Security Engineer

Hamilton Barnes ?; Cardiff; Hybrid; GBP 38,000 - 52,000; Full time

Job summary

Hamilton Barnes is seeking a Security Engineer to join a growing Security Operations function. This hands-on role focuses on the Microsoft Defender XDR and Sentinel stack, delivering incident response and security improvements across client environments.

You will design and optimise security controls, develop detections with KQL, and automate using Azure Logic Apps and Functions. Remote with occasional Cardiff office attendance is supported.

Qualifications

• Extensive Security Engineering or Senior Security Analysis experience.
• Strong KQL and Advanced Hunting knowledge.
• Experience with vulnerability scanning and risk analysis.
• Strong client-facing communication skills to non-technical stakeholders.
• Hands-on exposure to the Microsoft Security ecosystem.

Responsibilities

• Design, implement and optimise security controls.
• Develop detection capabilities using KQL and Advanced Hunting.
• Build and maintain Microsoft Sentinel analytical rules.
• Deploy and manage Content Hub solutions.
• Tune Defender policies and security configurations.
• Lead vulnerability scanning activities and analyze results.
• Produce structured security reports for clients.
• Handle escalated Incident Response investigations.
• Automate processes using Azure Logic Apps and Azure Functions.

Skills

Security engineering

Incident response

KQL / Advanced Hunting

Client-facing communication

Automation scripting

Azure/M365 security

Tools

Microsoft Defender XDR

Microsoft Sentinel

KQL

Azure Logic Apps

Azure Functions

Content Hub

Job description

Security Engineer | £45,000 | Remote (occasional Cardiff office)

We are looking for a Security Engineer to join a growing Security Operations function, supporting a range of clients and helping them strengthen their overall cyber security posture. This is a hands‑on role focused heavily on the Microsoft Security stack, particularly Microsoft Defender XDR and Microsoft Sentinel. You\'ll work across security engineering, detection development, vulnerability management, incident response and Microsoft 365 security, while also engaging directly with clients.

This is not a traditional SOC Analyst position. The focus is on Security Engineering and escalated Incident Response, with significant scope to improve security controls, detection capabilities and automation across client environments.

Why this role stands out:

• Technical ownership — work hands‑on with Microsoft Defender XDR, Sentinel, KQL and Advanced Hunting
• Variety — work across security engineering, detection, vulnerability management, incident response and Microsoft 365 security
• Client exposure — work directly with clients, presenting findings and helping them implement meaningful security improvements

• Design, implement and optimise security controls
• Develop detection capabilities using KQL and Advanced Hunting
• Build and maintain Microsoft Sentinel analytical rules
• Deploy and manage Content Hub solutions
• Tune Microsoft Defender and wider threat policies
• Manage phishing simulation campaigns
• Lead vulnerability scanning activities and analyse results and associated risks
• Produce structured security reports and present technical findings to clients and stakeholders
• Support client remediation and security improvement activities
• Handle escalated Incident Response investigations and support advanced investigations from the triage team
• Develop and improve Incident Response playbooks
• Automate processes using Azure Logic Apps and work with Azure Functions and codeless playbooks where appropriate
• Audit and uplift Microsoft 365 security environments, improving Secure Score and security controls
• Manage Defender policies, device tagging, and support Exchange security configuration and hardening
• Identify opportunities for scripting and automation
• Extensive Security Engineering or Senior Security Analysis experience
• Strong KQL and Advanced Hunting knowledge
• Experience with vulnerability scanning and risk analysis
• Strong understanding of security protocols and industry standards
• Experience with Microsoft 365 security environments
• Strong client-facing communication skills, able to convey technical findings to non-technical stakeholders
• Experience producing professional security reports
• Understanding of Incident Response processes and escalations
• Primarily remote working, with occasional Cardiff office attendance
• Hands‑on exposure to the Microsoft Security ecosystem
• Significant client-facing technical responsibility
• Opportunity to develop automation and scripting capabilities
• Exposure to Azure and Microsoft 365 security technologies
• Support for professional development and relevant security certifications