IT Security Operations Engineer (Infrastructure)

Harvey Nash Group; Birmingham; Hybrid; GBP 45,000 - 65,000; Full time

Job summary

Harvey Nash Group is seeking an IT Security Operations Engineer (Infrastructure) in Birmingham, operating on a hybrid basis. You will work within a Digital & Technology team to protect systems and services from evolving cyber threats, focusing on monitoring, incident response, tooling, vulnerability management, IAM, governance and continuous improvement.

You will monitor alerts, investigate suspicious activity, triage incidents and coordinate recovery with IT teams and external partners, while

Qualifications

• Experience in cyber security operations and infrastructure security.
• 1

Responsibilities

• Monitor security alerts across devices, networks and cloud services.
• Investigate phishing, malware and compromised accounts.
• Triage and manage security incidents with containment and recovery.
• Maintain security tooling configurations and dashboards.
• Support audits and security documentation.

Skills

Cyber security operations

Threat monitoring

Incident response

Security governance

Identity and access management

Education

Degree in cyber security / IT / computer science

CompTIA Security+ or Microsoft SC-200

Tools

SIEM

Microsoft Defender

Endpoint protection

Email security

Vulnerability scanning

Azure

Entra ID

Firewalls

VPN

Job description

Role: IT Security Operations Engineer (Infrastructure)

Location: Birmingham - Hybrid

I’m looking for an IT Security Operations Engineer to join a Digital & Technology team and help protect technology, information and services from evolving cyber threats.

This is a hands‑on security operations role focused on security monitoring, incident response, security tooling, vulnerability management, identity and access management, governance and continuous improvement.

THE ROLE

You’ll help keep systems secure, resilient and available, working closely with colleagues across IT and external security partners.

Security Monitoring & Incident Response

• Monitor security alerts across user devices, networks, cloud services and business systems
• Investigate suspicious activity, phishing emails, malware and compromised accounts
• Triage and investigate security incidents
• Take appropriate action to contain incidents and coordinate recovery with relevant IT teams
• Escalate serious incidents where required
• Maintain clear and accurate investigation and incident records

Security Tools & Controls

• Manage and maintain security tools including SIEM, Microsoft Defender, endpoint protection, email security and vulnerability scanning
• Review Microsoft 365, Azure and Entra ID security alerts and configurations
• Maintain security detection rules, dashboards and automated responses
• Support firewall, VPN, web filtering and wider network security controls
• Help ensure security tools and controls remain effective and appropriately configured

Vulnerability & Access Management

• Identify, assess and track system vulnerabilities and security weaknesses
• Work with technical teams to ensure security updates and remediation actions are completed
• Review privileged accounts, third‑party access and inactive accounts
• Investigate unusual sign‑in activity
• Support secure access controls and authentication processes
• Contribute to effective MFA and identity security practices

Governance, Reporting & Documentation

• Produce regular operational security reports, risk updates and incident summaries
• Maintain security procedures, incident response plans and technical documentation
• Support audits, compliance checks and evidence gathering
• Contribute to the development and maintenance of security policies and standards
• Provide practical cyber security advice to employees and IT colleagues
• Support security awareness and phishing education activities
• Monitor emerging threats and assess their potential impact
• Recommend improvements to security tools, processes and configurations
• Liaise with security suppliers and managed service providers where required
• Contribute to the ongoing improvement of the organisation’s cyber security posture

WHAT WE’RE LOOKING FOR

We’re looking for someone with practical experience in cyber security operations, infrastructure security or a comparable technical role.

You’ll have experience of:

• Monitoring and investigating security alerts
• Investigating phishing, malware, compromised accounts and suspicious activity
• Using and maintaining SIEM, endpoint protection, email security and vulnerability‑management tools
• Working with Microsoft 365, Azure and Entra ID security controls, alerts and identity‑management capabilities
• Incident response, including triage, containment, escalation, recovery and accurate record keeping
• Vulnerability remediation and managing security weaknesses
• Access controls, privileged accounts, MFA and secure authentication practices
• Network security controls including firewalls, VPNs and web filtering
• Maintaining security documentation and producing clear operational reports
• Supporting audits, compliance activity and evidence gathering
• Assessing cyber risk and providing practical technical advice
• Working effectively with internal IT teams and external security providers

QUALIFICATIONS & PROFESSIONAL DEVELOPMENT

You’ll ideally have:

• A degree, higher‑level apprenticeship or equivalent professional experience in cyber security, information technology, computer science or a related discipline
• Relevant industry certification such as CompTIA Security+, Microsoft Security Operations Analyst (SC-200) or equivalent demonstrable competence
• Current knowledge/training in cyber incident response, security monitoring, vulnerability management and identity & access management
• A commitment to ongoing professional development and keeping up to date with emerging threats, technologies and security practices