Security Engineer (SOC / Data Engineering)

£450 per day | Outside IR35 | 9-Month Contract | Active SC Clearance Required

London (1 day per month onsite)

A leading consultancy is seeking an experienced Security Engineer to join a high-profile cyber security programme supporting critical public sector environments. This role sits at the intersection of Security Operations, SIEM engineering, and cloud-based data engineering, offering the opportunity to work on large-scale security monitoring platforms and cloud-native security solutions.

The Role

As a Security Engineer, you will play a key role in designing, optimising, and maintaining security telemetry pipelines while supporting SOC operations and detection engineering activities. You’ll work with cloud-native technologies, SIEM platforms, and security data tooling to improve visibility, detection capability, and operational resilience across complex environments.

Key Responsibilities

• Manage and optimise security log ingestion pipelines using Cribl and cloud-native technologies.
• Support the collection and processing of AWS security telemetry, including CloudTrail, VPC Flow Logs, GuardDuty, EKS audit logs, and IAM activity.
• Build and maintain security data models, field extractions, and data normalisation standards aligned to OCSF.
• Troubleshoot ingestion and pipeline performance issues across services such as SQS, S3, and Splunk.
• Develop and enhance SIEM detection logic and support the tuning of use cases to improve alert quality.
• Work closely with SOC analysts to improve detection coverage and reduce false positives.
• Help implement secure data handling practices, including encryption, access controls, and least-privilege principles.
• Contribute to the optimisation of security data storage and tiering strategies across cloud environments.

Skills & Experience

Essential

• Strong experience within Security Engineering, SOC Engineering, SIEM Engineering, or Detection Engineering roles.
• Hands-on experience with AWS security services and cloud-native security monitoring.
• Proven experience developing and supporting Splunk detection rules and SPL queries.
• Experience with security data pipelines and log management technologies.
• Knowledge of S3, SQS, Kinesis, and cloud-based logging architectures.
• Understanding of security frameworks such as Zero Trust and identity-centric security models.
• Excellent communication and stakeholder management skills.

Desirable

• Experience with Cribl.
• Azure and/or Google Cloud Platform exposure.
• Knowledge of OCSF data schemas and security data normalisation.
• Previous experience working within UK Government or wider public sector environments.

What’s on Offer?

• £450 per day
• Outside IR35
• 9-month initial contract
• Hybrid working – only 1 day per month onsite in London