Lead Security Engineer, IT Security Operations

About the role

The Lead Security Engineer will join the Corporate IT Security Operations team to drive engineering, operation, and continuous improvement of enterprise security platforms. You will work closely with the IT Security Operations Manager to modernise SIEM, enhance EDR/XDR capabilities, and embed AI‑assisted SecOps across the organisation.

Key responsibilities

• Engineer, operate, and continuously improve SIEM, EDR/XDR, security automation/orchestration tools, and security data pipelines.
• Lead migration of the SIEM environment to Elastic on Google Cloud Platform, including log ingestion, pipeline development, dashboards, alerting, rule tuning and platform optimisation.
• Build and maintain data pipelines for logs from IT systems, networks, endpoints, identity platforms, cloud services, applications and security tools.
• Enhance alert enrichment, investigation workflows, case routing, ticketing integration and operational reporting.
• Support security monitoring, alert triage, threat investigation, incident response and detection tuning.
• Translate SecOps pain points into engineering improvements such as better detections, false‑positive reduction, automation playbooks and runbooks.
• Explore AI‑enabled use cases including anomaly detection, behavioural analytics and automation of repetitive SOC tasks.
• Partner with infrastructure, network, cloud, endpoint, identity, application and cybersecurity teams to improve security visibility.
• Provide coaching, technical guidance and knowledge sharing to team members.

Required profile

• Hands‑on experience in security engineering, investigations and SIEM/EDR operations.
• Proven track record of modernising security platforms and automating SecOps processes.
• Ability to translate operational challenges into practical engineering solutions.
• Strong collaboration skills to work with cross‑functional security and IT teams.

Required skills

• SIEM (Elastic Stack)
• EDR/XDR platforms
• Security automation and orchestration tools
• Security data pipeline development
• Google Cloud Platform (GCP)
• AI/ML for security use cases
• Anomaly detection and behavioural analytics
• Automation playbooks and runbooks