Principal Security Engineer job description

Cybersecurity — Principal Security Engineer
Sets security architecture and strategy across the organisation.

REQUIRED SKILLS
Threat Operations
- Security Alert Triage — You can tune triage criteria and playbooks from what past alerts revealed, cutting noise without hiding a real signal, and review contested calls made by other analysts.
- Threat Detection Engineering — You can set the detection engineering strategy for the organisation, deciding where investment in content beats investment in tooling, and defend detection coverage decisions to leadership.
- SIEM Monitoring and Tuning — You can plan SIEM capacity and log source coverage against real detection needs, and lead a platform migration without a monitoring gap.
- Incident Response Coordination — You can set the incident response programme for the organisation, including who has authority to declare and close an incident, and represent the organisation to regulators or the board after a serious breach.
- Digital Forensics and Evidence Handling — You can lead forensic investigation of a complex intrusion spanning cloud and on-premises systems, and present findings that survive challenge from legal or a regulator.
- Threat Intelligence Analysis — You can set intelligence requirements and sourcing strategy for the organisation, and advise leadership on emerging threats before they become incidents.

Exposure Management
- Vulnerability Scanning and Triage — You can validate whether a critical finding is actually exploitable in this environment before it triggers an emergency response, and improve the scanning programme from what was missed.
- Vulnerability Remediation Coordination — You can run remediation across a portfolio of systems with competing priorities, and report exposure trends in terms leadership will act on.
- Penetration Testing and Exploitation — You can set the offensive testing programme for the organisation, deciding what gets tested, how often and by whom, and interpret results against the real risk appetite of the organisation.
- Cloud Security Posture Management — You can set the cloud security baseline and guardrails for the organisation, and decide which controls are enforced automatically versus left to review.
- Attack Surface Reduction — You can build continuous attack surface monitoring into how the organisation ships infrastructure, and reduce a whole category of exposure rather than one instance at a time.

Identity and Access
- Identity and Access Governance — You can run access governance across many systems and identity sources, and defend the coverage and evidence of the programme to an internal or external auditor.
- Privileged Access Management — You can bring privileged access under control in messy estates where admin accounts are shared, undocumented or embedded in scripts, and you get the owners to agree the migration. You are who people ask when an outage needs emergency access fast.
- Access Control Reviews — You can design the review programme for a complex estate, choosing which systems are reviewed how often and what makes a reviewer decision defensible. You cut rubber-stamping by changing how the review is put to the reviewer.
- Identity Federation and Single Sign-On — You can federate across organisational boundaries, including mergers and partner tenants where the identity sources disagree, and resolve the conflicts without weakening the trust. You are called when a broken sign-on locks everyone out.

Secure Architecture
- Security Architecture Design — You can set the security patterns and reference architectures the organisation builds on, and decide which are retired. You change what teams outside your remit build by making the secure path the easy one.
- Threat Modeling — You can decide how and when the organisation threat models, and show that the practice changes what gets built. You get teams to model their own systems without you in the room.
- Application Security Testing — You can test systems where the interesting weakness only appears when components are chained together, and you chain them to prove the impact. You set how testing is scoped and what a report must show to be acted on.
- Secure Code Review — You can review code where the weakness lives across files, frameworks or trust boundaries, and judge which findings genuinely justify blocking a release. Developers ask you to look before they ship anything risky.
- Security Requirements and Design Review — You can set which changes need review, what the standing requirements are, and where teams may assess themselves. You get design review treated as help early rather than a gate at the end.

Governance and Risk
- Security Risk Assessment — You can set how the organisation measures and reports security risk, including its appetite and its escalation thresholds. You get executives to act on the risks that matter and to stop spending on the ones that do not.
- Security Policy and Compliance Governance — You can decide the policy and control framework the organisation runs by, and which external standards it commits to certify against. You get compliance treated as a by-product of good practice rather than a separate exercise.
- Third-Party and Vendor Security Risk — You can assess suppliers whose failure would stop the business, including their own subcontractors, and negotiate controls with commercial pressure pushing the other way. You lead the response when a critical supplier is breached.
- Security Awareness Programme Management — You can move awareness from a completion figure to a measured change in behaviour, including with audiences who have tuned security training out for years. You handle it when a simulation lands badly with senior staff.
- Security Metrics and Reporting — You can report on areas where the data is incomplete or easy to game, and say plainly what the numbers cannot tell you. You retire metrics that people have learned to hit without becoming any safer.

Delivery
- Project Management — You can run the organisation's largest and most contested programmes, and the planning practices you introduce get adopted by teams you do not lead.
- Planning & Estimation — You can forecast at the scale of quarters and headcount, and the estimation practice you set is what the wider organisation plans against.
- Ownership & Accountability — You can take on the outcomes the organisation is most exposed on, and other leaders route ownerless problems to you by default.
- Quality Focus — You can raise the quality bar across the organisation by building the tooling and habits that make the careful path the easy one.

Craft
- Problem Solving — You can crack problems the organisation has repeatedly failed to solve, and your approach becomes how others tackle that whole class of problem.
- Domain Expertise — You can influence how the field is practised beyond this organisation, and your expertise settles questions that have stood open for years.
- Continuous Learning — You can set what the organisation invests its learning time in, and the material and practice you create outlive your involvement.

Communication
- Communication — You can set how the organisation communicates, and the forums and norms you create measurably improve how information travels through it.
- Collaboration — You can dismantle the barriers that stop teams working together, and how the organisation collaborates changes because of what you built.
- Technical Writing — You can set the writing standard the organisation works to, and documents you authored are still in use long after you moved on.
- Stakeholder Management — You can represent the organisation in its most consequential relationships and set how it engages with everyone who depends on it.

Leadership
- Leadership — You can set direction for the whole organisation, make hard calls under real uncertainty, and carry the decisions nobody else wants to own.
- Mentoring — You can shape how the organisation grows its people, and those you developed are themselves named by others as strong practitioners.
- Strategic Thinking — You can shape the organisation's strategy, and the bets you argued for are visible in where it ended up.

REQUIRED CERTIFICATIONS
- CompTIA Security+ (required from Senior Security Analyst)
- GIAC Certified Incident Handler (GCIH) (required from Security Engineer)
- OffSec Certified Professional (OSCP) (required from Security Engineer)
- Certified Cloud Security Professional (CCSP) (required from Senior Security Engineer)
- Certified Information Systems Security Professional (CISSP) (required from Principal Security Engineer)