Senior Cyber Security Engineer

About us

Our client is a well-established and highly regarded specialty insurance group with a strong reputation for technical excellence, innovation, and underwriting expertise. Operating across a diverse range of insurance and reinsurance products, the business combines entrepreneurial thinking with a collaborative culture, providing employees with the opportunity to work alongside experienced industry professionals in a fast-paced and dynamic environment. With a focus on delivering outstanding solutions to clients and brokers globally, the organisation offers exceptional opportunities for professional development and career growth.

The role

The Senior Cyber Security Engineer will strengthen the organisation's hands-on security engineering capability during a period of significant security maturity uplift. The role focuses on operationalising the deployed security tooling estate, executing the security remediation backlog, and producing control evidence to an audit-ready standard. The Senior Cyber Security Engineer will work closely with the Head of Cyber Security, infrastructure and IT operations teams, the outsourced SOC provider and third-party delivery partners to ensure security platforms deliver managed, measurable and evidenced protection aligned with regulatory expectations and recognised frameworks.

Key accountabilities

Security Platform Operationalisation:

• Operationalise and tune the deployed security tooling estate, including CrowdStrike Falcon (EDR and Next-Gen SIEM), Wiz CSPM (Azure and AWS), Mimecast and the Microsoft security stack, moving platforms from deployed to fully managed through detection rule tuning, alert configuration, log source onboarding and compliance policy enablement.
• Triage and disposition security alerts across SIEM and EDR platforms, reducing alert backlog and improving detection fidelity through systematic investigation, rule refinement and false positive tuning.
• Support the implementation and tuning of identity and access controls, including Conditional Access policies, break-glass procedures, privileged access management and identity hygiene remediation such as shared account rationalisation, credential rotation and dormant privileged account deactivation.

Vulnerability Management and Remediation:

• Execute the security remediation backlog, prioritising and remediating vulnerabilities hands-on and coordinating remediation activities with infrastructure and IT operations teams through agreed change processes.
• Support patching governance and remediation tracking, ensuring critical findings are addressed within defined SLAs, and progress is evidenced for monthly reporting.
• Deliver secure configuration and compliance reporting across the estate, supporting a measurable uplift in security maturity against NIST CSF.

Security Operations and Incident Response:

• Act as the second cyber escalation point within the 24/7 security operating model, providing technical investigation, containment and response as part of the cyber on-call rota and supporting post-incident reviews.
• Onboard and manage the day-to-day relationship with the outsourced SOC/MDR provider, establishing operational handover processes and driving improvement in detection and response performance (MTTD/MTTR).
• Provide security input to change and architecture governance (CAB/ARB) and produce engineering documentation, runbooks and control evidence to an audit-ready standard.

Skills & experience

• Extensive hands-on experience of security engineering, security operations and tactical security remediation delivery in live enterprise environments.
• Strong hands-on experience with CrowdStrike Falcon, including console management, detection rule creation and tuning, host investigation and response actions.
• Experience operationalising SIEM, EDR/XDR and vulnerability management platforms (for example CrowdStrike Next-Gen SIEM, Microsoft Sentinel or Microsoft Defender), including detection tuning, alert management and vulnerability scanning and reporting.
• Microsoft security stack experience across Entra ID, Active Directory and Group Policy, Defender and Microsoft 365, with email security (Mimecast or equivalent). Exposure to Microsoft Purview is desirable.
• Cloud security experience across Azure and AWS, including cloud security posture management (Wiz or equivalent).
• Demonstrable delivery of security maturity uplift against recognised frameworks such as NIST CSF and CIS Benchmarks, evidenced through measurable posture improvement.
• Experience onboarding or managing an outsourced SOC or managed security service, including operational handover and improvement of detection and response performance.
• Incident response experience, including out-of-hours working, with an evidence-focused working style and documentation that stands up to internal audit and external assurance.
• Experience in regulated financial services; insurance or Lloyd's market experience and DORA awareness are desirable. Relevant certifications (such as ISC2 or Microsoft security and compliance certifications) are desirable.