Security Operations Engineer

Cantor Fitzgerald; City of Westminster; On-site; GBP 60,000 - 80,000; Full time

Job summary

A leading investment firm in the City of Westminster seeks a Cybersecurity Specialist to monitor and respond to security incidents. Candidates should possess a Bachelor's degree in Cybersecurity and at least five years of experience in Security Operations. Responsibilities include developing detection rules, conducting threat hunting, and ensuring compliance across systems. The ideal applicant will have proficiency in cloud platforms and SIEM tools. This role is pivotal for enhancing the organization's security posture.

Qualifications

• Minimum five years of experience in Security Operations.
• At least three years of Linux Administration experience.
• At least two years of Cloud (AWS or Azure) Administration experience.

Responsibilities

• Monitor, analyze, and respond to security events and incidents.
• Develop and maintain detection rules, playbooks, and automation scripts.
• Perform threat hunting and forensic investigations.
• Collaborate with teams on secure configurations and compliance.
• Maintain endpoint protection and intrusion detection/prevention systems.

Skills

Linux and Windows OS

DNS

Certificate Management: Digicert, AppViewX

Ticket management solutions: Dynamics 365, ServiceNow

PMO tools such as Jira, Smartsheet

SIEM and SOAR technologies (Splunk, Cribl, Azure Sentinel)

EDR/Microsoft Defender for Endpoint

AWS and Azure (IAM, IaaS, PaaS)

KQL queries in Sentinel/SPL in Splunk

Network packet analysis tools (Wireshark, TCPDump)

Collaboration and communication skills

Education

Bachelor's Degree in MIS, CIS, Cybersecurity or similar

Job description

Responsibilities

• Monitor, analyze, and respond to security events and incidents using SIEM and other security tools.
• Develop and maintain detection rules, playbooks, and automation scripts to improve incident response efficiency.
• Perform threat hunting and forensic investigations across IT environment.
• Collaborate with infrastructure and application teams to ensure secure configurations and compliance.
• Maintain and improve endpoint protection, intrusion detection/prevention systems.
• Document incident response procedures and contribute to post incident reviews.
• Create network diagrams and as built documents.
• Develop and maintain a strong partnership with relevant global businesses and technical leaders and teams, including 3rd parties and affiliate businesses.

Qualifications

• Bachelor's Degree in MIS, CIS, Cybersecurity or similar.
• At least five years of Security Operations.
• At least three years of Linux Administration.
• At least two years of Cloud (AWS or Azure) Administration.

Must Have Skills

• Linux and Windows OS.
• DNS.
• Certificate Management: Digicert, AppViewX.
• Experience with ticket management solutions: Dynamics 365, ServiceNow, Remedy, etc.
• Experience with PMO tools such as Jira, Smartsheet, etc.
• SIEM and SOAR technologies (Splunk, Cribl, Azure Sentinel).
• Configure and troubleshoot EDR/ Microsoft Defender for Endpoint, vulnerability management, and threat detection systems, with focus on Linux OS.
• Azure Security Center and Office 365 Compliance Portal.
• AWS and Azure (IAM, IaaS, PaaS).
• Knowledge in KQL queries in Sentinel and/or SPL in Splunk for developing use cases, dashboards, custom rules, custom parsers.
• Intermediate understanding of services and protocols commonly used in hosting environments: web servers, database servers, active directory protocols.
• Understanding of network packet analysis using tools such as Wireshark and TCPDump.
• Collaboration and communication skills across multiple teams and businesses.

Good to Have Skills

• Relevant certifications such as AWS Security Specialty, CISA, CISM, GIAC, Security+, or CISSP.
• Palo Alto Cortex suite of tools.
• Network technologies: switching, routing, wireless.
• PowerShell and Python Scripting.
• Power BI and Power Automate.
• Integrating security systems via API, etc.