Lead Technical Engineer

• We are looking for a Lead Technical Engineer to lead high-level and low-level design work for Security Operations Centre solutions delivered to customers.
• We will expect you to lead technology designs using small teams.
• You will lead the design of a range of security and security-related solutions across high-level designs, low-level design, and deployment level designs, including specification of interfaces between solution components.
• You will support the design and configuration of security tools such as Splunk and Sentinel SIEM, Nessus vulnerability management, Microsoft XDR, Jira, Cribl Core, and other appropriate tools.
• You will specify infrastructure requirements such as RAM, disk, CPU, and network bandwidth for security tools.
• You will support the creation and establishment of cloud hosting and containers, as well as on-premises hosted VMs and containers, applying security controls and compliance frameworks.
• You will support the design and configuration of network security devices, network routers and switches, establishment of VLANs, DNS, and identity management capability.
• You will support deployment of security tools to cloud hosting and containers, as well as on-premises hosted VMs and containers.
• You will develop test procedures to verify that solutions meet functional and non-functional requirements.
• You will support creation and maintenance of requirements and user stories, ensuring they are tracked and traceable to solution components.
• You will oversee deployment and implementation activities, ensuring entry criteria are met, planned activities are completed, and rollback plans are initiated where required.
• You will review and approve required documentation as part of release or change activities, including design, deployment, configuration, and administration guides.
• You will act as a cyber technical specialist with knowledge of cyber monitoring technologies and cyber threat tools, tactics, techniques, and procedures.

Technologies:

• Active Directory
• Cloud
• ICT
• Support
• JIRA
• LAN
• LDAP
• Linux
• Network
• Security
• Splunk
• TCP/IP
• Windows
• DevOps, We are BAE Systems Digital Intelligence, home to 4,500 digital, cyber and intelligence experts working collaboratively across 10 countries to collect, connect and understand complex data so governments, nation states, armed forces and commercial businesses can unlock digital advantage in demanding environments. This Lead Technical Engineer role is based in Guildford or Frimley, with hybrid and flexible working arrangements available. We offer an inclusive culture that values diversity, integrity and merit, and we welcome candidates from all backgrounds, including groups under-represented in our industry. We also support reasonable adjustments in our recruitment process where needed. Our teams work hard and often go the extra mile, while recognising the importance of life outside work and offering opportunities to rotate to new projects.

• We are looking for a talented and enthusiastic individual with excellent technical and client-facing skills.
• You should have knowledge and experience of design, build, deployment and operation of SOC technology, including at least two of SIEM, SOAR, EDR, Vulnerability Management, and Threat Intelligence.
• You should have experience deploying and configuring applications in a performant manner on cloud and/or on-premises environments to support high data ingest rates.
• You should have proven delivery experience leading onboarding activities onto a SIEM.
• You should have knowledge of on-premises architectures and design, including security controls and detection tools.
• You should understand networking and secure network architectures.
• You should understand OSI and TCP/IP models.
• You should understand IP addressing, subnetting, and routing protocols.
• You should have knowledge of LAN/WAN configurations and network security, including ACLs and VLANs.
• You should have knowledge of compute services and storage services.
• You should understand security best practices, including least privilege and encryption.
• You should understand how to design scalable and resilient architectures.
• You should have experience with OS installation and administration, including Windows and Linux.
• You should understand cybersecurity fundamentals, including common threats such as malware, phishing, and DDoS, and their mitigation techniques.
• You should have proficiency in risk assessment and vulnerability management.
• You should have experience managing endpoint security solutions, including antivirus and EDR tools.
• You should have proficiency in user access control, including Active Directory and LDAP.
• You should be able to configure and maintain secure system policies, including server hardening.
• You should have understanding of typical Security Operations Organisation structures, policy, and processes.
• You should have good knowledge and experience of common Enterprise ICT services.
• You should have detailed understanding of threat intelligence, threat actors, TTPs, and operationalising threat intelligence.