Cyber Security Engineer

Significant investment has gone into technology and data capability in recent years, including an in-house development function and a growing analytics team. Headcount continues to expand and a further office opens next year. As the organisation grows, so does the requirement to secure it properly.

This is a hands-on security engineering role reporting directly to the Head of Technology. It is not a policy or advisory position, and it is not one layer within a large security operations centre. A dedicated Cyber and Data Governance Lead is already in post and owns governance policy, which means your findings have somewhere to go and your recommendations get acted upon.

What you will be doing as a Cyber Security Engineer

You will own the technical security of the estate, working alongside IT operations, development and platform teams. Your remit will include:

• Reviewing and strengthening authentication, access and administrative privilege, promoting least privilege and zero trust principles

• Improving endpoint security, device compliance and secure configuration

• Assessing cloud services and hosted workloads for configuration weaknesses and excessive access

• Running and improving vulnerability and exposure management, coordinating remediation with system owners and verifying that fixes hold

• Investigating security alerts and incidents and maintaining practical response procedures

• Reviewing the security of third-party applications, integrations and data sharing arrangements

• Producing clear reporting on risk, incidents and remediation progress, and supporting audits and customer assurance requests

As the new second office is established you will extend security coverage to that site, giving you the opportunity to shape how security works across a growing multi-site estate rather than inheriting one already built.

At least five years in cyber security, infrastructure security, cloud security or a closely related technical role, gained within a regulated commercial environment such as financial services, insurance, lending, wealth management or professional services.

You will bring practical experience of securing enterprise identity and collaboration services, a working understanding of identity and access management, multifactor authentication, conditional access and privileged access, and experience securing Windows endpoints through a modern device management platform. You will have used endpoint detection and response or comparable technologies, and will have assessed, prioritised and driven the remediation of vulnerabilities in a live environment. Working knowledge of public cloud security is essential, covering identity, networking, logging, data protection and secure configuration.

Just as important is how you work. This role involves a good deal of influencing and persistent, constructive chasing of people who do not report to you. You will need to distinguish genuine risk from technical noise, recommend improvements that are proportionate and achievable, and explain security matters clearly to colleagues who are not technical.

Relevant certifications and experience of frameworks such as ISO 27001, Cyber Essentials, the National Institute of Standards and Technology Cyber Security Framework or the Centre for Internet Security Controls are all welcome, though none is a prerequisite.

• Base salary of £60,000 - 70,000 pounds, dependent on experience

• Uncapped annual bonus, typically five to fifteen per cent of base salary

• Hybrid working, two to three days per week on site in the East Midlands office

• Occasional travel to the new Southern office

• Pension, enhanced leave and a modern office environment