Cyber Defence & Reporting Engineer

SUMMARY:
🚨 Cyber Defence & Reporting Engineer

Are you passionate about defending organisations against evolving cyber threats?
Our client in the FMCG industry is  looking for a hands‑on Cyber Defence & Reporting Engineer to strengthen their security monitoring ecosystem and ensure timely visibility into risks across identity, endpoint, network, and cloud platforms.

POSITION INFO:
PLEASE NOTE THAT NO CV'S WILL BE KEPT FOR FUTURE USE. ONLY APPLY IF YOU QUALIFY IN FULL.

🔍 What You’ll Do

• Monitor and analyse security events and alerts across endpoint, network, identity, and application security platforms.
• Operate and tune SIEM and security monitoring tools, including use‑case development, correlation rules, and alert optimisation.
• Develop and maintain Microsoft Defender detections and use cases (including custom detections/analytics rules where applicable) to strengthen coverage across identity, endpoint, and cloud telemetry.
• Work closely with the outsourced SOC to validate alerts, manage escalations, and improve detection accuracy.
• Perform initial investigation and triage of security incidents, supporting containment and remediation activities led by Security Operations.
• Conduct threat analysis and pattern identification, identifying trends, emerging risks, and gaps in detection coverage.
• Support threat‑hunting activities using available telemetry and intelligence sources.
• Maintain security defence platforms used for detection and early warning (e.g., network detection and response and deception technologies), ensuring operational health, tuning, and meaningful alerting.
• Facilitate cyber forensics investigations by coordinating evidence collection, timelines, and handover to internal/external forensic providers; maintain investigation structure and evidence readiness.
• Plan, arrange and run purple team exercises with the SOC and relevant technology teams, ensuring clear scenarios, measurable outcomes, and documented detection/response improvements.
• Create and maintain run books / playbooks jointly with the SOC, aligning response actions to business requirements for predefined threat scenarios (e.g., containment approach, escalation paths, decision points, and communications).
• Drive incident automation and operational efficiency improvements (alert enrichment, ticketing workflows, response orchestration opportunities, and repeatable investigation patterns).
• Maintain and produce security operations reporting, including incident metrics, SOC performance data, and executive dashboards.
• Track and report on security posture, trends, and key risk indicators, translating technical findings into actionable insights.
• Support post‑incident reviews and root cause analysis, contributing detection and monitoring improvements.
• Maintain accurate monitoring documentation, including use‑cases, dashboards, and alert logic.
• Support security audits and compliance activities by providing monitoring evidence and incident records.

• 3–7 years’ experience in cyber defence, SOC, or security monitoring.
• Strong analytical mindset with attention to detail.
• Solid understanding of attack techniques, threat vectors, and detection methodologies.
• Hands‑on experience with SIEM platforms, alert analysis, and incident triage.
• Ability to communicate technical findings clearly to both technical and non‑technical audiences.
• Calm, decisive approach in high‑pressure incident scenarios.
• Collaborative spirit to work closely with SOC, Endpoint, Firewall, and Infrastructure teams.

🎓 Qualifications & Certifications

• Relevant IT or Information Security qualification (Diploma or Degree preferred).
• Cyber Defence / Monitoring certifications (advantageous).
• SIEM or SOC‑focused certifications.
• Vendor‑neutral security certifications (e.g., Security+ or equivalent).