Security Engineer

develop; Greater London; Hybrid; GBP 77,000 - 94,000; Full time

Benefits offered by this job

Remote 1-3x/month in London

Benefits

Job summary

develop is seeking a Microsoft Security Engineer to strengthen client security postures across identity, endpoint and cloud environments. This hands-on role combines architecture work with advisory guidance and close collaboration with customers.

You will implement detection logic with KQL, automate with PowerShell and Python, and work with SIEM tooling and threat hunting practices. The position offers a remote-friendly setup with quarterly London office presence.

Qualifications

• Strong experience across the Microsoft security ecosystem.
• Proven ability to write and tune detection logic (KQL) for threat hunting.
• Customer-facing communication and advisory capabilities.
• Hands-on design and implementation of security architectures.
• Automation experience with PowerShell, Python, and APIs.

Responsibilities

• Design and implement modern security architectures across on-prem and cloud environments.
• Collaborate with customers, engineers, and security teams to deliver security improvements.
• Develop detection logic and run threat-hunting activities using SIEM tools.

Job description

Security Engineer – Perm – Up to £85,000 + benefits

• Must already hold or be eligible for SC level security clearance
• Remote - 1 - 3 x a month in London office

An established organisation is seeking a Microsoft Security Engineer to help shape and enhance the security posture of the environments it supports. This role operates at the intersection of deep technical expertise, advisory ownership, and real-world security impact.

The successful candidate will work closely with customers, engineers, and operational security teams to deliver meaningful improvements across identity, detection engineering, endpoint security, and cloud security posture. This is a hands‑on role involving the design and implementation of modern security architectures, solving complex technical challenges, and acting as a trusted technical partner.

Technology Environment

Microsoft Security Stack:

• Microsoft Sentinel

Experience with alternative modern security platforms such as SentinelOne or CrowdStrike is advantageous.

• Exposure to AWS or GCP (desirable)

Platforms & Infrastructure:

• Active Directory / Entra hybrid identity
• Windows Server and Linux

Tooling & Automation:

• KQL
• PowerShell
• API integrations
• Automation tooling

Required Experience

• Strong, demonstrable experience across the Microsoft security ecosystem.
• Solid understanding of identity and endpoint security fundamentals.
• Proven experience writing and tuning detection logic (e.g., KQL) for detection engineering and threat hunting scenarios.
• Excellent communication and customer-facing skills
• Ability to work autonomously, solve complex problems, and deliver high-quality technical solutions.
• Automation experience (PowerShell, Python, API integrations) and/or systems administration background.
• Familiarity with security frameworks and incident response methodologies.
• Experience working with logging pipelines (e.g., AMA, Syslog, Cribl, SIEM tooling).
• Exposure to non-Microsoft security platforms such as CrowdStrike, SentinelOne, or Tenable.
• Experience producing architecture documents, diagrams, and technical design proposals.
• Background in an MSSP, consultancy, or customer‑facing engineering environment.

What the Role Offers

• Ownership of technical direction across engagements with the ability to influence customer security posture.
• A blend of architecture, engineering, advisory, and hands‑on implementation work.
• Exposure to a diverse range of environments, threat models, and operational challenges.