Security Engineer

Sanderson Government & Defence; City Of London; Hybrid; GBP 15,683,000 - 20,295,000; Full time

Benefits offered by this job

£450 per day

Outside IR35

9-month contract

Hybrid: 1 day per month onsite in LDN

Job summary

Sanderson Government & Defence is seeking an experienced Security Engineer to join a high-profile cyber security programme within critical public sector environments. You will design, optimise, and maintain security telemetry pipelines while supporting SOC operations and detection engineering activities with cloud-native security tooling.

You will work with SIEM platforms and security data tooling to improve visibility, detection capability, and operational resilience across complex

Qualifications

• Proven experience in Security/SOC engineering or detection engineering.
• Hands-on with AWS security services and cloud-native monitoring.
• Experience building and maintaining Splunk detection rules and SPL queries.
• Experience with security data pipelines and log management.
• Knowledge of S3, SQS, Kinesis, and cloud-based logging architectures.
• Understanding of Zero Trust and identity-centric security models.
• Excellent communication and stakeholder management skills.

Responsibilities

• Manage and optimise security log ingestion pipelines using Cribl and cloud-native technologies.
• Support collection and processing of AWS security telemetry (CloudTrail, VPC Flow Logs, GuardDuty).
• Build and maintain security data models, field extractions, and data normalisation to OCSF.
• Troubleshoot ingestion and pipeline performance across SQS, S3, and Splunk.
• Develop and enhance SIEM detection logic and tune use cases to reduce false positives.
• Collaborate with SOC analysts to improve detection coverage.
• Help implement secure data handling practices including encryption and least-privilege.
• Contribute to optimisation of security data storage and tiering across clouds.

Skills

Security engineering

SOC engineering

SIEM engineering

Detection engineering

AWS security services

Cloud-native security

Splunk queries

Security data pipelines

Log management

Zero Trust

Stakeholder management

Tools

Splunk

Cribl

AWS

CloudTrail

S3

SQS

Kinesis

Job description

Security Engineer (SOC/SIEM)£450 per day | Outside IR35 | 9-Month ContractLondon (1 day per month onsite)

A leading consultancy is seeking an experienced Security Engineer to join a high-profile cyber security programme supporting critical public sector environments. This role sits at the intersection of Security Operations, SIEM engineering, and cloud-based data engineering, offering the opportunity to work on large-scale security monitoring platforms and cloud-native security solutions.

The Role

As a Security Engineer, you will play a key role in designing, optimising, and maintaining security telemetry pipelines while supporting SOC operations and detection engineering activities. You'll work with cloud-native technologies, SIEM platforms, and security data tooling to improve visibility, detection capability, and operational resilience across complex environments.

Key Responsibilities

• Manage and optimise security log ingestion pipelines using Cribl and cloud-native technologies.
• Support the collection and processing of AWS security telemetry, including CloudTrail, VPC Flow Logs, GuardDuty, EKS audit logs, and IAM activity.
• Build and maintain security data models, field extractions, and data normalisation standards aligned to OCSF.
• Troubleshoot ingestion and pipeline performance issues across services such as SQS, S3, and Splunk.
• Develop and enhance SIEM detection logic and support the tuning of use cases to improve alert quality.
• Work closely with SOC analysts to improve detection coverage and reduce false positives.
• Help implement secure data handling practices, including encryption, access controls, and least-privilege principles.
• Contribute to the optimisation of security data storage and tiering strategies across cloud environments.

Skills & ExperienceEssential

• Strong experience within Security Engineering, SOC Engineering, SIEM Engineering, or Detection Engineering roles.
• Hands-on experience with AWS security services and cloud-native security monitoring.
• Proven experience developing and supporting Splunk detection rules and SPL queries.
• Experience with security data pipelines and log management technologies.
• Knowledge of S3, SQS, Kinesis, and cloud-based logging architectures.
• Understanding of security frameworks such as Zero Trust and identity-centric security models.
• Excellent communication and stakeholder management skills.

Desirable

• Experience with Cribl.
• Azure and/or Google Cloud Platform exposure.
• Knowledge of OCSF data schemas and security data normalisation.
• Previous experience working within UK Government or wider public sector environments.

What's on Offer?

• £450 per day
• Outside IR35
• 9-month initial contract
• Hybrid working - only 1 day per month onsite in London
• Opportunity to work on large-scale cloud security and SOC transformation initiatives
• Collaborative environment with experienced cyber security professionals
• High-profile programme delivering security services that support critical public sector operations

Reasonable Adjustments:

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.