IT Security Engineer

Achilles Information Limited; Abingdon; On-site; GBP 55,000 - 75,000; Full time

Job summary

Achilles Information Limited in Abingdon is seeking an IT Security Engineer to join our security operations team. You will monitor networks, manage firewalls and VPNs, conduct security audits, and ensure security is integrated into infrastructure designs.

You will collaborate with IT, compliance and legal to maintain ISO 27001, SOC 2 Type 2 and ENS compliance, handle incidents, drive improvements, and contribute to documentation and vendor oversight.

Qualifications

• IT Diploma level or equivalent experience.
• ISO 27001 Lead Auditor desirable.
• CISSP, CEH, CCNA Security desirable.
• Fluent in English and Spanish.
• Minimum of 5 years of IT security experience.
• Strong knowledge of network security principles and tools.

Responsibilities

• Threat Monitoring: monitor network traffic for suspicious activity and respond to threats.
• Security Audits: conduct internal audits to meet ISO 27001, SOC 2 Type 2 and ENS.
• Firewall and VPN Management: configure and manage firewalls, VPNs and related devices.
• Collaboration: work with IT teams to embed security in designs and processes.
• Patch Management: ensure timely updates to network devices.
• Documentation: maintain detailed security configurations, incidents, and changes.
• Compliance & Audits: prepare for internal and external audits.
• Incident Management: handle incidents and implement corrective actions.
• Vendor Management: ensure third parties meet security requirements.
• Continuous Improvement: monitor ISMS effectiveness and drive improvements.

Skills

Security monitoring

Incident response

Threat modelling

Network security

Vulnerability assessment

Documentation

Communication

Team collaboration

Education

IT Diploma level or equivalent

ISO 27001 Lead Auditor desirable

CISSP

CEH

CCNA Security

Tools

Mimecast Portal

DMARC

Sophos Central

Qualys

Duo

Taegis XDR

Microsoft Entra ID

InTune

Azure

Job description

IT Security Engineer

UK - Abingdon

Key Responsibilities

SECURITY OPERATIONS

• Threat Monitoring: Monitor network traffic for suspicious activity, detect and respond to potential threats, and provide recommendations for mitigation.
• Security Audits: Conduct internal audits of Achilles teams to ensure ISO 27001, SOC 2 Type 2 and ENS requirements are met.
• Firewall and VPN Management: Configure and manage firewalls, VPNs, and related network security devices to ensure optimal protection.
• Collaboration: Work with other IT teams to ensure security is embedded in infrastructure designs and processes.
• Patch Management: Ensure timely updates and patches to network devices to mitigate vulnerabilities.
• Documentation: Maintain detailed documentation of network configurations, security incidents, and changes made to systems.

INFORMATION SECURITY

• Compliance and Audits: Ensuring that the organisation complies with ISO 27001 requirements and other related standards. Preparing for internal and external audits.
• Incident Management: Handling security incidents and breaches, ensuring proper reporting and analysis. Ensuring that corrective actions from security incidents are implemented and that lessons learned are incorporated into future improvements.
• Vendor and Third-Party Management: Ensuring that third-party vendors and service providers comply with the organisation's security policies and ISO 27001, SOC 2 Type 2 and ENS requirements.
• Continuous Improvement: Monitoring the effectiveness of the ISMS and implementing improvements as needed.
• Collaboration: Working closely with IT, legal, compliance, and other departments to ensure a unified approach to security. Collaborating on the integration of ISO 27001, SOC 2 Type 2 and ENS requirements into broader IT or business processes.

PERSONAL DEVELOPMENT

• Taking personal responsibility for skills development, particularly to enhance security capabilities.
• Actively participating in the performance management process and taking responsibility for delivering agreed objectives.

RELATIONSHIPS

• Manage and develop relationships with third party providers and internal stakeholders
• Being a security 'go to person'.

Qualifications

• IT Diploma level or equivalent experience.
• ISO 27001 Lead Auditor desirable.
• CISSP, CEH, CCNA Security, or other relevant security certifications are highly desirable.
• Fluent in English and Spanish, with the ability to communicate effectively in both written and spoken form.

Person Specification

COMPETENCIES

DECISION MAKING

• Identifies and evaluates the range of options open to them
• Articulates the assumptions made and the risks involved in decisions taken
• Analyses information carefully to identify facts, patterns, trends and missing data that may impact on a decision
• Communicates decisions clearly to those who are affected

ACHIEVING RESULTS

• Focuses on performance outcomes despite uncertain or difficult circumstances
• Actively links own efforts to those of others within the team to avoid overlap, rework or delays
• Spots opportunities to deliver beyond expectations, where this would help others perform more effectively
• Sets own targets and objectives with clear reference to how these contribute to the departmental business plan

MANAGING CHANGE

• Responds constructively and quickly to shifting goalposts or changing requirements
• Copes effectively with rapid change or increased demands
• Reprioritises own work or the work of the team in response to external pressures
• Is flexible in their approach; adapts their working style to suit the needs of the situation

DRIVE & MOTIVATION

• Addresses multiple demands without losing focus or energy
• Increases efforts in the face of difficulties or obstacles and recovers quickly after setbacks
• Remains calm and focused during stressful or challenging situations; concentrates only on things they can control or influence
• Encourages others during challenging times with their positive, can-do attitude

CREATIVE CAPACITY

• Uses initiative to resolve recurring problems in own role or team
• Takes calculated risks to improve own performance
• Tries out new ways of working
• Allocates time to identifying and resolving the root causes of problems

KNOWLEDGE

• Understanding of ISO 27001 principles, threat modelling, vulnerability assessments, and risk treatment methodologies.
• Deep understanding of network security principles (e.g., firewalls, VPNs, intrusion detection systems, SIEM), and network protocols.
• Knowledge of encryption methods, access control mechanisms, and endpoint security tools.
  • Knowledge of compliance frameworks (ISO 27001, SOC 2, ENS, PCI DSS) and best practices.
• Knowledge and experience with securing cloud environments (Azure).
• Knowledge of network architectures.

EXPERIENCE

• Minimum of 5 years of experience in IT Security, with a proven track record in a similar role.
• Technical skills:
  • Strong understanding of network protocols, including TCP/IP, DNS, routing, and switching.
  • Experience of security toolsets (Mimecast Portal and DMARC, Sophos Central, Qualys, Duo, Taegis XDR, Microsoft Entra ID, Copilot and InTune).
• Soft skills:
  • Strong problem-solving and analytical skills.
  • Excellent communication skills, both verbal and written.
  • Ability to work both independently and collaboratively in a fast-paced environment.
• Preferred skills:
  • Experience in conducting penetration testing and threat hunting.
  • Scripting experience (PowerShell) for automation of security tasks.