SOC Platform Engineer (AI, Wazuh, Graylog and Linux) - falmouth, south west england, uk in Cornwall

About the role UK Cyber Defence Ltd is looking for a mid-level SOC Platform Engineer to help run the platform that underpins our Security Operations Centre. You will work directly with our Head of Threat Disruption, who built the platform, and you will learn it thoroughly, share its day-to-day running and progressively take ownership of parts of it, so that the knowledge lives in a team rather than in one head. This is a platform and infrastructure role rather than a triage-desk role. First and second line alert analysis is carried out by Emily, our AI analyst. You will make sure the alerts she works from arrive, are correct and can be trusted, and you will be the engineer she turns to when she meets something she cannot close herself. The role is also client-facing: speaking to customers by telephone, on Teams and in chat is a normal part of the week. Your first year is a structured training year. We do not expect you to know our platform or Emily on the first day. By the end of the year, we expect you to be able to run the platform and handle Emily’s escalations without needing to ask. Key responsibilities You will operate and maintain our multi-tenant Wazuh manager estate, including the managers, the load-balanced agent enrolment and event paths, agent groups and the per-client portals. You will run the Graylog and OpenSearch logging tier behind it, keeping the cluster healthy, managing index lifecycle policies and hot, warm and cold tiers, and planning capacity. You will administer the hardened Ubuntu hosts, load balancers, collectors and telemetry receivers that make up the platform, in our own data centre and in the cloud. You will write and tune Wazuh decoders and rules, including PCRE2-based decoders for awkward log formats, mapping detections to MITRE ATT Wazuh is preferred, but Elastic, OpenSearch, Graylog, Splunk or Security Onion experience transfers well. A working understanding of how logs travel from source to searchable index. Bash and Python scripting sufficient to automate operational tasks safely, and confidence with regular expressions. You should be able to diagnose problems methodically under pressure, verify rather than assume, and write a clear post-incident summary in plain English. You should take direct technical challenge without taking it personally and give it back with the same honesty. You should have a hardened-by-default mindset: least privilege, minimal attack surface and secrets kept out of scripts. You must be comfortable dealing with clients by telephone, on Teams and in chat, including when the news is unwelcome. You must have the right to work in the United Kingdom without sponsorship and be willing to undergo background checks to BPSS level. Desirable Hands-on Wazuh decoder and rule writing; Graylog and OpenSearch or Elasticsearch cluster administration; HAProxy; Nagios, Zabbix or similar; Microsoft Sentinel or Azure Log Analytics; familiarity with MITRE ATT MySQL and PHP; Linux or SIEM certifications such as Linux+, LPIC, RHCSA, Security+ or CySA+; managed service provider experience; involvement in the security community; and an interest in working alongside AI-driven analysis. The working arrangement The role is permanent, full-time and fully remote within the United Kingdom, working UK office hours. Our SOC runs on UTC. Out-of-hours work is occasional and by arrangement, for planned maintenance windows and major incidents, and is not a standing on-call rota. We provide the equipment you need, and you will be mentored by a veteran of the field who wants you to be able to do everything he can do. If you would like to apply, please include a short note on a problem you diagnosed that you were proud of, and links to any talks, repositories or write-ups you would like us to see.