Security Engineer in Cardiff

Security Engineer | £45,000 | Remote (occasional Cardiff office)

We are looking for a Security Engineer to join a growing Security Operations function, supporting a range of clients and helping them strengthen their overall cyber security posture. This is a hands‑on role focused heavily on the Microsoft Security stack, particularly Microsoft Defender XDR and Microsoft Sentinel. You\'ll work across security engineering, detection development, vulnerability management, incident response and Microsoft 365 security, while also engaging directly with clients.

This is not a traditional SOC Analyst position. The focus is on Security Engineering and escalated Incident Response, with significant scope to improve security controls, detection capabilities and automation across client environments.

Why this role stands out:

• Technical ownership — work hands‑on with Microsoft Defender XDR, Sentinel, KQL and Advanced Hunting
• Variety — work across security engineering, detection, vulnerability management, incident response and Microsoft 365 security
• Client exposure — work directly with clients, presenting findings and helping them implement meaningful security improvements

• Design, implement and optimise security controls
• Develop detection capabilities using KQL and Advanced Hunting
• Build and maintain Microsoft Sentinel analytical rules
• Deploy and manage Content Hub solutions
• Tune Microsoft Defender and wider threat policies
• Manage phishing simulation campaigns
• Lead vulnerability scanning activities and analyse results and associated risks
• Produce structured security reports and present technical findings to clients and stakeholders
• Support client remediation and security improvement activities
• Handle escalated Incident Response investigations and support advanced investigations from the triage team
• Develop and improve Incident Response playbooks
• Automate processes using Azure Logic Apps and work with Azure Functions and codeless playbooks where appropriate
• Audit and uplift Microsoft 365 security environments, improving Secure Score and security controls
• Manage Defender policies, device tagging, and support Exchange security configuration and hardening
• Identify opportunities for scripting and automation
• Extensive Security Engineering or Senior Security Analysis experience
• Strong KQL and Advanced Hunting knowledge
• Experience with vulnerability scanning and risk analysis
• Strong understanding of security protocols and industry standards
• Experience with Microsoft 365 security environments
• Strong client-facing communication skills, able to convey technical findings to non-technical stakeholders
• Experience producing professional security reports
• Understanding of Incident Response processes and escalations
• Primarily remote working, with occasional Cardiff office attendance
• Hands‑on exposure to the Microsoft Security ecosystem
• Significant client-facing technical responsibility
• Opportunity to develop automation and scripting capabilities
• Exposure to Azure and Microsoft 365 security technologies
• Support for professional development and relevant security certifications