> Markdown version of [/jobs/ext/3724964-security-engineer-sc-cleared](https://www.wearedevelopers.com/jobs/ext/3724964-security-engineer-sc-cleared). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer - SC Cleared

- **Company:** Sanderson Recruitment Plc
- **Location:** London, UK
- **Salary:** £117,000.0
- **Contract:** Temporary contract
- **Skills:** Amazon Web Services, Amazon S3, Microsoft Azure, Cloud Computing, Cloud Computing Security, Data Security, Database Schema, Identity and Access Management, Intrusion Detection and Prevention, Zero Trust Network Access, Security Log, Security Information and Event Management, Data Logging, Google Cloud, Data Storage Technologies, Cloud Platform System, Data Ingestion, Amazon Virtual Private Cloud (VPC), Containerization, Amazon Simple Queue Service (SQS), Splunk, Data Pipelines
- **Published:** October 14, 2026
- **Apply:** https://www.totaljobs.com/job/security-engineer/sanderson-government-and-defence-job108161456

## About the Role

* Strong experience within Security Engineering, SOC Engineering, SIEM Engineering, or Detection Engineering roles.
 * Hands-on experience with AWS security services and cloud-native security monitoring.
 * Proven experience developing and supporting Splunk detection rules and SPL queries.
 * Experience with security data pipelines and log management technologies.
 * Knowledge of S3, SQS, Kinesis, and cloud-based logging architectures.
 * Understanding of security frameworks such as Zero Trust and identity-centric security models.
 * Excellent communication and stakeholder management skills.

Desirable

 * Experience with Cribl.
 * Azure and/or Google Cloud Platform exposure.
 * Knowledge of OCSF data schemas and security data normalisation.
 * Previous experience working within UK Government or wider public sector environments.

## Description

As a Security Engineer, you will play a key role in designing, optimising, and maintaining security telemetry pipelines while supporting SOC operations and detection engineering activities. You'll work with cloud-native technologies, SIEM platforms, and security data tooling to improve visibility, detection capability, and operational resilience across complex environments., * Manage and optimise security log ingestion pipelines using Cribl and cloud-native technologies.

 * Support the collection and processing of AWS security telemetry, including CloudTrail, VPC Flow Logs, GuardDuty, EKS audit logs, and IAM activity.
 * Build and maintain security data models, field extractions, and data normalisation standards aligned to OCSF.
 * Troubleshoot ingestion and pipeline performance issues across services such as SQS, S3, and Splunk.
 * Develop and enhance SIEM detection logic and support the tuning of use cases to improve alert quality.
 * Work closely with SOC analysts to improve detection coverage and reduce false positives.
 * Help implement secure data handling practices, including encryption, access controls, and least-privilege principles.
 * Contribute to the optimisation of security data storage and tiering strategies across cloud environments.