Senior Security Engineer job description

Cybersecurity — Senior Security Engineer
Owns a domain and leads response to major incidents.

REQUIRED SKILLS
Threat Operations
- Security Alert Triage — You can tune triage criteria and playbooks from what past alerts revealed, cutting noise without hiding a real signal, and review contested calls made by other analysts.
- Threat Detection Engineering — You can build detection coverage for a whole class of technique, prioritise which gaps matter most, and coach others in writing rules that hold up in production.
- SIEM Monitoring and Tuning — You can plan SIEM capacity and log source coverage against real detection needs, and lead a platform migration without a monitoring gap.
- Incident Response Coordination — You can set the incident response programme for the organisation, including who has authority to declare and close an incident, and represent the organisation to regulators or the board after a serious breach.
- Digital Forensics and Evidence Handling — You can lead forensic investigation of a complex intrusion spanning cloud and on-premises systems, and present findings that survive challenge from legal or a regulator.
- Threat Intelligence Analysis — You can run a structured intelligence programme that prioritises collection against the threats the organisation actually faces, and brief technical findings to non-technical leaders.

Exposure Management
- Vulnerability Scanning and Triage — You can validate whether a critical finding is actually exploitable in this environment before it triggers an emergency response, and improve the scanning programme from what was missed.
- Vulnerability Remediation Coordination — You can run remediation across a portfolio of systems with competing priorities, and report exposure trends in terms leadership will act on.
- Penetration Testing and Exploitation — You can scope and lead a test involving several systems or a red-team-style exercise, and judge when a finding is too dangerous to demonstrate live rather than describe.
- Cloud Security Posture Management — You can drive posture improvement across multiple cloud accounts and providers, and stop a risky deployment pattern by changing how it is provisioned rather than by policing it after the fact.
- Attack Surface Reduction — You can build continuous attack surface monitoring into how the organisation ships infrastructure, and reduce a whole category of exposure rather than one instance at a time.

Identity and Access
- Identity and Access Governance — You can run access governance across many systems and identity sources, and defend the coverage and evidence of the programme to an internal or external auditor.
- Privileged Access Management — You can bring privileged access under control in messy estates where admin accounts are shared, undocumented or embedded in scripts, and you get the owners to agree the migration. You are who people ask when an outage needs emergency access fast.
- Access Control Reviews — You can design the review programme for a complex estate, choosing which systems are reviewed how often and what makes a reviewer decision defensible. You cut rubber-stamping by changing how the review is put to the reviewer.
- Identity Federation and Single Sign-On — You can federate across organisational boundaries, including mergers and partner tenants where the identity sources disagree, and resolve the conflicts without weakening the trust. You are called when a broken sign-on locks everyone out.

Secure Architecture
- Security Architecture Design — You can produce security designs for systems with competing constraints, legacy dependencies or regulatory obligations, and get the tradeoffs agreed rather than deferred. Other architects bring you their designs before formal review.
- Threat Modeling — You can threat model systems with complex trust relationships, supply chains or unclear ownership, and separate the threats worth spending on from the ones worth accepting. You change the method when it stops finding anything.
- Application Security Testing — You can test systems where the interesting weakness only appears when components are chained together, and you chain them to prove the impact. You set how testing is scoped and what a report must show to be acted on.
- Secure Code Review — You can review code where the weakness lives across files, frameworks or trust boundaries, and judge which findings genuinely justify blocking a release. Developers ask you to look before they ship anything risky.
- Security Requirements and Design Review — You can review designs where security requirements conflict with cost, delivery date or an existing platform, and land an agreed position with conditions attached. You are brought in when a project and security have deadlocked.

Governance and Risk
- Security Risk Assessment — You can assess risk where the impact is uncertain or contested, and give decision-makers a real choice rather than a colour on a heat map. You challenge a rating that has been set to suit the answer someone wanted.
- Security Policy and Compliance Governance — You can rework a policy set that has drifted from how the organisation really works, and judge whether to change the policy or the practice. You close audit findings without creating paperwork nobody reads.
- Third-Party and Vendor Security Risk — You can assess suppliers whose failure would stop the business, including their own subcontractors, and negotiate controls with commercial pressure pushing the other way. You lead the response when a critical supplier is breached.
- Security Awareness Programme Management — You can move awareness from a completion figure to a measured change in behaviour, including with audiences who have tuned security training out for years. You handle it when a simulation lands badly with senior staff.
- Security Metrics and Reporting — You can report on areas where the data is incomplete or easy to game, and say plainly what the numbers cannot tell you. You retire metrics that people have learned to hit without becoming any safer.

Delivery
- Project Management — You can run work spanning several teams, negotiate scope and sequencing with their owners, and maintain one shared plan that all of them actually use.
- Planning & Estimation — You can estimate work spanning several teams, name the assumptions each figure rests on, and re-cut the plan as those assumptions break.
- Ownership & Accountability — You can hold accountability for outcomes delivered mostly by other people, absorbing the blame when it fails and passing on the credit when it works.
- Quality Focus — You can design the quality practice for complex work owned by several teams, and you anticipate the failure modes that only appear once systems interact.

Craft
- Problem Solving — You can solve problems in domains where you are not the expert, and your solutions hold up on cost, performance, and maintainability at once.
- Domain Expertise — You can bring in practice from outside the organisation and make it work here, and your judgement demonstrably improves the projects you touch.
- Continuous Learning — You can judge which new ideas are worth the team's time and which are not, and you make room for the people around you to learn too.

Communication
- Communication — You can bring disagreeing groups to a shared understanding, and colleagues come to you for help framing a difficult or sensitive message.
- Collaboration — You can align teams with competing priorities on a common goal, surfacing the conflict early instead of letting it harden into resentment.
- Technical Writing — You can own the documentation of a large project, coordinating contributions so the work can be maintained by people who never built it.
- Stakeholder Management — You can hold senior and external relationships, negotiate between competing demands, and deliver unwelcome news without losing trust.

Leadership
- Leadership — You can lead across team boundaries, build the credibility that makes people follow you by choice, and create room for others to lead.
- Mentoring — You can develop other mentors, coach people through career decisions rather than tasks, and lift the capability of a whole team.
- Strategic Thinking — You can set direction for an area, choose deliberately what not to do, and defend that choice when it is challenged.

REQUIRED CERTIFICATIONS
- CompTIA Security+ (required from Senior Security Analyst)
- GIAC Certified Incident Handler (GCIH) (required from Security Engineer)
- OffSec Certified Professional (OSCP) (required from Security Engineer)
- Certified Cloud Security Professional (CCSP) (required from Senior Security Engineer)