Security Engineer - SOC & Cloud Data Pipelines (SC Clear)

Sanderson Government & Defence; City Of London; Hybrid; GBP 105,000 - 125,000; Full time

Benefits offered by this job

Outside IR35

Hybrid working

London onsite 1 day per month

Job summary

Sanderson Government & Defence is seeking an experienced Security Engineer to join a high-profile cyber security programme in London. The role spans SOC operations, SIEM engineering, and cloud-based data engineering, delivering large-scale security monitoring and cloud-native solutions.

The candidate will design, optimise, and maintain telemetry pipelines, work with AWS security services, and develop detection logic for improved alert quality.

Qualifications

• Experience in Security/SOC/SIEM or Detection Engineering roles.
• Hands-on with AWS security services and cloud monitoring.
• Proven Splunk detection rules development and SPL queries.
• Experience with security data pipelines and log management.
• Knowledge of S3, SQS, Kinesis, and cloud logging architectures.
• Understanding Zero Trust and identity-centric security.
• Excellent communication and stakeholder management.

Responsibilities

• Design, optimise, and maintain security telemetry pipelines for SOC operations.
• Work with cloud-native technologies and SIEM platforms.
• Improve visibility and detection capabilities across complex environments.
• Support ingestion pipelines and resolve performance issues.
• Develop and tune SIEM detection logic and use cases.
• Collaborate with SOC analysts to reduce false positives.
• Implement secure data handling practices and access controls.
• Optimise data storage and tiering in cloud environments.

Skills

Security Engineering

SOC Engineering

SIEM Engineering

Detection Engineering

AWS Security

Splunk

Log Management

Data Pipelines

Cloud Logging

Zero Trust

Stakeholder Mgmt

Communication

Tools

Cribl

Splunk

S3

SQS

Kinesis

GuardDuty

CloudTrail

Job description

Sanderson Government & Defence is seeking an experienced Security Engineer to join a high-profile cyber security programme in London. The role spans SOC operations, SIEM engineering, and cloud-based data engineering, delivering large-scale security monitoring and cloud-native solutions.

The candidate will design, optimise, and maintain telemetry pipelines, work with AWS security services, and develop detection logic for improved alert quality.