About the role
UK Cyber Defence Ltd is looking for a mid-level SOC Platform Engineer to help run the platform that underpins our Security Operations Centre. You will work directly with our Head of Threat Disruption, who built the platform, and you will learn it thoroughly, share its day-to-day running and progressively take ownership of parts of it, so that the knowledge lives in a team rather than in one head.
This is a platform and infrastructure role rather than a triage-desk role. First and second line alert analysis is carried out by Emily, our AI analyst. You will make sure the alerts she works from arrive, are correct and can be trusted, and you will be the engineer she turns to when she meets something she cannot close herself. The role is also client-facing: speaking to customers by telephone, on Teams and in chat is a normal part of the week.
Your first year is a structured training year. We do not expect you to know our platform or Emily on the first day. By the end of the year, we expect you to be able to run the platform and handle Emily’s escalations without needing to ask.
Key responsibilities
You will operate and maintain our multi-tenant Wazuh manager estate, including the managers, the load-balanced agent enrolment and event paths, agent groups and the per-client portals. You will run the Graylog and OpenSearch logging tier behind it, keeping the cluster healthy, managing index lifecycle policies and hot, warm and cold tiers, and planning capacity. You will administer the hardened Ubuntu hosts, load balancers, collectors and telemetry receivers that make up the platform, in our own data centre and in the cloud.
You will write and tune Wazuh decoders and rules, including PCRE2-based decoders for awkward log formats, mapping detections to MITRE ATT&CK. You will onboard new client log sources, from endpoint agents and firewalls to cloud tenants and Microsoft Sentinel integrations, and make sure each feed is parsed correctly and monitored for silence. You will maintain the Nagios monitoring that watches the platform itself, and help manage our Cyber Essentials Plus and DCC technical compliance programmes.
You will operate Emily day to day and help maintain her, keeping her data feeds healthy and feeding back the cases where she got it wrong. You will investigate the escalations she raises, take them through to closure where you can, and escalate to the Head of Threat Disruption with a clear
SOC Platform Engineer (AI, Wazuh, Graylog and Linux) - UK Cyber Defence in Falmouth employer: UK Cyber Defence
UK Cyber Defence Ltd is an exceptional employer that prioritises employee growth and development, offering a structured training year for new SOC Platform Engineers. With a fully remote working arrangement, you will enjoy a supportive work culture where mentorship from experienced professionals fosters collaboration and knowledge sharing. The company also provides the necessary equipment and encourages engagement with cutting-edge technologies, making it an ideal place for those seeking meaningful and rewarding employment in the cybersecurity field.
