JOB DESCRIPTION
Senior Security Engineer
Position Summary
We are looking for a Senior Security Engineer to implement and improve managed security services across endpoint, identity, email, network, secure access and cloud environments. This is a hands-on role focused on technical delivery, troubleshooting and clear customer communication.
Working with established architects and international delivery teams, you will own complex engineering work, improve service baselines and mentor colleagues. Strong systems and networking foundations matter more than knowledge of every named product; specialist platform training and certification support are available.
Job Details
Work Setup: Hybrid. Work from home initially, with short weekly office meetings (around 1–2 hours). Office attendance will gradually increase as the team grows, potentially to 2–3 days per week.
Schedule: Monday to Friday | 5 PM to 2 AM Philippine time.
Responsibilities
- Implement, configure and maintain endpoint, identity, email, firewall, IDS/IPS, secure access and cloud security controls; tune policies, exclusions and allow/block lists without weakening protection.
- Translate technical and client requirements into implementation plans, with testing, change and configuration management, rollback arrangements and clear technical handovers.
- Onboard client users, devices, tenants, sites and remote users, including endpoint agents, Microsoft 365/Google Workspace integrations and secure access.
- Administer and harden Microsoft 365, Entra ID, Exchange Online, Google Workspace and cloud environments; manage access controls, mail flow, SPF, DKIM, DMARC and related DNS changes.
- Investigate alerts and incidents, including phishing, business email compromise, identity misuse, ransomware and network issues; contain threats, preserve evidence, remediate and document root causes within agreed SLAs.
- Run vulnerability assessments, track remediation and work with specialist testing teams on findings. Coordinate technical escalations with architects, vendors and third-party identity/access service providers.
- Contribute to SIEM log onboarding, log-source health, queries, detection tuning and dashboards within assigned services, with specialist data-platform engineering supported by the wider technical team.
- Improve repeatable onboarding, remediation and response tasks using approved scripts, APIs and automation, including SOAR playbooks and alert-to-ticket workflows where appropriate.
- Use approved AI tools for investigation, query writing and documentation with confidentiality controls and human review; help evaluate detection accuracy and false positives.
- Apply agreed security and regulatory controls, maintain runbooks, tickets and change records, and support audits, incident reporting, post-incident reviews and improvements informed by emerging threats.
- Report service performance and improvements, including detection/response times, false positives and automation coverage; explain technical findings, risks and next steps clearly to clients.
- Collaborate with international teams, contribute reusable tools and knowledge, develop through technical training, and participate in agreed escalation and on-call rotas.
- Own complex security implementations within your areas of expertise, such as email migrations, cloud hardening or SASE/SD-WAN deployments; review technical changes and mentor engineers.
- Lead complex incidents and technical investigations within your expertise; contribute to threat hunting and tested detection content aligned to MITRE ATT&CK, and brief clients on findings and actions.
- Where relevant, support security telemetry, data-quality improvements, reusable detection content and automation, working with specialists on advanced data-platform architecture.
- Contribute to responsible AI-assisted security workflows and detection improvements, with confidentiality, human review and measurable outcomes.
- Support vendor reviews, new service improvements, client service reviews and occasional pre-sales scoping where relevant; hands-on technical delivery remains the primary focus.
Qualifications
- At least 5 years of relevant hands-on engineering experience, including substantial security implementation and troubleshooting. Candidates who progressed from systems or network administration into security engineering are welcome.
- Strong practical foundations in systems administration, network engineering or related infrastructure work, with evidence of hands-on security engineering responsibilities.
- Demonstrated implementation and troubleshooting experience, with clear examples of systems configured, changes delivered and problems personally resolved.
- Strong systems and networking foundations, such as Microsoft technologies, Linux/Red Hat, routing, switching, DNS, VPNs and firewalls.
- Practical strength in endpoint/identity, email, network/secure access or cloud security. Equal depth across all domains is not required.
- Relevant technical/vendor certification, such as Microsoft, Cisco, Check Point, Palo Alto or equivalent. Previously earned credentials, including expired certifications, may be considered.
- Excellent written and spoken English, customer empathy, and the ability to explain technical issues confidently to European and North American customers.
- Practical problem-solving, independent ownership, honest assessment of technical strengths and gaps, and sound judgment about when to seek guidance or escalate.
- Willingness to learn new platforms, follow security and change-control practices, and develop through training and certification.
Nice to Have
- Experience in an MSP/MSSP or other multi-client managed services environment, or in regulated industries; familiarity with NIST CSF, ISO 27001, CIS Controls or related frameworks.
- Exposure to Microsoft Defender, Sentinel, Huntress, Check Point, Cato Networks or comparable endpoint, identity, email, network and cloud security platforms.
- PowerShell or Python, APIs, Git, Terraform, KQL/SQL, SIEM/SOAR, detection engineering or threat hunting experience.
- Experience with security data pipelines, scalable telemetry, detection-as-code, AI-assisted workflows, practical AI/ML projects or LLM security risks such as prompt injection and data leakage.
- Technical design input, mentoring, vendor coordination or pre-sales experience supporting managed security services.
- German, French or Spanish language skills.