SOC Platform Engineer (AI, Wazuh, Graylog and Linux)
This is a security engineering job without an alert queue. First and second line analysis in our Security Operations Centre is carried out by Emily, our AI analyst, who has been in production since 2018. You will run the platform she depends on and take the cases she cannot close herself, which are the awkward and interesting ones.
You will work directly with our Head of Threat Disruption, who built the platform, has thirty years in the field and wants you to be able to do everything he can do. Your first year is a structured training year. We do not expect you to know Wazuh, our estate or Emily on your first day. We expect you to be curious, careful and hard to fool, and by the end of the year we expect you to run the platform and handle Emily's escalations without needing to ask.
What you will do
You will operate a multi-tenant Wazuh estate and the Graylog and OpenSearch logging tier behind it, on hardened Ubuntu hosts in our own data centre and in the cloud. You will write and tune decoders and detection rules, map them to MITRE ATT&CK, and bring new client log sources on board, from endpoint agents and firewalls to cloud tenants and Microsoft Sentinel.
You will investigate what Emily escalates, close what you can and hand over what you cannot with a clear account of your findings. When something breaks you will find out why, properly, and write it up so that it stays fixed. You will speak to clients directly by telephone, on Teams and in chat, walking their IT staff through an installation or explaining in plain language what an alert means.
Over time you will take ownership of parts of the platform, of the monitoring that watches it, and of our Cyber Essentials Plus and Defence Cyber Certification work.
What you need
You need strong, practical Linux administration on Ubuntu or a comparable distribution, including systemd, networking, storage and TLS, and you should be at home in the shell all day. You need enough Bash and Python/PHP/Pearl to automate operational tasks safely, and confidence with regular expressions. You should understand how a log travels from its source to a searchable index.
You should diagnose methodically under pressure, verify rather than assume, and be able to write a clear summary in plain English afterwards. You should be able to take direct technical challenge without taking it personally and give it back with the same honesty. You should build things hardened by default. You must be comfortable with clients, including when the news is unwelcome.
You must have the right to work in the United Kingdom without sponsorship and be willing to undergo background checks to BPSS level.
Useful, and we will teach it if you lack it
Experience of Wazuh, Elastic, OpenSearch, Graylog, Splunk or Security Onion in production is welcome, as is familiarity with HAProxy, Nagios or Zabbix, Microsoft Sentinel, MySQL and PHP, and time spent at a managed service provider. Certifications and involvement in the security community are of interest to us, but neither is required.
Out of hours
Out of hours, Emily keeps watching, and she needs a human about once or twice a month. Cover is shared equally across the team, which today means alternate weeks with the Head of Threat Disruption, and you join the rota only once you have been trained and have shadowed it. You receive an allowance for each week you cover, and any time you work is paid on top. If you are called out at night, you start late the next day.
The arrangement
The role is permanent, full-time at 40 hours a week and fully remote within the United Kingdom, working UK office hours. We provide the equipment you need. Holiday entitlement is 25 days per year plus up to 10 days per year for conference attendance.