Cyber Operations Engineer

The Cyber Operations Engineer is responsible for the continuous improvement, governance, and operational effectiveness of the cybersecurity tooling, configurations, and control implementations, focused on strengthening cyber defences.

This role will have a strong emphasis on threat-led security operations, including proactive threat hunting, adversary simulations, and validating the effectiveness of security controls across the enterprise environment. 

Required Experience:

• 8+ years cybersecurity and/or IT industry experience, with at least 4 years hands-on experience in relevant roles (security operations, security engineering, infrastructure or cloud engineering)
• Demonstrable experience in threat hunting, detection engineering, purple teaming, or adversary simulation activities
• Demonstratable experience configuring, operating, and improving enterprise-scale security controls  
• Experience working in close partnership with SOC and IT operations teams
• Experience collaborating with incident response, threat intelligence, and/or red teams to identify and remediate security gaps
• Practical experience with cyber platforms such as CrowdStrike, Microsoft Purview, Palo Alto
• Relevant Cyber qualifications e.g. CISSP, GCIH, Cloud Security certs, Security+, or similar relevant qualifications
• Background in ethical hacking, penetration testing, or offensive security is highly desirable 
• This role is not entry‑level and assumes prior hands‑on experience configuring and tuning IT and/or security tooling across multiple cyber domains (network, cloud, endpoint, email, identity)
• Strong understanding of modern enterprise security controls and how they fail in practice
• Comfortable working with configuration management, change control, and operational governance processes

Key responsibilities & duties include:

• Maintain and continuously improve the configuration and effectiveness of cyber security tools and platforms across:
  • Email security controls
  • Endpoint and device security (EDR/MDR, hardening)
  • Data, Identity and Access Security Controls
  • Cloud security controls and native security services
  • Network security & Application security tooling (where applicable)
• Proactively perform threat hunting activities to identify malicious behaviour, control gaps, and detection blind spots across the environment 
• Design and execute adversary simulation or purple team exercises to test the effectiveness of existing security controls and monitoring capabilities 
• Collaborating with Threat Intelligence & Hunting team, Vulnerability team and Cyber Engineering & Architecture to:
  • Identify current tooling and/or control gaps and weaknesses
  • Recommend and implement configuration or policy improvements
  • Design and implement preventive and detective control improvements based on incident learnings
  • Translate threat intelligence and real-world attacker techniques into improved detection and prevention controls 
• Partner with the SOC to:
  • Improve detection coverage and fidelity
  • Reduce false positives and alert fatigue
  • Ensure controls align with real‑world attack techniques
  • Continuously validate and enhance detection logic based on emerging threats and adversary behaviours 
• Support governance and oversight of security tooling by:
  • Ensuring configurations align with approved standards and policies
  • Maintaining documentation of control intent and configuration rationale
• Work closely with Incident Response teams to identify gaps in detection and response, implement improvements across tooling and processes
• Support Cyber Engineering & Architecture with insights and contributions on cyber tooling selection, control design decisions and effectiveness of cyber platforms
• Contribute to the development and maintenance of security configuration standards, baseline cyber standards and operational runbooks
• Assist in the roll-out of new cyber tooling, to transition into operational and support management, with supporting third parties
• Support audits and assessments by providing evidence of control configurations and operational procedures

Desirable skills:

• Working knowledge of at least one scripting or programming language (e.g. Python, Bash, PowerShell)
• Familiarity with MITRE ATT&CK framework and modern attacker techniques
• Experience with threat hunting methodologies, SIEM/XDR detection engineering, and log analysis at scale 
• Hands-on experience with adversary simulation tools, red teaming frameworks, or attack emulation techniques 
• Experience working with outsourced providers