Security Engineer

Beazley Security offers flexible working arrangements, generous leave including 3 months paid parental, and strong benefits coverage with 100% of employee-only insurance premiums (healthcare, dental, and vision). You will also have opportunities for ongoing training and career advancement, plus participation in industry conferences and events.

In this remote role, you will help operate and continually improve the detection platforms at the center of the SOC, owning the lifecycle and tuning for Beazley Group’s Endpoint Detection and Response (EDR) and Network Detection and Response (NDR) technologies used by the SOC.

Responsibilities

• Serve as the technical owner for SOC systems and operations, maintaining full operational coverage and integration across the enterprise estate.
• Maintain the physical and virtual infrastructure for EDR/NDR (appliances, sensors, collectors), including upgrades, hardware refreshes, and configuration changes.
• Oversee policy, sensor deployment, and version control across EDR/NDR agents and connectors.
• Validate data flow and platform health between endpoints, appliances, and the central XDR platform.
• Coordinate with the SOC, vendors, and IT infrastructure teams to schedule upgrades, patching, and feature enablement.
• Tune detection logic, behavioural models, and response policies to reduce false positives while improving threat visibility.
• Improve investigation support through NDR model optimisation, device tagging, and subnet labelling enhancements.
• Maintain EDR configuration baselines and analytics dashboards.
• Support integration and data quality within the Beazley Security XDR platform to ensure dependable event correlation.
• Document configuration changes, tuning decisions, and engineering work in line with IT Security change management processes.
• Work closely with the SOC to ensure analysts have the right visibility, alert quality, and context for effective first-line detection and triage.
• Act as part of the escalation group for security cases from the centralized SOC, assisting with containment and isolation when needed.
• Provide subject-matter expertise on EDR/NDR telemetry during investigations and post-incident reviews.
• Contribute to root-cause analysis and recommend platform-level improvements after potential incidents.
• Partner with Threat Intelligence and the MDR organization to proactively hunt for malicious activity and validate emerging TTPs.
• Feed newly identified patterns into SOC detection content and threat models.
• Produce operational and executive reporting across managed detection platforms.
• Participate in technical optimisation sessions and quarterly business reviews with vendors.
• Track detection efficacy, platform uptime, and configuration drift metrics as part of IT Security KPIs.
• Continuously evaluate opportunities for automation, enrichment, and process improvement.

Requirements

• Minimum 3 years experience in security operations, cyber engineering, or platform management.
• Hands-on experience administering and optimising leading NDR and EDR platforms.
• Strong understanding of endpoint telemetry, network analytics, and SOC workflows.
• Experience planning and performing platform upgrades, integrations, and lifecycle management.
• Familiarity with MITRE ATT&CK and threat-hunting principles.
• Ability to collaborate effectively with SOC analysts, infrastructure teams, and vendors.
• Excellent documentation, analytical, and communication skills.

Technologies

Endpoint Detection and Response (EDR), Network Detection and Response (NDR), XDR, MITRE ATT&CK, SQL, PowerShell, Python, Identity Threat Detection & Response (ITDR)

Benefits

• Competitive salary and bonus.
• Flexible working arrangements.
• Generous leave policies including 3 months paid parental.
• 100% of employee-only insurance premiums covered (healthcare, dental and vision).
• Up to 5% matched 401k contribution.
• Opportunities for career advancement and ongoing training.
• Participation in industry conferences and events.

Desirable skills

• Experience working within hybrid SOC models (internal + managed service).
• Exposure to Identity Threat Detection & Response (ITDR) solutions.
• Certifications such as CySA+, GCIA, or equivalent.
• Scripting or query language capability (SQL, PowerShell, Python).

Personal attributes

• Highly organised and proactive, with strong ownership of assigned technologies.
• Analytical thinker focused on improving systems and processes.
• Collaborative and approachable, able to bridge operations, engineering, and intelligence teams.
• Calm under pressure, with a methodical and disciplined approach to incident support.

Key interfaces

Internal: Head of IT Security, SOC Manager, Incident Response, Infrastructure, Cloud, and Networking teams.

External: Beazley Security MDR SOC