Security Architect Lead

TN United Kingdom; London; Hybrid; GBP 60,000 - 90,000; Full time

Job summary

A leading company in the UK is seeking a Splunk Engineer / Security Architect to enhance their SIEM capabilities within a large-scale hybrid security environment. The role involves strategic improvements, leading configuration efforts, and collaborating with security teams to bolster cyber threat detection and response capabilities. Ideal candidates will have strong experience with Splunk SaaS and a background in cyber security operations.

Qualifications

• Strong experience in Splunk SaaS as a lead engineer and/or architect.
• Deep understanding of SIEM Engineering & Architecture in CSOC environments.
• Demonstrated experience leading end-to-end SIEM improvement initiatives.

Responsibilities

• Produce and maintain architecture diagrams and design documentation.
• Lead configuration of Splunk and associated infrastructure.
• Drive use case development aligned with CSOC and MITRE ATT&CK framework.

Skills

Splunk SaaS

Cyber Security Operations Centre (CSOC)

AWS Infrastructure

MITRE ATT&CK Framework

SOAR Integration

Education

Splunk SOAR Administrator

Splunk Certified Cybersecurity Defence Analyst

Cloud Security Architecture (CSA)

Tools

JIRA

Confluence

Git

Job description

Social network you want to login/join with:

We are seeking an experienced Splunk Engineer / Security Architect to lead strategic and tactical improvements to the SIEM and associated components across a large-scale hybrid security environment.

Key skills required for this role

Splunk SaaS SIEM Architecture Cyber Security Operations Centre (CSOC) AWS Infrastructure MITRE ATT&CK Framework SOAR Integration

Important

Splunk SaaS SIEM Architecture Cyber Security Operations Centre (CSOC) AWS Infrastructure MITRE ATT&CK Framework SOAR Integration

Splunk Engineer / Security Architect
Location: Hybrid - Remote with up to 2 days/week in
Contract Duration: 9 months (192 working days)
Active SC clearance required

Role Overview

We are seeking an experienced Splunk Engineer / Security Architect to lead strategic and tactical improvements to the SIEM and associated components across a large-scale hybrid security environment. You'll play a pivotal role in enhancing monitoring capabilities, driving SIEM convergence, and supporting the maturity of security operations.

This role is aligned to a national programme improving the government's ability to detect and respond to cyber threats across multiple portfolios. You'll work alongside the SIEM Product Owner and CSOC teams to define and deliver architectural and engineering enhancements using Splunk SaaS and related technologies.

Key Responsibilities

• Produce and maintain architecture diagrams, high- and low-level design documentation
• Lead configuration of Splunk and associated infrastructure (AWS EC2, S3, SQS, etc.)
• Drive use case development aligned with CSOC and MITRE ATT&CK framework
• Attend and represent the project at key technical forums (ADF, TDA, workshops)
• Deliver improvements to SIEM architecture, use cases, automation, and data enrichment
• Improve onboarding processes for directorates and manage onboarding QA
• Lead integration of SOAR, Attack Analyzer, and other tooling into operational use
• Standardise collection tier components using Infrastructure as Code (IaC) where possible
• Strong experience in Splunk SaaS as a lead engineer and/or architect
• Deep understanding of SIEM Engineering & Architecture, particularly in CSOC environments
• Demonstrated experience leading end-to-end SIEM improvement initiatives
• Proven ability to define and implement change within complex cyber environments
• Excellent documentation, communication, and stakeholder engagement skills
• Experience with SIEM convergence from legacy platforms
• Familiarity with tools such as JIRA, Confluence, Git
• Background in Ethical Hacking, IDAM, PKI, or broader information security disciplines
• A team-oriented, adaptable mindset with a problem-solving approach

Required Qualifications

• Splunk SOAR Administrator
• Splunk Certified Cybersecurity Defence Analyst
• Cloud Security Architecture (CSA)

Desirable Certifications

• Certified Information Systems Security Professional (CISSP)
• Ethical Hacking & Intrusion Prevention
• Information Security Management Systems (ISMS)
• Identity Access & Management (IDAM)

manages this role

Matchtech is a STEM Recruitment Specialist, with over 40 years’ experience