Senior Security Operations Engineer

Job Overview:

As the Senior Security Operations Engineer, you will own the hands-on security functions of the team implementing controls, closing findings, running detection and response, and producing the evidence our compliance programs depend on. The Security Manager sets the standards, you make them real, and show that they hold. You will work across endpoints, cloud, identity, applications and vendor security, ranging from alert triage through to control design by researching options and proposing designs or tooling.
Responsibilities:

The primary function is accountability for security outcomes in your domains being achieved and demonstrable. Where a control is claimed, you implement it, operate it, enforce its SLA, and evidence it. This role implements, operates, remediates and evidences. It also offers guidance and suggestions on proposing standards, policies, compliance frameworks and security tooling. As the team and the company scale, this role will grow to include additional related responsibilities.

Remediation and Closure
• Owns closure of security findings end to end: triage, prioritisation against the standard, driving the remediation cycle against existing findings with platform owners, and verifying closure. Closure, not detection, is the deliverable.
• Manages, reviews and drives outcomes against penetration tests, vulnerability and posture scans, audit gaps, access reviews, and CVEs across the estate.
• Security is an overlay onto other domains, so where security does not own the platform you own the finding and its closure while holding the platform owner (IT, DevOps, Engineering, etc) to executing the fix.

Functional Security
• Endpoint security direction and Tier 1 asset hardening.
• Vulnerability and application security scanning, and enforcement of its SLA.
• Cloud security posture management: stand up, then SLA enforcement.
• Data loss prevention: prevention and monitoring controls.
• Access control: least privilege, dual control, and other access validations.
• Network Security implementation at the cloud edge (alongside DevOps).

Detection and Response
• Operates managed detection and response end to end, including day to day interactions with the provider.
• First responder for security events, carrying triage through to closure.
• External phishing investigation and prevention.
• Selection, implementation, and operation of a SIEM (when approved).

Audit Evidence and Control Operation
• Produces and packages audit evidence for compliance frameworks (SOC 2 Type II, PCI DSS v4, etc) where automated collection cannot reach it.
• Runs the recurring access review cycles; mitigates, remediates, or otherwise drives corrections.
• Builds the controls that close audit gaps, and returns the evidence that shows they operate.

Tooling, Design and Automation
• Researches, vets and recommends security tooling; owns day to day use once approved.
• • Drafts solution designs for new controls; implements on approval.
• Supports security architecture reviews for new services and integrations.
• Builds and maintains automation to remove recurring manual work from role scope.

Also Supports
• Technical contact for the QSA, ASV and external auditor, including the quarterly external scan cycle.
• Security questionnaires (CAIQ, HECVAT, etc) answered from the evidence library, and upkeep of that library.
• Review of vendor security assessments.
• Security awareness training, including Internal phishing simulation campaigns and content recommended for approval.
Qualifications:

REQUIRED:

Experience: 5+ years full time in an in-house security role, with hands-on ownership of controls in one or more of the domains above, and a track record of driving findings to verified closure.

Technical Skills:
• Identity and access including least privilege, privileged access, conditional access, and running access reviews.
• Detection and response using an EDR, a SIEM or a managed provider, from triage through containment.
• Vulnerability management measured by closure rather than detection.
• Audit evidence production for SOC 2, ISO 27001, HITRUST, PCI or equivalent, as a deliverable rather than background knowledge.
• Endpoint management and hardening across macOS and Windows.
• Scripting in PowerShell, Python or Bash, with API integration.
• AI tooling Fluent use of major platforms as a daily driver.

OPTIONAL

• Cloud security posture management in Azure or AWS.
• Data loss prevention deployed and monitored (beyond policy writing).
• Network security implementation: segmentation, firewalls, VLANs and VPNs.
• Direct work with a PCI-DSS QSA, ASV or external auditor (as the technical contact).
• Comfortable presenting to all levels of the company (executives to junior colleagues)

Certifications: CISSP, CISM, GIAC (GSEC, GCIH, GCIA), CompTIA Security+ or CySA+, Microsoft SC-200 or AZ-500, AWS Certified Security Specialty.
Benefits:

• Full benefits package (Medical, Dental, Vision, Short-Term Disability, Life Insurance, 401(k) plan)
• Equity Appreciation Plan
• Flexible Time Off policy
• Seven (7) company-wide paid holidays + two (2) floating holidays
• Two (2) wellness days
• Employee Assistance Program
• Professional Development Stipend
• Home Office Stipend

Compensation:

The salary range for this role has been established at $120,000.00 - $130,000.00 annually. The final agreed-upon compensation is based on a number of factors, including but not limited to: individual education, qualifications, skills, prior work experience, competencies, and geographic work location. The above salary range represents the Company's good faith and reasonable estimate of the range of possible compensation at the time of posting.

Travel Requirements:

• Occasional business travel may be required, up to 10%.

Deadline for Applications:

• The company will accept ongoing applications until the role is filled. There is no deadline to apply for this position.