SOC Engineer - DV cleared

CBSbutler Holdings Limited; Hemel Hempstead; On-site; GBP 92,000 - 129,000; Full time

Job summary

CBSbutler Holdings Limited seeks a DV-cleared SOC Engineer to lead the design, implementation and optimisation of security monitoring platforms feeding into a central SOC in Hemel Hempstead. The role is onsite five days a week and focuses on building scalable SIEM solutions while remaining hands-on.

Responsibilities include deploying Elastic and Splunk tools, building log ingestion pipelines, and tuning detection rules, with strong emphasis on collaboration and risk-aware security improvements.

Qualifications

• Proven leadership in Security Engineering and client-facing environments.
• Strong hands-on expertise with Elastic Stack and Splunk (Enterprise/ES).
• Advanced knowledge of SIEM operations and detection engineering.
• Experience with large-scale data ingestion, enrichment, and pipeline design.
• Familiarity with automation tools, SOAR, Terraform/Ansible, and CI/CD.
• Excellent communication and stakeholder management skills.

Responsibilities

• Lead design and deployment of security monitoring tools (Elastic & Splunk)
• Build and optimise large-scale log ingestion pipelines and data models (ECS/CIM)
• Develop and tune detection rules using KQL, EQL, and SPL
• Drive detection engineering lifecycle aligned to MITRE ATT&CK
• Implement automation, CI/CD, and Infrastructure as Code for SIEM platforms
• Ensure platform performance, scalability, and resilience (HA/DR, clustering)
• Collaborate with stakeholders to assess risk and deliver security improvements

Skills

Security engineering leadership

Elastic Stack expertise

Splunk expertise

SIEM operations

Detection engineering

Log ingestion pipelines

Automation & CI/CD

SOAR

Terraform

Ansible

Tools

Elastic Stack

Splunk

Terraform

Ansible

CI/CD tooling

Job description

SOC Engineer (DV Cleared) Hemel Hempstead - 5 days onsite £500-£700 per day Inside IR35

We're seeking a DV-cleared Managing Security Engineer to lead the design, implementation, and optimisation of security monitoring platforms feeding into a central SOC. This is a hands‑on leadership role focused on building scalable SIEM solutions and strengthening client security posture.

This is a great opportunity to play a key role in delivering high-impact cybersecurity solutions while remaining technically hands‑on.

Key Responsibilities

• Lead design and deployment of security monitoring tools (Elastic & Splunk)
• Build and optimise large‑scale log ingestion pipelines and data models (ECS/CIM)
• Develop and tune detection rules using KQL, EQL, and SPL
• Drive detection engineering lifecycle aligned to MITRE ATT&CK
• Implement automation, CI/CD, and Infrastructure as Code for SIEM platforms
• Ensure platform performance, scalability, and resilience (HA/DR, clustering)
• Collaborate with stakeholders to assess risk and deliver security improvements

Essential Skills & Experience

• Proven leadership in Security Engineering and client‑facing environments
• Strong hands‑on expertise with Elastic Stack and Splunk (Enterprise/ES)
• Advanced knowledge of SIEM operations, detection engineering, and RBA
• Experience with large‑scale data ingestion, enrichment, and pipeline design
• Familiarity with automation tools, SOAR, Terraform/Ansible, and CI/CD
• Excellent communication, stakeholder management, and problem‑solving skills