Cyber Security Engineer – Elastic Security (SIEM)

About the role

The Cyber Security Engineer will strengthen BCS's cyber defence capabilities by leveraging hands‑on experience with Elastic Security (SIEM/ELK Stack). The role involves security monitoring, threat detection, incident investigation and optimisation of cybersecurity solutions.

Key responsibilities

• Manage, administer and optimise Elastic Security components including Elasticsearch, Kibana, Logstash and Beats.
• Develop and tune SIEM use cases, correlation rules, dashboards and alerts.
• Perform log onboarding, analysis and continuous security event monitoring.
• Conduct threat hunting activities and investigate security alerts and incidents.
• Support incident response, including containment, remediation and recovery.
• Operate and enhance Network Detection and Response (NDR) capabilities and analyse network security events.
• Participate in cybersecurity projects, solution implementations and technology upgrades.
• Assist with vulnerability assessments, penetration testing, red‑team and tabletop exercises.

Required profile

• Degree in Computer Science, Information Security, IT, Engineering or a related discipline.
• Minimum 4 years of hands‑on experience administering cybersecurity solutions and supporting security operations, with proven expertise in Elastic Security (ELK Stack) or comparable SIEM platforms.
• Strong understanding of SIEM, security monitoring, log analytics and the MITRE ATT&CK framework.
• Good knowledge of networking fundamentals, operating systems (Linux, Unix, Windows) and NDR solutions.
• Familiarity with MAS Cyber Hygiene, Technology Risk Management Notices, Cybersecurity Act and Code of Practice.
• Excellent communication, analytical and problem‑solving abilities.

Required skills

• Elastic Security (Elasticsearch, Kibana, Logstash, Beats)
• SIEM use‑case development and rule tuning
• Threat hunting and incident investigation
• Network Detection and Response (NDR)
• Log analysis and monitoring
• Linux, Unix, Windows operating systems
• Networking protocols and traffic analysis
• MAS regulatory frameworks (Cyber Hygiene, Technology Risk Management, Cybersecurity Act, Code of Practice)