Security Engineer

Space NK Limited; City of Westminster; Hybrid; GBP 60,000 - 95,000; Full time

Job summary

Space NK Limited is seeking a hands-on Security Engineer to protect our cloud and on‑premises estate. You will work across Azure, Defender, Sentinel and Entra ID, collaborating with Security, Infrastructure and Network teams to investigate security events, remediate vulnerabilities and improve security posture.

We value a practical security foundation and a willingness to develop deeper expertise in cloud security, threat detection and automation.

Qualifications

• 2–5 years of relevant security, infrastructure or cloud engineering experience.
• Hands-on with Microsoft security technologies or equivalent platforms.
• Understanding of Azure, Microsoft 365 and Entra ID security concepts.
• Experience investigating security alerts and suspicious activity.
• Knowledge of endpoint security, EDR/XDR and risk-based prioritisation.

Responsibilities

• Administer and support security controls across Azure, Microsoft 365 and on‑premises infrastructure.
• Monitor security alerts with Sentinel and Defender XDR; tune rules and dashboards.
• Investigate incidents, contain and remediate with cross‑team collaboration.
• Support vulnerability management, posture improvement and Zero Trust implementation.
• Work with SOC/MSSP to coordinate actions and investigations.
• Document incidents, findings and post‑incident reviews.

Skills

Cyber security

Security incident handling

Threat hunting

Documentation

Collaboration

Education

Bachelor's or equivalent in Cyber Security / CS

Microsoft SC-200, SC-900, AZ-900, Security+

CompTIA CySA+ or equivalent

Tools

Microsoft Defender XDR

Microsoft Sentinel

Azure Security

Entra ID

PowerShell

KQL

Azure CLI

Logic Apps

Microsoft Graph API

Job description

Space NK operates a hybrid technology environment spanning Microsoft Azure, Microsoft 365, corporate infrastructure, distribution environments and a nationwide retail estate. The Security Engineer helps protect, monitor and continually improve security across our cloud and on-premises estate. This is a hands-on engineering role for someone with a sound foundation in cyber security and Microsoft technologies who wants to build deeper capability across Azure security, Microsoft Defender, Sentinel, identity security, vulnerability management and incident response. Working within Platform Engineering, you will collaborate with Cyber Security, Infrastructure, Cloud, Network, Application, Service and Operations teams to investigate security events, implement agreed controls, remediate vulnerabilities and support security improvement and transformation initiatives. The role offers clear scope to develop expertise in cloud security, threat detection, security automation and incident response, with increasing technical ownership as your experience grows.

Key Responsibilities Cloud & Infrastructure Security

• Administer and support security controls across Microsoft Azure, Microsoft 365 and on-premises infrastructure.
• Support the implementation and maintenance of Microsoft Defender for Cloud, including security recommendations, posture management and workload protection.
• Assist with security controls across Azure services including Key Vault, Azure Firewall, Private Link, Network Security Groups and Azure Policy.
• Review cloud security configurations and identify misconfigurations, excessive permissions and potential security weaknesses.
• Support the implementation of security baselines, hardening standards and Zero Trust principles across cloud and on-premises environments.
• Work with Infrastructure, Network and Cloud teams to remediate identified security risks.
• Support security reviews for new and existing infrastructure services.

Security Monitoring & Threat Detection

• Monitor and investigate security alerts using Microsoft Sentinel, Microsoft Defender XDR and associated security platforms.
• Analyse security events across identity, endpoint, server, network and cloud environments.
• Investigate suspicious activity and determine the scope, impact and appropriate next actions.
• Review logs and telemetry from Entra ID, Azure, Microsoft 365, endpoints, firewalls and other infrastructure platforms.
• Support the development and tuning of Sentinel analytics rules, alerts, dashboards and detection logic.
• Perform proactive security analysis and threat-hunting activities using available security telemetry.
• Work directly with our SOC/MSSP and security partners to investigate alerts and coordinate technical actions.

Incident Response

• Investigate security incidents and support containment, remediation and recovery activities.
• Gather and analyse relevant logs, endpoint information, identity activity and other technical evidence.
• Carry out approved containment actions such as isolating endpoints, disabling accounts, revoking sessions or blocking malicious indicators.
• Work with Cyber Security, Infrastructure, Network and Application teams during incident investigation and remediation.
• Escalate high-risk or complex incidents appropriately while maintaining ownership of assigned investigative activities.
• Document incidents, technical findings, actions and lessons learned.
• Contribute to post-incident reviews and implementation of corrective actions.

Endpoint, Identity & Infrastructure Security

• Support security controls across Windows endpoints, servers and cloud workloads using Microsoft Defender technologies.
• Investigate endpoint alerts, suspicious processes, malware and other potentially malicious activity.
• Work with the Identity team on security issues involving Entra ID, Conditional Access, MFA, privileged accounts and risky users.
• Support the review and remediation of inappropriate or excessive permissions.
• Assist with server and endpoint hardening in accordance with agreed security baselines.
• Support the identification and reduction of legacy or insecure protocols, configurations and services.
• Work with the Network team on security events involving firewalls, VPNs, segmentation and suspicious network traffic.

