Cyber Security Engineer

Broaden; Greater London; Hybrid; GBP 75,000 - 95,000; Full time

Job summary

Broaden in London is seeking a Cyber Security Engineer to own the Zero Trust platform, Entra ID governance, Defender XDR policy tuning, and data protection across a scale-up global insurance group. The role is hybrid with on-site 2–3 days per week.

The successful candidate will automate recurring security tasks, work with the MDR/XDR partner, and help standardise security posture for acquisitions, while building evidence pipelines for ISO 27001 and NIST CSF.

Qualifications

• Demonstrable hands-on security engineering experience.
• Experience working in multi-tenant or acquisition-led environments.
• Track record of working with external security partners (MDR/XDR).
• Certifications such as SC-200/SC-300/AZ-500 are desirable.
• Exposure to IaC (Bicep/Terraform) or Defender for Cloud is a plus.

Responsibilities

• Design and maintain identity and access controls across Entra ID estate.
• Automate security tasks and evidence gathering using PowerShell and Graph.
• Tune Defender XDR, Defender for Cloud, and Sentinel policies with MDR partner.
• Define Windows/macOS endpoint hardening baselines and enforce Purview DLP policies.
• Lead security onboarding for newly acquired entities and automate compliance evidence.

Skills

Security engineering

Automation mindset

Threat hunting

Communication

MSSP oversight

Tools

PowerShell

Microsoft Graph

Logic Apps

KQL

Sentinel

Entra ID

Microsoft Defender XDR

Defender for Cloud

Job description

Cyber Security Engineer | Zero Trust Platform & Identity Controls | Scale-Up Global Insurance Group | London (Hybrid) | £75-95K base DOE

About the Company

Our client is a fast-scaling, PE-backed specialist insurance group operating across the UK, Ireland, Europe, Singapore, and Australia. Having acquired over fifty separate businesses spanning specialist lines including professional indemnity, financial lines, and commercial insurance, they are executing a group-wide IT transformation programme to rebuild a fragmented legacy footprint into a unified, highly secure, and automated platform.

Operating with a Microsoft-first technology strategy, the organisation runs a lean in-house technology team that leverages world-class external partners to achieve massive operational leverage. They champion absolute ownership, engineering discipline, and radical simplicity-moving dynamically without layers of bureaucracy or corporate hand-holding. They are anti-bureaucracy but pro-governance, delivering regulatory compliance and security controls (ISO 27001 / NIST CSF) directly through platform automation rather than paperwork and committees.

If you are an exceptionally bright, technically curious engineer who would rather design a smart automated fix for a recurring problem than quietly work around it, you will find a massive opportunity here.

About the Role

Reporting directly to the Lead Infrastructure Security Engineer within the Security & Devices team, this is a hands-on, keyboard-level security engineering role designed to build, automate, and maintain the technical security controls protecting the group.

This is not a passive policy oversight or ticket-monitoring position. While you will provide second-line security operations cover for alerts escalated by the group's outsourced MDR/XDR provider, your primary mission is proactive security engineering. You will own the Zero Trust security programme covering Entra ID identity controls, Microsoft Defender XDR policy tuning, Purview data protection, and endpoint hardening standards implemented by the infrastructure team. Additionally, you will play a central role in the M&A security playbook—standardising and automating the security posture of newly acquired entities through a structured "Contain, Encapsulate, Absorb" methodology.

Key Responsibilities

• Design, implement, and maintain identity and access controls across the group’s Entra ID estate, including Conditional Access policies, Privileged Identity Management (PIM), break-glass provisions, and authentication methods.
• Treat security as an engineering discipline - automating recurring security tasks, evidence gathering, and access hygiene using PowerShell, Microsoft Graph, and Logic Apps in preference to manual workarounds.
• Configure and tune protection, detection, and response policies across Microsoft Defender XDR and Defender for Cloud, partnering with the MDR provider to eliminate false positives and close coverage gaps.
• Define endpoint hardening baselines for Windows and macOS (verified against deployed infrastructure) and enforce Microsoft Purview DLP and sensitivity labeling policies across the estate.
• Perform second-line investigations of alerts escalated by the MDR provider across Defender XDR and Sentinel, conducting proactive threat hunting via KQL queries and Sentinel workbooks.
• Oversee the outsourced vulnerability scanning service, driving findings through to remediation within SLA limits while quality-checking triage decisions and provider KPI performance.
• Act as the technical security point of contact for newly acquired entities, executing the security onboarding playbook to remediate configuration gaps during integration.
• Build and maintain technical evidence pipelines supporting ISO 27001 and NIST CSF frameworks, generating compliance documentation directly from tooling rather than assembling it by hand.
• Deep Microsoft Security Command: Hands-on experience configuring, tuning, and investigating alerts across Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Defender for Cloud.
• Entra ID & Identity Architecture: Strong technical grasp of Entra ID governance, including Conditional Access, PIM, and managing workload identity risks (service principals, app registrations, consent grants).
• Practical Automation Mindset: Proven ability to automate security operations using PowerShell and Microsoft Graph as a minimum, with ideal exposure to Logic Apps or Azure Functions.
• KQL & Threat Investigation: Proficiency in writing KQL queries and leveraging Sentinel workbooks to establish incident scope, impact, and root cause.
• Communication & Collaboration: Clear written and verbal communication, with the ability to translate technical security risks into clear remediation steps for non-technical stakeholders and infrastructure peers.

Qualifications & Experience

• Proven Engineering Background: Demonstrable hands-on experience in a security engineering, infrastructure security, or cloud security role.
• M&A or Multi-Tenant Exposure: Experience working within multi-tenant, multi-entity, or acquisition-led environments.
• Partner & MSSP Oversight: Track record of working alongside or managing external security partners (MDR/XDR, vulnerability scanning), enforcing SLAs and escalation pathways.
• Certifications (Desirable): Active SC-200, SC-300, or AZ-500 certifications are treated as evidence of technical depth and curiosity, never as a strict barrier to apply.
• Desirable: Exposure to Infrastructure-as-Code approaches (Bicep, Terraform) or Microsoft Defender for Cloud (CSPM/CWPP).
• Employment Type: Permanent
• Location: London (Hybrid - 2 to 3 days per week on-site)
• Reporting Line: Lead Infrastructure Security Engineer