Security Engineer – SIEM/SOAR, Build Threat Defenses

Gravitas Recruitment Group (Global) Ltd; Greater London; On-site; GBP 51,000 - 85,000; Full time

Job summary

Gravitas Recruitment Group (Global) Ltd in London is seeking a Cyber Security Engineer to strengthen the security technology stack, including SIEM, EDR and SOAR for a leading financial services client.

You will own detection use cases, threat hunting queries, automation, and threat modelling, working closely with the SOC and infrastructure teams to drive security improvements and evaluate new tools.

Qualifications

• 3+ years in security engineering, security automation or a similar cyber role.
• Hands-on SIEM and EDR experience, ideally Microsoft Sentinel.
• Strong query language skills plus PowerShell or Python scripting.
• Good knowledge of Active Directory security, networking and cloud (Azure, GCP, AWS).
• Familiarity with MITRE ATT&CK, NIST or similar frameworks.
• Certifications such as AZ-500, SC-200 or Security+.

Responsibilities

• SIEM engineering, including log onboarding and parsing, analytics rules, workbooks and playbooks.
• Detection use cases and threat hunting queries driven by current threat intelligence.
• SOAR and automation for detection, configuration drift monitoring and remediation.
• Threat modelling and security control advice on new projects.
• Close partnership with the SOC and infrastructure teams, plus evaluating new security tools.

Skills

Security engineering

Security automation

PowerShell

Python scripting

Active Directory security

Cloud security (Azure/GCP/AWS)

MITRE ATT&CK

NIST

Security certifications (AZ-500, SC-2

Tools

Microsoft Sentinel

Job description

Gravitas Recruitment Group (Global) Ltd in London is seeking a Cyber Security Engineer to strengthen the security technology stack, including SIEM, EDR and SOAR for a leading financial services client.

You will own detection use cases, threat hunting queries, automation, and threat modelling, working closely with the SOC and infrastructure teams to drive security improvements and evaluate new tools.