Security Engineer - SC Cleared

Sanderson Government & Defence; City Of London; Hybrid; GBP 105,000 - 125,000; Full time

Benefits offered by this job

Outside IR35

Hybrid working

London onsite 1 day per month

Job summary

Sanderson Government & Defence is seeking an experienced Security Engineer to join a high-profile cyber security programme in London. The role spans SOC operations, SIEM engineering, and cloud-based data engineering, delivering large-scale security monitoring and cloud-native solutions.

The candidate will design, optimise, and maintain telemetry pipelines, work with AWS security services, and develop detection logic for improved alert quality.

Qualifications

• Experience in Security/SOC/SIEM or Detection Engineering roles.
• Hands-on with AWS security services and cloud monitoring.
• Proven Splunk detection rules development and SPL queries.
• Experience with security data pipelines and log management.
• Knowledge of S3, SQS, Kinesis, and cloud logging architectures.
• Understanding Zero Trust and identity-centric security.
• Excellent communication and stakeholder management.

Responsibilities

• Design, optimise, and maintain security telemetry pipelines for SOC operations.
• Work with cloud-native technologies and SIEM platforms.
• Improve visibility and detection capabilities across complex environments.
• Support ingestion pipelines and resolve performance issues.
• Develop and tune SIEM detection logic and use cases.
• Collaborate with SOC analysts to reduce false positives.
• Implement secure data handling practices and access controls.
• Optimise data storage and tiering in cloud environments.

Skills

Security Engineering

SOC Engineering

SIEM Engineering

Detection Engineering

AWS Security

Splunk

Log Management

Data Pipelines

Cloud Logging

Zero Trust

Stakeholder Mgmt

Communication

Tools

Cribl

Splunk

S3

SQS

Kinesis

GuardDuty

CloudTrail

Job description

Security Engineer (SOC / Data Engineering)£450 per day | Outside IR35 | 9-Month Contract | Active SC Clearance RequiredLondon (1 day per month onsite)

A leading consultancy is seeking an experienced Security Engineer to join a high-profile cyber security programme supporting critical public sector environments. This role sits at the intersection of Security Operations, SIEM engineering, and cloud-based data engineering, offering the opportunity to work on large-scale security monitoring platforms and cloud-native security solutions.

The Role

As a Security Engineer, you will play a key role in designing, optimising, and maintaining security telemetry pipelines while supporting SOC operations and detection engineering activities. You'll work with cloud-native technologies, SIEM platforms, and security data tooling to improve visibility, detection capability, and operational resilience across complex environments.

Key Responsibilities

• Manage and optimise security log ingestion pipelines using Cribl and cloud-native technologies.
• Support the collection and processing of AWS security telemetry, including CloudTrail, VPC Flow Logs, GuardDuty, EKS audit logs, and IAM activity.
• Build and maintain security data models, field extractions, and data normalisation standards aligned to OCSF.
• Troubleshoot ingestion and pipeline performance issues across services such as SQS, S3, and Splunk.
• Develop and enhance SIEM detection logic and support the tuning of use cases to improve alert quality.
• Work closely with SOC analysts to improve detection coverage and reduce false positives.
• Help implement secure data handling practices, including encryption, access controls, and least-privilege principles.
• Contribute to the optimisation of security data storage and tiering strategies across cloud environments.

Skills & Experience Essential

• Strong experience within Security Engineering, SOC Engineering, SIEM Engineering, or Detection Engineering roles.
• Hands-on experience with AWS security services and cloud-native security monitoring.
• Proven experience developing and supporting Splunk detection rules and SPL queries.
• Experience with security data pipelines and log management technologies.
• Knowledge of S3, SQS, Kinesis, and cloud-based logging architectures.
• Understanding of security frameworks such as Zero Trust and identity-centric security models.
• Excellent communication and stakeholder management skills.

Desirable

• Experience with Cribl.
• Azure and/or Google Cloud Platform exposure.
• Knowledge of OCSF data schemas and security data normalisation.
• Previous experience working within UK Government or wider public sector environments.

What's on Offer

• £450 per day
• Outside IR35
• 9-month initial contract
• Hybrid working - only 1 day per month onsite in London

Reasonable Adjustments:

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.

If you need any help or adjustments during the recruitment process for any reason, please let us know when you apply or talk to the recruiters directly so we can support you.