(SC cleared) Cyber Security Engineer SoC/SIEM

Methods Business and Digital Technology Limited • APPLICATION • Remote (West Midlands, Not Specified, United Kingdom) • £550 - £650 / * • 4h ago

*no remote, fully onsite*

Daily rate: £550 to £650 outside IR35

Duration: 6months with possible extension

Location: 5days onsite in Ledbury/Gloucester/Cheltenham/Worcester

Clearance: must be SC cleared

Responsibilities & Requirements

Elastic Stack Expertise:
Demonstrable expertise across the Elastic Stack, particularly in the use of Kibana for creating advanced visualisations, dashboards, queries, and alerts. You must hold a valid Elastic Certified Analyst certification, with full working knowledge of the competencies it covers, including anomaly detection, dashboard tuning, and timeline analysis.
Data Ingestion & Log Pipeline Engineering:
Build, manage and optimise complex Logstash pipelines, utilising a wide range of plugins to handle diverse log formats, transform data, and enrich security telemetry. Ensure reliable ingestion of logs from both structured and unstructured sources into Elasticsearch.
Syslog Configuration:
Configure, manage rsyslog and configure centralised logging for network appliances, Firewalls, and infrastructure components to ensure visibility and completeness of data collection.
Linux Proficiency:
Administer and troubleshoot Linux-based systems, with command-line fluency and Scripting ability (eg Bash, Python) to support SIEM operations, log parsing, and agent deployment.
Detection Engineering & Threat Rules:
Develop and tune custom detection rules using ESQL, EQL, and Lucene syntax to identify malicious activity. Use MITRE ATT&CK-aligned techniques and contribute to the design of the detection roadmap. Create and maintain bespoke investigation guides to assist SOC analysts in conducting triage and escalation.
SOC Maturity & Policy Development:
Contribute to the development of SOC processes and policies, including detection logic life cycle, alert tuning procedures, and SIEM configuration governance. Play a key role in maturing the operational use of SIEM tooling and automation within the SOC environment.
Defence Writing & JSP Familiarity:
Prepare formal documentation in line with Defence Writing principles, with an understanding of Joint Service Publications (JSPs), particularly in areas related to cybersecurity governance, incident response, and monitoring operations.
Incident & Case Management:
Support the incident response life cycle through alert review, case triage, evidence handling, escalation, and forensic data support. Ensure cases are documented comprehensively and aligned with operational SOPs and client expectations.
Client Engagement & Communication:
Communicate technical information clearly and confidently to both internal stakeholders and external clients. Collaborate with multidisciplinary teams, report findings effectively, and represent security operations during client interactions and project reviews.

Desirable Skills and Experience

Prior experience in Defence, Government, or Critical National Infrastructure environments.
Familiarity with security frameworks such as MITRE ATT&CK, NIST CSF, or ISO 27001 including how to map TTP's to Rule coverage.
Experience with SOAR or SIEM enrichment tools (eg, TheHive, MISP, Cortex).
Knowledge of additional log forwarding/processing tools (eg Elastic Agent, Fluentd).
Exposure to vulnerability management and threat intelligence platforms such as OpenCTI.

Qualifications:

Expert knowledge of Azure & Sentinel
Proven experience as a Cyber Analyst with a focus on Security Operations.
Strong expertise in using Elastic Stack, including Elasticsearch, Logstash, and Kibana.
Familiarity with other SIEM tools and security technologies.
Knowledge of cybersecurity best practices, threat intelligence, and incident response.
Excellent analytical and problem-solving skills.
Relevant certifications such as Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), or Elastic Certified Engineer (ECE) are a plus.

This role will require you to hold active SC and/or DV - If DV isn't held, then you will have to be eligible for DV.

Related Jobs

(SC cleared) DevSecOps - outside IR35

Methods Business and Digital Technology Limited • APPLICATION • Remote (West Midlands, Not Specified, United Kingdom) • £700 / * • 4h ago

Fully Remote

*no remote, fully onsite* Daily rate: £700 outside IR35 Duration: 6 months with possible extension Location: 5 days onsite in Ledbury/Gloucester/Cheltenham/Worcester Clearance: must be SC cleared Knowledge/experience : A...

4h ago

Apply

(SC cleared) Backend Python Developer

Methods Business and Digital Technology Limited • APPLICATION • Remote (West Midlands, Not Specified, United Kingdom) • 6h ago

Fully Remote

*no remote, fully onsite* Daily rate: £650 outside IR35 Duration: 6months with possible extension Location: 5days onsite in Ledbury/Gloucester/Cheltenham/Worcester Clearance : must be SC cleared Key Responsibilities: Des...

6h ago

Apply

Storage Engineer

Lorien • APPLICATION • West Midlands, Not Specified, United Kingdom • 9h ago

Engineer

Storage Engineer Contract - Inside IR35 Duration: 5 months Location: Coventry, hybrid approach (2 days in the office) Join our established Platform team to support and maintain critical storage infrastructure. You'll tro...

9h ago

Apply

SAP PP Consultant - Super User/Floor Walker - Inside IR35

Masento • APPLICATION • West Midlands, Not Specified, United Kingdom • 2d ago

SAP PP Consultant S/4HANA Implementation - Super User/Floor Walker - Inside IR35 Location: Hybrid - West Midlands, UK (On-site 4 days a week) & Remote Duration: Until the end of the year + potential extensions Start...

2d ago

Apply

Head Of Finance

McGregor Boyall • TRAFFIC • West Midlands, Not Specified, United Kingdom • £500 / * • 2w ago

Head of Finance - Midlands - NHS - Hybrid Role: Head of Finance Location: Midlands (2-3 days per week onsite working) Duration: 3 Months initially. Rate: £500 per day IR35 Status: INSIDE Head of Finance - About the Role...

2w ago

Apply