Senior Cyber Security Engineer: SIEM, SOAR & EDR

Thames Water Utilities Limited; Reading; On-site; GBP 65,000 - 78,000; Full time

Benefits offered by this job

Competitive salary

26 days annual leave

Pension scheme (generous)

Health and wellbeing benefits

Cycle to Work scheme

Job summary

Thames Water Utilities Limited seeks a Senior Cyber Security Engineer to design, implement, and maintain security controls across IT and OT. You will enable early threat detection and rapid response, translating cyber risk and regulatory demands into practical controls.

The role is hands-on, requiring delivery of resilient security capabilities, platform integration, and continuous improvement through lessons learned from incidents and risk assessments.

Qualifications

• Experience in security engineering focused on detection and response.
• Strong IT and OT systems understanding.
• Experience identifying and remediating cyber risks in evolving environments.
• Familiarity with SIEM, EDR, email security and IAM (e.g. Entra ID, CyberArk).
• Knowledge of SaaS, IaaS, end-user computing, and server estates.

Responsibilities

• Design, implement and maintain security controls meeting compliance and risk requirements.
• Integrate SIEM health alerts and log ingestion improvements.
• Manage use cases, data enrichment and automated containment workflows.
• Develop operational procedures and reporting methodologies.
• Oversee security platforms (SIEM, SOAR, EDR, email security).
• Coordinate remediation for control gaps and align with baselines across IT/OT.

Skills

Security engineering

Detection & response

SIEM

EDR

IAM

Cloud security

Network security

Stakeholder communication

Security architecture

Education

Bachelor's degree in Cyber Security / related field

Industry certification (CISSP, CCSP, CompTIA Security+, SC-200)

Tools

SOAR

CyberArk

Entra ID

Tenable

Job description

Thames Water Utilities Limited seeks a Senior Cyber Security Engineer to design, implement, and maintain security controls across IT and OT. You will enable early threat detection and rapid response, translating cyber risk and regulatory demands into practical controls.

The role is hands-on, requiring delivery of resilient security capabilities, platform integration, and continuous improvement through lessons learned from incidents and risk assessments.