Security Engineer in Lee-on-the-Solent

Role Overview

This role covers both:

• Day 1 Security (Build / Project Implementation)
• Day 2 Security (Operations / Production Support)
• The Security Engineer will work closely with Security Leads, Infra, System, and Software teams to ensure compliance with government security policies and standards.

Key Responsibilities

Day 1 – Project / Implementation Security

1. Security Implementation & Engineering
   • Implement security architecture and controls as designed by Security Leads/Architects
   • Support system, application, and infrastructure security configurations
   • Assist in threat modelling and risk assessment activities
   • Translate security requirements into technical implementation across platforms
2. Compliance Support
   • Support compliance with:
     • IM8 / Government security policies
     • Whole‑of‑Government (WOG) security requirements
     • PDPA (where applicable)
   • Assist in preparation and documentation for:
     • Security Risk Assessments (SRA)
     • Vulnerability Assessments (VA)
     • Penetration Testing (PT)
   • Maintain security documentation and evidence for audits
3. DevSecOps & Secure Development
   • Implement and maintain security tools in CI/CD pipelines:
     • SAST
     • DAST
     • SCA
     • container scanning
   • Monitor and triage findings, and work with developers on remediation
   • Support secure coding practices and DevSecOps adoption
   • Assist in API security, secrets management, and secure communications setup
4. Security Testing Support
   • Support coordination and execution of VA/PT activities
   • Track vulnerabilities and ensure timely remediation
   • Assist in documenting findings and closure evidence
   • Support system security certification and go-live requirements
5. System & Platform Hardening
   • Implement and maintain security hardening for:
     • Operating systems
     • Middleware and databases
     • Kubernetes and containers (RBAC, secrets, network policies)
   • Support configuration of:
     • API Gateways
     • WAF
     • Authentication and authorization mechanisms (OAuth2, mTLS)

Day 2 – Operations / Production Security

1. Incident Response
   • Support investigation, containment, and remediation of security incidents
   • Perform log analysis and assist in root cause analysis (RCA)
   • Work with SOC and internal teams during incidents
   • Follow and improve incident response playbooks
2. Vulnerability & Patch Management
   • Perform regular vulnerability scans and monitoring
   • Track and verify patching and remediation activities
   • Escalate high-risk vulnerabilities and propose mitigation controls
3. Security Monitoring
   • Monitor alerts from SIEM and security tools
   • Assist in tuning detection rules and dashboards
   • Ensure logging and monitoring coverage across systems
4. Audit & Compliance Support
   • Support audit preparation, evidence collection, and remediation tracking
   • Maintain security records and documentation
   • Assist in reporting security posture and issues
5. Access Control Administration
   • Support implementation of:
     • RBAC
     • MFA
     • Privileged Access Management (PAM)
   • Perform user access reviews and ensure least privilege.

Regret to inform that only shortlisted candidates will be notified.

CEI: R1988671. EA License: 14C7275

#J-18808-Ljbffr