Senior Security Engineering Consultant

Stott and May Inc.; England; Hybrid; GBP 70,000 - 80,000; Full time

Job summary

Stott and May Inc. is seeking a Senior Security Engineering Consultant to lead detection and response design for SIEM, XDR, and SOAR. You will craft detections, automations, and playbooks, aligning with MITRE ATT&CK and working directly with clients to improve visibility and maturity.

The role is hybrid in the UK, with main activity remote and occasional visits to the Hampshire/South East office for team and business needs. Strong scripting, cloud security, and consulting skills are essential.

Qualifications

• Senior level role focused on detection and response across SIEM, XDR, and SOAR.
• Design and deliver detection rules, automations, and playbooks.
• Customer-facing consultancy and strong technical communication.
• MITRE ATT&CK-aligned use case design and log-source mapping.

Responsibilities

• Build and tune SIEM/XDR detections using KQL and related languages.
• Map and normalise log sources, assess coverage, close gaps.
• Create SOAR automations and incident playbooks for SOC teams.
• Turn threat intel into stronger detections and automations.
• Own detection-as-code pipelines and use case development.
• Advise customers, run workshops, and deliver strategies and catalogs.

Skills

Hands-on SIEM detection engineering

SOAR automation and playbooks

Python, PowerShell scripting

MITRE ATT&CK-aligned use cases

XDR/EDR experience with vendor tools

Azure cloud security telemetry

Customer-facing consultancy skills

Tools

Microsoft Sentinel

Logic Apps

Cortex XSOAR

PowerShell

Job description

Senior Security Engineering Consultant – SOC, SIEM, XDR, SOAR, KQL, Microsoft - £70,000 - £80,000 – Hampshire (hybrid)

We are partnered with a fast-paced fast growing MSSP and they have a key requirement. You will lead the design and delivery of detection and response capabilities across SIEM, XDR, and SOAR. In this senior, customer-facing Professional Services role, you'll build detection rules, develop automations, and create playbooks that SOC teams can put to work.

You will own the detection-as-code approach, making detections and automations consistent, scalable, and repeatable. Work directly with customers to define detection strategies, design MITRE ATT&CK-aligned use cases, and close gaps in visibility, coverage, and response maturity. Partner with onboarding and engineering teams as the detection and automation specialist—not the platform deployment lead.

This is a hybrid role, you will be mainly remote, however clients visits and occasional visits to the Hampshire office for specific team and business reasons will be expected.

Key Skills

• Hands-on SIEM detection engineering and KQL or similar query languages; Microsoft Sentinel preferred.


• SOAR automation and playbook delivery using Logic Apps, Cortex XSOAR, or similar.


• Python, PowerShell, or similar scripting, plus API-driven automation and integration.


• MITRE ATT&CK-aligned use case design, coverage assessment, and log-source mapping to the attack lifecycle.


• XDR/EDR experience: Microsoft Defender, CrowdStrike, Cortex, or SentinelOne; hands-on NDR knowledge, such as Vectra AI or Corelight.


• Cloud security telemetry, particularly Azure; threat intelligence integration and awareness of AI-driven SOC tools.


• Customer-facing consultancy skills and clear technical communication.

Duties & Responsibilities

• Build and tune SIEM/XDR detections using KQL or equivalent languages, aligned to MITRE ATT&CK and real-world threats.


• Map and normalise log sources, assess coverage, and close telemetry, logging, and enrichment gaps.


• Build SOAR automations, integrations, response workflows, and documented incident playbooks for SOC teams.


• Turn threat intelligence and operational lessons into stronger detections and automations.


• Own detection-as-code pipelines, structured use case development, and versioning.


• Advise customers, lead workshops, and deliver clear detection strategies, use case catalogues, and recommendations for all stakeholders.


• Partner with onboarding, engineering, and SOC teams to integrate practical, operationally aligned content.


• Evolve reusable content, delivery standards, and automation patterns through lab testing and validation.

Senior Security Engineering Consultant – SOC, SIEM, XDR, SOAR, KQL, Microsoft - £70,000 - £80,000 – Surrey (hybrid)