Vulnerability & Security Posture Management

• Review vulnerability and security posture information across cloud, endpoint, server and infrastructure environments.
• Assess vulnerabilities based on severity, exposure and potential business impact.
• Work with technical teams to coordinate and track remediation activities.
• Validate remediation and help identify recurring security weaknesses.
• Support vulnerability scanning and remediation programmes.
• Monitor Microsoft Secure Score, Defender for Cloud recommendations and other security posture indicators.
• Contribute to continuous improvement of Space NK's security posture.

Governance, Compliance & Security Improvement

• Apply Zero Trust, least privilege and secure-by-default principles to day-to-day security engineering.
• Implement and maintain agreed security controls and technical standards.
• Support security requirements relating to PCI DSS, SOX, GDPR, ISO 27001 and other applicable frameworks.
• Assist with audit evidence gathering, control validation and remediation activities.
• Maintain security documentation, procedures and technical records.
• Participate in change management and security reviews for infrastructure and cloud changes.
• Contribute to security improvement projects and initiatives across the organisation.

Automation & Continuous Improvement

• Identify opportunities to automate repetitive security activities and operational processes.
• Use PowerShell and other scripting technologies to support security administration and investigation.
• Develop skills across Microsoft Graph API, KQL, Azure CLI, Logic Apps and security automation.
• Support the development of Sentinel automation rules and playbooks.
• Contribute to improving security monitoring, detection and response processes.
• Maintain scripts and automation in a documented, controlled and repeatable manner.

We're looking for someone with a strong technical security foundation and the potential to develop further, rather than an established Security Architect or subject matter expert.

You should have experience in several of the following areas:

• Hands-on experience in a Cyber Security, Security Operations, Infrastructure Security or related technical role.
• Practical experience with Microsoft security technologies or equivalent enterprise security platforms.
• Understanding of Microsoft Azure, Microsoft 365 and Entra ID security concepts.
• Experience investigating security alerts and suspicious activity.
• Understanding of endpoint security, malware protection and EDR/XDR technologies.
• Familiarity with SIEM technologies, log analysis and security monitoring.
• Understanding of vulnerability management and remediation processes.
• Good knowledge of fundamental security concepts including least privilege, MFA, network segmentation, encryption and Zero Trust.
• Understanding of common security threats and attack techniques such as phishing, credential compromise, malware and privilege escalation.
• Good troubleshooting and analytical skills.
• Ability to independently investigate routine security incidents and recognise when escalation is required.
• Good technical documentation and communication skills.

We don't expect candidates to be experts across every security technology. We're looking for strong technical foundations and someone keen to develop deeper expertise across Microsoft cloud and hybrid security.

Desirable Experience

• Microsoft Sentinel and Kusto Query Language (KQL).
• Microsoft Defender XDR, Defender for Endpoint or Defender for Identity.
• Microsoft Defender for Cloud and Cloud Security Posture Management.
• Entra ID security, including Conditional Access, Identity Protection and PIM.
• Azure security technologies including Key Vault, Azure Firewall and Azure Policy.
• Vulnerability management and security posture assessment.
• Incident response and threat hunting.
• Security automation using PowerShell, Microsoft Graph, Logic Apps or APIs.
• Network security and firewall technologies.
• Exposure to AWS security services such as GuardDuty, Security Hub, IAM or CloudTrail.
• Experience working with an external SOC, MSSP or security service provider.
• Exposure to PCI DSS, SOX, GDPR, ISO 27001, CIS or NIST environments.

Qualifications & Certifications

A degree in Cyber Security, Computer Science, Information Technology or a related discipline is advantageous but not essential where equivalent practical experience can be demonstrated. We would typically expect approximately 2-5 years of relevant security, infrastructure or cloud engineering experience, although technical capability, attitude and potential are more important than a specific number of years.

• Microsoft Security Operations Analyst Associate (SC-200), Microsoft Security, Compliance and Identity Fundamentals (SC-900)
• Microsoft Azure Fundamentals (AZ-900)
• CompTIA Security+
• CompTIA CySA+ or equivalent

Candidates actively working towards relevant security or Microsoft certifications are also encouraged to apply.

Skills & Attributes

• Strong interest in cyber security, cloud technologies and threat detection.
• Logical and methodical approach to security investigation and troubleshooting.
• Able to take responsibility for assigned incidents and technical work while recognising when escalation is required.
• Comfortable analysing technical evidence and working through an investigation to resolution.
• Good written and verbal communication skills.
• Collaborative approach when working with Cyber Security, Infrastructure, Cloud, Network, Applications and Service teams.
• Comfortable working directly with SOC/MSSP and technology partners when required.
• Willingness to learn new technologies and continually develop security knowledge.
• Good understanding of change control, documentation and production environments.
• Proactive approach to automation, security improvement and continuous learning.

Development & Progression

This role provides the opportunity to develop deeper capability across Microsoft Sentinel, Defender XDR, Defender for Cloud, Azure security, threat hunting, incident response, vulnerability management and security automation. As technical capability and experience grow, the engineer will take increasing responsibility for complex security investigations, technical solutions and project delivery, providing a natural development path towards a Senior Security Engineer - Cloud & On-Premises (Hybrid Security) role.

As the ultimate curator of over 100 of the most in-demand, highly innovative and boundary-pushing beauty brands, we are the go-to destination for worldwide beauty discovery. Together through our neighbourhood stores, online presence and loyalty scheme, Space NK has built a flourishing community in which to discover beauty. The customer is at the heart of everything we do, and we will always endeavour to offer everything they need to help them explore, experiment, and enjoy our brands.