Senior IT Security Engineer

Airswift; Manchester; On-site; GBP 75,000 - 110,000; Full time

Benefits offered by this job

Career progression

World-class training

Work-life balance

Charity days

Job summary

Airswift is seeking a hands-on Senior IT Security Engineer to deliver security engineering across the Microsoft stack, including Defender XDR, Sentinel and Purview. You will own data protection, immutable backups, incident response and governance for an AI/Copilot platform, guiding controls across tenants and agents.

You will work with IT Operations, Cloud, and AI engineering teams to implement security as code, run recovery drills, and continuously improve Secure Score and posture.

Qualifications

• Hands-on production experience with Microsoft Defender XDR, Sentinel and Purview.
• Proficient in KQL for detections, hunting and dashboards.
• Strong knowledge of UK GDPR principles and data protection practices.

Responsibilities

• Own Microsoft security stack: configure, tune, operate Defender XDR and Purview.
• Build and maintain Sentinel analytics and automated playbooks to scale detection.
• Lead incident response triage, containment and recovery with Service Desk integration.
• Design and maintain retention, DLP and data-protection controls for Copilot/agent layer.
• Operate immutable backups and recovery tests with documented RPO/RTO.
• Provide monthly risk and control-health updates to technology leadership.

Skills

Defender XDR

Sentinel

Purview

KQL

PowerShell

Entra ID

M365

Backup immutability

GDPR knowledge

Incident response

Tools

Microsoft Defender XDR

Microsoft Sentinel

Microsoft Purview

Job description

Role Description

We are looking for a hands‑on Senior IT Security Engineer who thrives on getting stuck in and working alongside the team to deliver what the business actually needs. This is a delivery‑focused security engineering role across the full Microsoft stack – building and running controls in Microsoft Defender, Sentinel and Purview, automating operations wherever possible, and cutting through the noise to keep our protection sharp and relevant.

You will take ownership of data sovereignty and protection, immutable backups and recovery, Right to be Forgotten requests, and streamlined incident response with the Service Desk. As our AI and Copilot platform scales, you will be the engineering owner of the security and data‑protection controls that keep agents, connectors and tenant data safe. This is a role for someone who prefers building over managing and wants to make a real impact across the estate.

Principle Accountabilities:

Microsoft security stack ownership

• Configure, tune and operate Microsoft Defender XDR across endpoints, identity, email, SaaS and cloud, and administer Microsoft Purview for information protection, DLP, records management and eDiscovery.
• Build and maintain Microsoft Sentinel analytics, hunting queries and automated response playbooks (Logic Apps and PowerShell) so that detection and response scale without manual effort.

Threat detection and incident response

• Lead triage, containment, eradication and recovery for security incidents, integrated with the Service Desk, and hunt for threats using KQL with custom detections and dashboards that track control effectiveness.

Data protection, retention and AI platform safety

• Design and maintain M365 retention, sensitivity and DLP controls – extended to the Copilot and agent layer – to keep tenant data, connectors and grounding sources protected.
• Own the Right to be Forgotten process under UK GDPR (discovery, validation, deletion, reporting and audit evidence), partnering with Legal and Data Protection on defensible retention and data‑subject requests.

Backups, immutability and recovery

• Operate immutable backup policies, vault locks and archive tiers for M365 and Azure workloads, and run restore tests and recovery drills with documented RPO/RTO.

Posture, risk and awareness

• Improve Secure Score and Defender posture through prioritised remediation, and provide concise monthly risk and control‑health updates to technology leadership.
• Track the CVEs, threat intelligence and trends that genuinely matter to the business, and feed real‑world gaps into training, knowledge articles and how‑to guides.

Ways of working

• Work closely with IT Operations, the Cloud and AI engineering team and the Service Desk to land changes safely, treating configuration as code and keeping it version‑controlled.

Skills, Knowledge, and Experience:

• Strong hands‑on, production experience with Microsoft Sentinel, Defender XDR and Microsoft Purview.
• Proficiency in Kusto Query Language (KQL) for detections, threat hunting and dashboards.
• Solid Microsoft Entra ID experience, including conditional access and identity protection.
• Practical Purview experience: DLP, sensitivity labels, records management and eDiscovery.
• Proven work with immutable backups and archive storage for M365 and Azure, with documented recovery testing.
• Incident‑response capability: triage, containment, forensics basics, evidence handling and clear write‑ups.
• Scripting with PowerShell; experience with Logic Apps and the Microsoft Graph API is an advantage.
• A working understanding of UK GDPR principles and their application to retention and Right to be Forgotten.
• A clear communicator who writes concise runbooks and can brief stakeholders.
• Infrastructure as Code for security content and configuration (for example Bicep or Terraform).
• Experience handling Subject Rights Requests, and familiarity with CIS Benchmarks, ISO 27001 controls and NCSC guidance.
• Exposure to EDR, email security and CASB controls within Defender, and to phishing simulation and awareness tooling.
• Awareness of the security and governance considerations of AI agents and Copilot (data exposure, prompt/grounding risks).

Certifications (advantageous, not required)

• Microsoft SC-200, SC-100, SC-400 or AZ-500; a privacy certification such as CIPT.

What we can offer you!

• Attractive monthly base salary + competitive commission/performance bonus.
• Genuine career progression opportunities, either locally or globally!
• World‑class training programmes and development opportunities.
• Team driven environment, supportive culture with a focus on work‑life balance.
• Career breaks available after one year.
• Real time recognition through our employee reward platform.
• Mental Health First Aiders to signpost you to support when you need it.
• Yearly destination trips as part of our High Flyers program (Dubai, Buenos Aires, etc…)
• Charity days for various important causes such as Relay for Life and Earth Day.

Our Core Values:

• Growth - In life and business, one must grow to flourish and achieve high ambitions. Growthrequires change, challenge, risk and sacrifice - we will always choose growth.
• Life – Above all else, we value life. The quality of life, both in and outside of work, profoundly influences our well‑being and our impact on the world.
• Excellence - We deliver, holding ourselves accountable for results. Our customers see excellence in everything we do.
• Integrity - We are ethical, open, honest and authentic. People trust us to do the right thing for the right reason.

Disclaimer

Disclaimer

The above statements are intended to describe the general nature and level of work being performed by people assigned to this classification. They are not to be construed as an exhaustive list of all responsibilities, duties, and skills required of personnel so classified. All personnel may be required to perform duties outside of their normal responsibilities from time to time, as needed.

Diversity & Inclusion

At Airswift, we believe that diversity is critical to our success and makes us a great place to work. We are committed to building an equal opportunity workplace, the more inclusive we are - the better our work will be.

Please click here to view our privacy policy.