Security Engineer: Incident Response, IAM & Compliance

Penningtons Manches Cooper LLP; Greater London; Sur place; GBP 65 000 - 90 000; Plein temps

Résumé du poste

Penningtons Manches Cooper LLP is seeking a Security Engineer to protect the organisation by monitoring the SIEM and security tools, coordinating with the external SOC, and leading incident response. You will own vulnerability management, patch governance, and alignment with Cyber Essentials and ISO 27001.

The role also covers IAM, Entra ID, and AI governance considerations. The ideal candidate has 2–3 years in security operations, hands-on SIEM and Defender experience, and a collaborative,

Qualifications

• Hands-on experience with SIEM platforms (Microsoft Sentinel, Splunk, or equivalent).
• Practical experience with Defender products (Defender for Endpoint, Defender for Cloud Apps, Defender for Identity).
• Vulnerability management experience: scanning, triage, remediation tracking.
• Identity & access management knowledge: Entra ID / Azure AD, conditional access, PIM, access reviews.
• Incident response experience: containment, investigation, remediation in real environments.
• Minimum 2–3 years in a security operations or cyber security role.
• Experience responding to real security incidents.
• Experience with vulnerability management in an enterprise environment.
• Track record of working with IAM systems in governance or operations.

Responsabilités

• Monitor the SIEM platform and security tooling daily - triaging alerts, investigating anomalies, and escalating confirmed threats.
• Act as the named internal interface to the external SOC - receiving escalations via the on-call rota, making incident response decisions, and providing the SOC with updated detection requirements.
• Lead incident response for confirmed security events - coordinating containment, remediation, and recovery.
• Own and manage Defender for Endpoint / XDR and Defender for Cloud Apps - maintaining configuration, reviewing alerts, and tuning detection policies.
• Manage SIEM rule sets - adding new detection use cases, tuning existing rules, and reviewing rule coverage.
• Own and operate the vulnerability management programme - running regular scanning, triaging findings, and tracking remediation to SLA.
• Manage patching governance oversight - ensuring the organisation's patch management process is followed and exceptions are documented.
• Maintain alignment with compliance frameworks - Cyber Essentials, ISO 27001, or equivalent.
• Own Purview Compliance - maintaining audit log policies, eDiscovery configuration, and retention policies.
• Own the organisation's Identity & Access Management discipline - including Entra ID, Privileged Identity Management (PIM), and access governance.
• Monitor the joiner/mover/leaver (JML) process - ensuring accounts are provisioned, modified, and deprovisioned accurately and on time.
• Run and manage access reviews and access certification cycles - enforcing least privilege.
• Manage privileged accounts - ensuring all privileged access is logged, reviewed, and time-bound where possible.
• Review new AI tool requests from a security risk perspective - assessing data handling, access scoping, and prompt injection risk.
• Ensure AI tools approved for use are correctly scoped and monitored; feed AI-related security findings into the risk register.

Connaissances

SIEM platforms

Defender products

Vulnerability management

Identity & Access Management

Incident response

Security operations

IAM governance

Security certifications

Description du poste

Penningtons Manches Cooper LLP is seeking a Security Engineer to protect the organisation by monitoring the SIEM and security tools, coordinating with the external SOC, and leading incident response. You will own vulnerability management, patch governance, and alignment with Cyber Essentials and ISO 27001.

The role also covers IAM, Entra ID, and AI governance considerations. The ideal candidate has 2–3 years in security operations, hands-on SIEM and Defender experience, and a collaborative,