Cyber security Operation Manager

Agratas – A Tata Enterprise; Bridgwater; On-site; GBP 60,000 - 90,000; Full time

Job summary

Agratas – A Tata Enterprise is seeking a Cyber Security Engineer to lead security monitoring, threat detection, and incident response across enterprise environments in the United Kingdom. You will develop detection use cases, secure cloud and identity platforms, and perform proactive threat hunts to defend against evolving threats.

The role requires practical expertise in SIEM/EDR technologies, scripting, and cloud security, with the ability to communicate findings to technical and management

Qualifications

• Relevant experience in cybersecurity operations, monitoring, or security engineering.
• Strong experience with enterprise security solutions across endpoints, network, and cloud.
• Proven experience managing security incidents through the full incident response lifecycle.
• Solid understanding of networking fundamentals and security concepts.
• Knowledge of attack techniques, threat detection methodologies, and threat hunting.
• Experience analysing logs, packet captures, endpoint artefacts, and digital evidence.
• Proficiency in Splunk SPL, KQL, SQL, or similar query languages.

Responsibilities

• Develop and optimise detection use cases aligned with the MITRE ATT&CK framework and emerging threats.
• Tune security controls and automate workflows to reduce false positives and improve detection accuracy.
• Manage and secure Microsoft 365 Security and Microsoft Security platforms.
• Strengthen identity security through attack surface analysis, privilege reviews, and policy optimisation.
• Review security architecture and provide guidance for secure deployment of new applications and technologies.
• Create advanced correlation rules across multiple log sources to detect sophisticated attack patterns and generate high-fidelity alerts.
• Support end-to-end incident response, including triage, investigation, containment, eradication, recovery, and reporting.
• Perform digital forensic investigations across endpoints, servers, cloud environments, and other relevant sources.
• Assist in malware removal, persistence eradication, root cause validation, and secure system recovery.
• Maintain and enhance incident response playbooks to align with current threats and industry best practices.
• Conduct structured, unstructured, and intelligence-driven threat hunts across network, endpoint, and cloud environments.
• Analyse security data to identify anomalous behaviour, indicators of compromise (IOCs), and attack patterns.
• Collaborate with security, incident response, and engineering teams to improve detections and strengthen security posture.
• Present findings, recommendations, and remediation strategies to technical and management stakeholders.
• Stay current with emerging threats, attack techniques, and security technologies through continuous learning.

Skills

Cybersecurity ops

Threat hunting

Incident response

EDR/NDR/SIEM

Splunk SPL

PowerShell

Python

Active Directory

Identity protection

Tools

Microsoft Defender

CrowdStrike

Splunk

Sentinel

Elastic

Entra ID

Active Directory

Job description

Role Overview

We are seeking a skilled and proactive Cyber Security Engineer with a proven ability to manage enterprise cybersecurity operations. The ideal candidate will have strong technical expertise across security operations, detection engineering, incident response, and threat hunting, with proven experience working on modern security platforms. This role requires a practitioner who can actively defend enterprise environments and continuously improve security posture.

Key Responsibility Areas

Security Monitoring & Engineering

• Develop and optimise detection use cases aligned with the MITRE ATT&CK framework and emerging threats.
• Tune security controls and automate workflows to reduce false positives and improve detection accuracy.
• Manage and secure Microsoft 365 Security and Microsoft Security platforms.
• Strengthen identity security through attack surface analysis, privilege reviews, and policy optimisation.
• Review security architecture and provide guidance for secure deployment of new applications and technologies.
• Create advanced correlation rules across multiple log sources to detect sophisticated attack patterns and generate high-fidelity alerts.

Incident Response

• Support end-to-end incident response, including triage, investigation, containment, eradication, recovery, and reporting.
• Perform digital forensic investigations across endpoints, servers, cloud environments, and other relevant sources.
• Assist in malware removal, persistence eradication, root cause validation, and secure system recovery.
• Maintain and enhance incident response playbooks to align with current threats and industry best practices.

Threat Hunting

• Conduct structured, unstructured, and intelligence-driven threat hunts across network, endpoint, and cloud environments.
• Analyse security data to identify anomalous behaviour, indicators of compromise (IOCs), and attack patterns.
• Collaborate with security, incident response, and engineering teams to improve detections and strengthen security posture.
• Present findings, recommendations, and remediation strategies to technical and management stakeholders.
• Stay current with emerging threats, attack techniques, and security technologies through continuous learning.

Good to Have

• Knowledge of OT (Operational Technology) security concepts and principles.
• Familiarity with automation and scripting (PowerShell, Python, Bash).
• Familiarity with securing cloud workloads on Azure, AWS

Required Qualifications

• Relevant experience in cybersecurity operations, monitoring, or security engineering.
• Strong experience with enterprise security solutions across endpoint, network, and cloud environments.
• Proven experience in managing security incidents throughout the full incident response lifecycle.
• Solid understanding of networking fundamentals and security concepts.
• Knowledge of attack techniques, threat detection methodologies, and threat hunting.
• Experience analysing logs, packet captures, endpoint artefacts, and digital evidence.
• Proficiency in Splunk SPL, KQL, SQL, or similar query languages.

Technology Expertise

• Advanced proficiency with EDR, NDR, and SIEM platforms such as Microsoft Defender, CrowdStrike, Splunk, Sentinel, or Elastic.
• Experience with data security technologies, including DLP, IRM, and DSPM solutions.
• Advanced proficiency in configuring and investigating email security platforms.
• Hands-on experience with identity and access management solutions such as Entra ID and Active Directory.
• Strong understanding of authentication and authorisation protocols, including SAML, OAuth 2.0, and OIDC.
• Experience with security automation tools, orchestration platforms, and threat intelligence feeds.