SME IT Security

Job description

Job Summary • We are seeking a Security Engineer to join the Cyber Security Office (CSO) and strengthen the organization\'s cyber defense capabilities across enterprise environments. • The role focuses on security monitoring, threat detection, incident response automation, and security engineering initiatives that protect critical business services. • The successful candidate will design, implement, and optimize security controls, telemetry integrations, and detection capabilities across diverse technology platforms. • You will work closely with security operations, engineering, cloud, infrastructure, and development teams to improve cyber resilience and threat visibility. • The role requires hands-on expertise in SIEM, SOAR, threat hunting, and security automation technologies. • Candidates should possess strong analytical, problem-solving, and scripting skills with a proactive security mindset. • This position supports both UK and Offshore cybersecurity operations and strategic security transformation initiatives. Key Responsibilities Design, implement, and maintain SIEM use cases, detection rules, correlation logic, dashboards, and monitoring capabilities. • Develop and enhance threat detection content based on emerging threats, attack techniques, and threat intelligence sources. • Build and automate incident response workflows using SOAR platforms to improve operational efficiency and response effectiveness. • Integrate security telemetry from cloud, network, endpoint, application, and identity platforms into centralized monitoring systems. • Conduct proactive threat hunting activities to identify hidden threats, suspicious behaviors, and indicators of compromise. • Collaborate with DevOps and engineering teams to embed security controls within CI/CD pipelines and software delivery processes. • Support incident investigations, root cause analysis, and continuous improvement initiatives to strengthen security operations. Skill Requirements Strong experience in SIEM Engineering, including log onboarding, detection rule development, correlation, monitoring, and alert tuning. • Hands-on expertise in Detection Engineering with the ability to develop use cases aligned to threat intelligence and attack frameworks. • Experience in Response Engineering and security automation using SOAR platforms and orchestration technologies. • Proven capability in Threat Hunting, attack analysis, adversary behavior identification, and threat investigation activities. • Experience integrating and managing Security Telemetry from endpoint, cloud, network, identity, and application security tools. • Knowledge of Secure CI/CD pipelines, DevSecOps practices, infrastructure-as-code security, and software development lifecycle security. • Familiarity with scripting languages such as Python, PowerShell, or similar automation technologies and strong understanding of cybersecurity principles. Technical Certification Need to Have and Good to Have Need to Have • Microsoft Certified: Cybersecurity Architect Expert or equivalent Microsoft Security certification. • Splunk Core Certified Power User or Splunk Enterprise Security Certified Admin. • Microsoft Certified Security Operations Analyst (SC-200) or equivalent SIEM/SOC-focused certification. • CompTIA Security+ or an equivalent foundational cybersecurity certification. • Demonstrated hands-on experience with SIEM, detection engineering, and security automation platforms in enterprise environments. Good to Have • GIAC Certified Incident Handler (GCIH). • GIAC Continuous Monitoring Certification (GMON). • Certified Information Systems Security Professional (CISSP). • Other Requirements Certified Cloud Security Professional (CCSP). • Certified Ethical Hacker (CEH) or equivalent threat-hunting certification. • Vendor certifications related to SOAR platforms, Sentinel, Splunk Enterprise Security, CrowdStrike, Palo Alto, or cloud security technologies. • DevSecOps-related certifications covering secure software delivery, CI/CD security, and cloud-native security engineering. Role Details • Role: Security Engineer • Function: Cyber Security Office (CSO) • Hiring Managers: Louise Furniss / Julie Wilson • Grade: E/F • Location: UK / Offshore • Number of Positions: 2 • Duration: 10 Months • Demand Type: Specialist Cyber Security Requirement Apply now Information at a Glance Why HCLTech? At HCLTech, you'll supercharge your potential. You'll find your career. And you'll find your spark. All at a place that knows that helping its customers stay on top starts by putting its people first. HCLTech is a global technology company, home to more than 223,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud and AI, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services. Consolidated revenues as of 12 months ending June 2026 totaled $14.8 billion. Disclaimer Privacy Statement Terms of use Sitemap Raise a Grievance We use cookies on our site. Please read more about cookies policy here. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Copyright © 2026 HCL Technologies Limited Cookie Consent Manager When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. Because we respect your right to privacy, you can choose not to allow some types of cookies. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. Required Cookies These cookies are required to use this website and can't be turned off. Required Cookies Required Cookies Provider Description Enabled SAP as service provider We use the following session cookies, which are all required to enable the website to function: "route" is used for session stickiness "careerSiteCompanyId" is used to send the request to the correct data center "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another Cookies from provider SAPasserviceprovider are required and cannot be turned off Functional Cookies These cookies provide a better customer experience on this site, such as by remembering your login details, optimizing video performance, or providing us with information about how our site is used. You may freely choose to accept or decline these cookies at any time. Note that certain functionalities that these third-parties make available may be impacted if you do not accept these cookies. Consent to all Functional Cookies Functional Cookies Provider Description Enabled Vimeo Vimeo is a video hosting, sharing, and services platform focused on the delivery of video. Opting out of Vimeo cookies will disable your ability to watch or interact with Vimeo videos. Cookie Policy Privacy Policy Terms and Conditions Consent to cookies from provider Vimeo YouTube YouTube is a video-sharing service where users can create their own profile, upload videos, watch, like, and comment on videos. Opting out of YouTube cookies will disable your ability to watch or interact with YouTube videos. Cookie Policy Privacy Policy Terms and Conditions Consent to cookies from provider YouTube Advertising Cookies These cookies serve ads that are relevant to your interests. You may freely choose to accept or decline these cookies at any time. Note that certain functionality that these third parties make available may be impacted if you do not accept these cookies. Consent to all Advertising Cookies Advertising Cookies Provider Description Enabled Google Analytics Google Analytics is a web analytics service o