Security Engineer (Tooling & SIEM)

NP Group; Greater London; Remote; GBP 83,000 - 120,000; Full time

Job summary

NP Group is seeking a Security Engineer to join a client programme on a 6-month contract, with an ASAP start and UK remote work, some international travel. The role spans security tooling (endpoint, Zscaler and identity) and SIEM/logging (Microsoft Sentinel and Cribl).

You will own configuration, onboarding and day-to-day engineering across both areas. Hands-on experience with endpoint tooling, Zscaler, identity platforms and Cribl/Sentinel is required, plus the ability to integrate tools with a

Qualifications

• HANDS-ON experience with endpoint security tooling, Zscaler and identity platforms in a production enterprise environment.
• HANDS-ON experience with Microsoft Sentinel and Cribl, including onboarding and managing log sources.
• Ability to integrate security tools with a SIEM and troubleshoot data flow issues.
• Ability to work independently and deliver without close supervision.
• Strong communication skills, with the ability to explain technical issues clearly to the client.
• Relevant vendor or Microsoft security certification (e.g. SC-200, Zscaler, Cribl), though hands-on experience is the priority.
• Experience with KQL and with scripting or automation.
• Experience in a regulated or large enterprise environment.
• Familiarity with formal change governance, including change approval boards and maintenance windows.

Responsibilities

• Deploy, configure and tune endpoint security tooling, including policy management and agent rollout.
• Configure and manage Zscaler services, including policy, access controls and traffic steering.
• Implement and support identity tooling, including authentication policy, conditional access and privileged access controls.
• Build and maintain Microsoft Sentinel, including workspace configuration, data connectors and analytics rules.
• Design and manage Cribl pipelines for routing, filtering, enrichment and reduction of log data.
• Onboard new log sources, including those from the endpoint, Zscaler and identity tools, and make sure data is parsed, normalised and fit for detection.
• Tune detections and manage data volume and cost without losing security visibility.
• Troubleshoot issues across the tooling and logging estate and resolve them with minimal disruption to users.
• Work with the client's security, infrastructure and operations teams, and keep stakeholders informed of progress.
• Produce clear technical documentation, including designs, configuration standards, log source inventories and handover notes.
• Operate within the client's change governance, including change approval and maintenance windows.
• Hands-on engineering experience with tooling & SIEM in a production enterprise environment.

Skills

Endpoint security

SIEM integration

Data flow troubleshooting

Clear communication

Automation scripting

Change governance

Tools

Zscaler

Microsoft Sentinel

Cribl

KQL

Job description

Contract: Security Engineer (Tooling & SIEM)
Start: ASAP (on completion of background checks)
Duration: 6 Months
Rate: Negotiable outside of IR35
Location: UK remote - some international travel
Reference: 20916
We are looking for a Security Engineer to support a client programme. The role spans security tooling (endpoint, Zscaler and identity) and SIEM and logging (Microsoft Sentinel and Cribl). You will be hands-on, owning configuration, onboarding and day-to-day engineering across both areas.
The two areas are closely linked. Good detection depends on reliable telemetry, and the tooling needs to feed the SIEM cleanly.
You will be the engineer who connects them.

Key Responsibilities

• Deploy, configure and tune endpoint security tooling, including policy management and agent rollout.
• Configure and manage Zscaler services, including policy, access controls and traffic steering.
• Implement and support identity tooling, including authentication policy, conditional access and privileged access controls.
• Build and maintain Microsoft Sentinel, including workspace configuration, data connectors and analytics rules.
• Design and manage Cribl pipelines for routing, filtering, enrichment and reduction of log data.
• Onboard new log sources, including those from the endpoint, Zscaler and identity tools, and make sure data is parsed, normalised and fit for detection.
• Tune detections and manage data volume and cost without losing security visibility.
• Troubleshoot issues across the tooling and logging estate and resolve them with minimal disruption to users.
• Work with the client's security, infrastructure and operations teams, and keep stakeholders informed of progress.
• Produce clear technical documentation, including designs, configuration standards, log source inventories and handover notes.
• Operate within the client's change governance, including change approval and maintenance windows.
• Security Engineer (Tooling & SIEM) - Role Profile
• Hands-on experience with endpoint security tooling, Zscaler and identity platforms in a production enterprise environment.
• Hands-on experience with Microsoft Sentinel and Cribl, including onboarding and managing log sources.
• Ability to integrate security tools with a SIEM and troubleshoot data flow issues.
• Ability to work independently and deliver without close supervision.
• Strong communication skills, with the ability to explain technical issues clearly to the client.
• Relevant vendor or Microsoft security certification (e.g. SC-200, Zscaler, Cribl), though hands-on experience is the priority.
• Experience with KQL and with scripting or automation.
• Experience in a regulated or large enterprise environment.
• Familiarity with formal change governance, including change approval boards and maintenance windows.