Cyber Security Engineer / SOC Analyst

Certain Advantage; Stevenage; On-site; GBP 170,000 - 185,000; Full time

Job summary

World Class Defence Organisation is seeking a Cyber Security Engineer subcontractor to lead technical aspects of cyber security appliance efficiency, alert tuning and log ingestion across UK networks.

You will support the SOC with tool upgrades, capability expansion and ensuring availability and resilience of cyber security toolsets, reporting to the Cyber Security Capability Manager.

Qualifications

• Strong coding and scripting background with PowerShell, Python & Regex.
• Proven ability to work with APIs, including HTTP/S headers and responses, JSON Objects.
• Experience with proxies administration and changes.
• Windows (SMB) and Nix (NFS) remote storage.
• IIS (Windows Web Server) configuration, Active Directory/ LDAP authentication.
• Experience with applying certificates, software updates and end-of-life refresh activity.
• Experience with VMware/ Hyper-V virtualization and virtual switches.
• Experience in setting up, implementing and maintenance of cyber security tooling.
• Experience with AI or machine learning technologies to assist with workflow optimization or playbooks.
• Experience with SIEM technologies.

Responsibilities

• Accountable for the effective mapping and topology of SOC toolsets including integrations and feeds between solutions.
• Enriching the visibility and optimisation of SOC tools through data modelling and tuning.
• Maintain the primary SOC toolsets, ensuring their availability, functionality and optimisation.
• Responsible for the daily muster and availability of all cyber security technologies within in-scope environments.
• Responsible for the accurate tracking of product lifecycle and advising management of EOL/EOS roadmaps.
• Support the Cyber Security Capability Manager in the coordination, planning and execution of SOC appliance upgrades.
• To support all cyber security pillars with new capability implementation and integration to existing solutions.
• Implement cyber security tool changes and configuration ensuring efficient reporting into CAB and control boards.
• To lead on playbook scripting activities ensuring they are well documented and tested, including fault finding and review of false positives.
• To be the SME on SOC connectivity and visibility across all in-scope networks and infrastructure, ensuring connections and integrations are understood and documented.
• To lead all activity of back-end refresh on cyber security appliances - including certificate updates, patch releases and software updates.
• Responsible for attending DEX CAB and collating all impacting activities on cyber security alerting.
• Responsible for attending DEX Incident and Issue red teams in support of root cause analysis - advising on cyber security changes which may impact other services.
• Collaborate closely with DEX back office to maintain availability and efficiency of cyber security tools and recover any service outages or disruption.
• Support the SOC in investigation activity utilising a wide variety of security platforms, creating custom searches, advanced queries or scripts to find root cause or IOC of an alert.

Skills

PowerShell

Python

Regex

APIs

JSON

HTTP/HTTPS

Proxies

Windows

Active Directory

LDAP

Certificates

Software updates

VMware

Hyper-V

SIEM

Security tooling

AI/ML for workflows

Tools

SIEM technologies

VMware

Hyper-V

IIS

Active Directory

Job description

World Class Defence Organisation is currently looking to recruit a Cyber Security Engineer subcontractor on an initial 24 month contract.

People from a background working as a Cyber Security Engineer, SOC Engineer, SOC Analyst, Senior SOC Analyst, Cyber Security Analyst, Security Operations Engineer, SIEM Engineer, SIEM Analyst, Threat Detection Engineer, Security Infrastructure Engineer would be well suited to this position.

Rate: £92.11 per hour

Location: Stevenage

Hybrid / Remote working: Onsite 5 days per week

Contract: 37 Hours per week

Overtime: Hours worked over 37 hours per week will be calculated at 'time and a quarter'

Duration: 24 Months (initially and then ongoing and long-term thereafter)

IR35 status: Inside IR35 (Umbrella)

Cyber Security Engineer Job Description

An opportunity has arisen in the Cyber Security Operations Centre (SOC) within Digital Excellence (DEX) UK for a Cyber Security Engineer. The successful applicant will lead on the technical aspects of ensuring cyber security appliance efficiency of tasks to support alert tuning, network visibility and log ingesting to relevant toolsets. They will advise on implementation of new tools and lead the updating and expansion of existing capabilities. Reporting to the Cyber Security Capability Manager, the Cyber Security Engineer will provide support by ensuring availability, readiness and resilience of cyber security tool sets within in scope environments.

Responsibilities

We are looking for a Cyber Security Engineer to support the Cyber Security Capability Manager in ensuring Digital Excellence UK meets the challenges and demands of countering the Cyber Threat. To work with other UK Cyber Security members, the role will cover back-end refresh, playbook scripting and fault finding, Cyber Security tool upgrades, capability implementation, tool integration, data source on-boarding and investigation activity utilising a wide variety of security platforms including but not limited to; SIEM (Security Information Event Management), Network Packet Capture platform, Anti Malicious Code, Threat Detection technologies and platforms across the in-scope UK networks.

The SOC Threat Detection Analyst key responsibilities are

• Accountable for the effective mapping and topology of SOC toolsets including integrations and feeds between solutions
• Enriching the visibility and optimisation of SOC tools through data modelling and tuning
• Maintain the primary SOC toolsets, ensuring their availability, functionality and optimisation
• Responsible for the daily muster and availability of all cyber security technologies within in-scope environments
• Responsible for the accurate tracking of product lifecycle and advising management of EOL/EOS roadmaps
• Support the Cyber Security Capability Manager in the coordination, planning and execution of SOC appliance upgrades
• To support all cyber security pillars with new capability implementation and integration to existing solutions
• Implement cyber security tool changes and configuration ensuring efficient reporting into CAB and control boards
• To lead on playbook scripting activities ensuring they are well documented and tested. This includes fault finding and review of false positives
• To be the Subject Matter Expert (SME) on SOC connectivity and visibility across all in scope networks and infrastructure, ensuring connections and integrations are understood and documented with the Cyber Security Capability Manager
• To lead all activity of back-end refresh on cyber security appliances - including certificate updates, patch releases and software updates
• Responsible for attending DEX CAB and collating all impacting activities on cyber security alerting
• Responsible for attending DEX Incident and Issue red teams in support of root cause analysis - advising on cyber security changes which may impact other services
• Collaborate closely with DEX back office to maintain availability and efficiency of cyber security tools and recover any service outages or disruption
• Support the SOC in investigation activity utilising a wide variety of security platforms, creating custom searches, advanced queries or scripts in order to find the root cause or IOC of an alert

Skillset/experience required

• Strong coding and scripting background - PowerShell, Python & Regex
• Proven ability to work with APIs, including HTTP/S headers and responses, JSON Objects.
• Proven experience with Proxies administration and changes.
• Windows (SMB) and Nix (NFS) remote storage.
• IIS (Windows Web Server) Configuration, Active Directory/ LDAP (authentication).
• Experience with applying certificates, software updates and the steps involved for end-of-life refresh activity.
• Experience with VMware/ Hyper-V Virtual machines and virtual switches.
• Experience in setting up, implementing and maintenance of cyber security tooling.
• Experience with the creation, testing and maintenance of AI or machine learning technologies to assist with the optimisation of work flows or play books.
• Experience with SIEM (Security Information Event Management) technologies