Cyber Security Engineer

Responsibilities

Lead end-to-end cyber incident response, from triage and containment to eradication, recovery and post-incident review, with minimal supervision.

Translate MITRE ATT&CK techniques into high-fidelity, actionable detection rules, and tune them to reduce false positives.

Build and maintain detection content using YARA and Sigma.

Investigate and analyse sophisticated threats: phishing campaigns, malicious domains, malware samples and actively exploited vulnerabilities.

Use Tanium EDR for endpoint investigation, threat hunting and remediation.

Use Elastic/Kibana (SIEM) for log analysis, correlation, dashboards and alerting.

Automate security workflows and response playbooks with Python or PowerShell.

Document findings and communicate clearly with technical teams and stakeholders during and after incidents.

Qualifications

Required Skills

3-6 years experience leading real-world incident response, not only supporting it.

Deep, hands-on expertise with Tanium EDR and Elastic/Kibana (SIEM).

Strong command of detection engineering: MITRE ATT&CK, Sigma, YARA.

Practical malware, phishing and domain analysis skills.

Scripting and automation in Python and/or PowerShell.

Strong analytical mindset, composure under pressure, and clear written and spoken English.

Preferred Skills

Experience in financial services or another regulated environment.

Relevant certifications (e.g. GCIH, GCFA, GCTI, GREM, OSCP or equivalent).

Familiarity with SOAR platforms and threat intelligence tooling.

Reverse engineering or threat hunting experience.