‑world incidents. At Foresters we are a supportive, collaborative working environment and you will have on‑going opportunities to develop your technical skills and grow within cyber security

What you will do:

Security Monitoring & Incident Response

• Actively monitor alerts and telemetry across endpoints, identities, email, and cloud services using Rapid7 SIEM, Microsoft Defender, and Sophos AV.
• Investigate suspected cyber attacks including malware infections, phishing campaigns, identity compromise, and unauthorised access attempts.
• Perform triage, root cause analysis, containment, and remediation of security incidents.
• Lead or support incident response activities in line with internal policies and procedures.
• Escalate significant incidents appropriately and provide clear, timely updates to stakeholders.

Threat Detection & Prevention

• Proactively identify emerging threats, vulnerabilities, and attack patterns affecting the organisation.
• Tune and optimise security tools to reduce false positives and improve detection accuracy.
• Implement, manage, and maintain endpoint protection and security policies.
• Support vulnerability management activities, including remediation planning and risk tracking.

Security Operations & Continuous Improvement

• Maintain and enhance security monitoring rules, alerts, and dashboards.
• Contribute to the development and maintenance of security runbooks and incident response playbooks.
• Support security audits, compliance activities, and risk assessments.
• Actively contribute to improving the organisation’s overall cyber security maturity.

Collaboration & Communication

• Work closely with IT, infrastructure, and service desk teams to resolve security-related issues.
• Produce clear, structured technical and non-technical incident reports.
• Identify trends in phishing or risky user behaviour and support security awareness initiatives.
• Assist with security-related projects and new technology deployments.

Working hours are 40 hours a week Monday to Friday. Start times are flexible from 7.30am to 9.30am. After a successful training period there is flexibility to work from home for 1 day a week.

What we require:

• Experience in a Cyber Security Engineer, SOC Analyst, or similar security-focused role.
• Hands‑on experience with Microsoft Defender (Endpoint and/or O365 security).
• Experience using Rapid7 SIEM or a comparable SIEM platform for alerting and investigations.
• Experience managing or supporting Sophos Antivirus or other endpoint protection solutions.
• Strong understanding of common cyber threats, attack vectors, and incident response processes.
• Ability to analyse logs, alerts, and endpoint activity to determine scope, impact, and root cause.
• Good working knowledge of Windows environments and basic networking concepts.
• Strong documentation, reporting, and communication skills.
• Practical experience with security tools such as IDS/IPS, Metasploit, Nexpose, Nmap, Nessus, Wireshark, L0phtCrack, John the Ripper, or similar.
• Familiarity with recognised information security frameworks such as ISO27001 and the NIST Cybersecurity Framework.

What we offer you:

• Basic salary up to £60000 per annum
• Discretionary annual bonus dependent on your performance and company performance provided you are employed on bonus payment date.
• Annual holiday allowance of 25 days holiday plus bank holidays
• Life Assurance (based on pensionable earnings)
• Generous contributory Pension scheme
• 1 days paid charitable workday
• Employee Assistance Programme

About us

Foresters Financial is not your typical financial services provider. Those who join our purpose‑driven organisation enjoy a culture of collaboration, creativity, and mutual respect and are challenged to do their best to make a difference every day. We help everyday families achieve their financial goals and make a lasting difference in their lives and communities.

What we do

We help everyday families achieve their financial goals and make a lasting difference in their lives and communities. We will continue to do this by employing enthusiastic and talented Financial Advisers working across the country and equally talented people to be based at our Head Office in Bromley