Elastic SIEM Security Engineer — Cloud & IR Focus

TRIA; Manchester; Sur place; GBP 60 000 - 90 000; Plein temps

Résumé du poste

TRIA is seeking a mid-level Security Engineer to join a specialist Security Engineering team focused on developing and managing the Elastic SIEM platform. The role involves securing AWS, Azure and on-premise environments while building detection rules and monitoring coverage.

You will implement log ingestion, tune alerts and dashboards, and collaborate with Threat Intelligence, Vulnerability Management and Network Operations teams to strengthen security across systems and services.

Qualifications

• Hands-on experience with Elastic Stack or Elastic Security.
• Good knowledge of AWS security and services such as IAM, CloudTrail, GuardDuty or Security Hub.
• Experience with SIEM engineering, log ingestion and detection-rule development.
• Understanding of incident response, cloud security and vulnerability management.
• Strong communication and problem-solving skills.

Responsabilités

• Manage, develop and optimise the Elastic SIEM platform.
• Create and tune detection rules, alerts and dashboards.
• Integrate new log sources and improve monitoring coverage.
• Support the secure configuration of AWS, Azure and on-premise systems.
• Assist with security incidents, investigations and remediation.
• Work with Threat Intelligence, Vulnerability Management and Network Operations teams.
• Contribute to the secure design of new systems and services.

Connaissances

Elastic Stack

Elastic Security

AWS security

SIEM engineering

log ingestion

detection rules

incident response

cloud security

vulnerability management

communication

Outils

MITRE ATT&CK

Python

PowerShell

Terraform

Azure security

Description du poste

TRIA is seeking a mid-level Security Engineer to join a specialist Security Engineering team focused on developing and managing the Elastic SIEM platform. The role involves securing AWS, Azure and on-premise environments while building detection rules and monitoring coverage.

You will implement log ingestion, tune alerts and dashboards, and collaborate with Threat Intelligence, Vulnerability Management and Network Operations teams to strengthen security across systems and services.