SIEM Engineer at Sopra Steria

Dacorum, England, United Kingdom -

Full Time

Start Date

Immediate

Expiry Date

29 Aug, 26

Salary

0.0

Posted On

31 May, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Splunk Enterprise, Splunk ES, Elastic Security, SIEM Engineering, MITRE ATT&CK, SPL, KQL, EQL, Terraform, Ansible, CI/CD, SOAR, Infrastructure as Code, Data Pipeline Engineering, Log Ingestion, Security Detection Tuning

Industry

IT Services and IT Consulting

Description

We are looking for a Managing Security Engineer to lead the design, implementation and documentation of enterprise security monitoring platforms. This is a key technical leadership role, responsible for ensuring the right tooling, controls and processes are in place to help protect and monitor our clients’ environments. This opportunity is ideally suited to someone with strong hands-on experience deploying and managing Splunk at enterprise scale. In return, the role offers the chance to broaden your capability and gain deeper experience in Elastic Security, with support to build your expertise further. You will work closely with cross-functional teams to assess risk, design effective security controls and define testing requirements. As a senior technical leader, you will champion security by design, promote engineering excellence and act as a trusted advisor to clients, helping them understand their security challenges and implement practical, effective solutions to strengthen their security posture. This is an excellent opportunity to deepen your hands-on cybersecurity expertise while making a meaningful impact across both client and organisational security. This role is permanent and requires full-time, on-site working in Hemel Hempstead. The successful candidate may also participate in an out-of-hours call-out rota. What you will be doing: Lead the deployment, management and optimisation of Splunk Enterprise and Splunk ES platforms in large, complex environments. Support and develop capability in Elastic Stack / Elastic Security, with training and upskilling provided as needed. Design, implement and maintain data pipelines, including log ingestion, enrichment and schema standardisation. Develop and tune security detection content, translating threat intelligence and TTPs aligned to MITRE ATT&CK into actionable, high-value alerts. Manage the full detection content lifecycle: design, test, deploy, monitor, tune and retire, using version control and rollback processes. Automate workflows and platform configurations using CI/CD, SOAR, scripting and Infrastructure as Code tools such as Terraform and Ansible. Ensure platform performance, stability and resilience through capacity planning, high availability, disaster recovery and proactive monitoring. Provide technical leadership and guidance to internal teams and clients on security monitoring strategy and best practice. What you will bring: Proven experience deploying and managing Splunk at enterprise scale, including Splunk Enterprise and Splunk ES. Strong hands-on knowledge of SIEM engineering, including indexing, parsing, onboarding and performance tuning. Experience designing and optimising detection content, including MITRE ATT&CK-aligned use cases and alert tuning to reduce noise. Good understanding of data pipeline engineering, log enrichment, data quality and large-scale ingestion architectures. Strong knowledge of SPL; experience with KQL and EQL would be beneficial, but is not essential. Experience with automation and Infrastructure-as-Code within security monitoring or SIEM environments. Solid understanding of SIEM platform operations, including clustering, scaling, high availability, disaster recovery and performance optimisation. Strong problem-solving skills and a proactive approach to improving security operations. An interest in developing expertise in Elastic Security, with support and training available as part of the role. If you are interested in this role but not sure if your skills and experience are exactly what we’re looking for, please do apply, we’d love to hear from you! Security Clearance Level: Live DV clearance. Referral Bonus: £1500 Salary offered will be in line with experience and development needs Loved reading about this job and want to know more about ADS? Sopra Steria’s Aerospace, Defence and Security business designs, develops and deploys digital solutions to Central Government clients. The work we do makes a real difference to the client’s goal of National Security, and we operate in a unique and privileged environment. We are given time for professional development activities, and we coach and mentor our colleagues, sharing knowledge and learning from each other. We foster a culture in which employees feel valued and supported and have pride in their work for the customer, delivering outstanding rates of customer satisfaction in the UK’s most complex safety- and security-critical markets.

Responsibilities

Lead the design, implementation, and optimization of enterprise security monitoring platforms, specifically Splunk and Elastic Security. Develop security detection content aligned with MITRE ATT&CK and automate workflows using CI/CD and Infrastructure as Code tools.