Detection & security engineer Work, Jobs in Ockham, Sry (with Salaries)

Detection & Security Engineer
CSS Labs —London
- £80,000 - £100,000 a year
- Full-time
- Hybrid work
- Computer networking
- APIs
- Linux
Quick apply
7d
Senior Security Operational Centre Engineer
Sopra Steria —Farnborough
- Up to £80,000 a year
- Hybrid work
- Scripting
- IT
- Python
- Annual leave
- Life insurance
Head of Regional Service
Chubb Fire & Security —Thames Valley
- £41,228.04 - £65,000.00 a year
- Full-time
- Hybrid work
- Management
- Team management
- Contracts
- Free parking
- Store discount
Quick apply
Security Engineer, Detection & Response
doxy.me —London
- Full-time
- Remote
- SQL
- AWS
- Python
- Annual leave
- Work from home
Security Engineer
Air Apps —London
- £61,000 - £76,000 a year
- Full-time
- Azure
- AWS
- Scripting
- Life insurance
Senior Security Engineer
Sopra Steria —Farnborough
- Up to £65,000 a year
- Azure
- AWS
- IT
- Annual leave
Security Engineer (SIEM) – SC Eligible – Government Projects
ByDesign Secure —London
- £625 a day
- Temporary
- Hybrid work
- Agile
- In-person
- Communication skills
Quick apply
14d
Threat Detection Engineer
Millennium Management —London
- Computer Science
- Master's degree
- SQL
Cyber Security Engineer
Foresters Financial —Bromley
- Up to £60,000 a year
- Full-time
- Computer networking
- Communication skills
- Work from home
- Employee assistance programme
Infrastructure Engineer
OLIX —London
- £88,000 a year
- Full-time
- Computer Science
- DevOps
- Bachelor's degree
14d
Security Operations Engineer
TIEVA —Reading
- £45,000 - £55,000 a year
- Full-time
- Hybrid work
- Microsoft Office
- Communication skills
- Free parking
- Employee assistance programme
Quick apply
Security Engineer - Vulnerability
Gamma —London
- Full-time
- Analysis skills
- Communication skills
- Annual leave
- Employee discount
Quick apply
Security Systems Engineer
Amulet —London
- £38,000 a year
- Full-time
- Maintenance
- Driving
- Computer networking
Quick apply
7d
Graduate Programme 2027: Information Security Engineer (Operations)
Revolut —London
- £16,600 a month
- Full-time
- Hybrid work
- English
- Master's degree
- Bachelor's degree
Senior Security Engineer, Detection and Response
roblox —London
- Computer Science
- Bachelor's degree
- No degree
8d
Protection Scientist Engineer, Integrity
OpenAI —London
- £220,000 - £425,000 a year
- Full-time
- SQL
- Machine learning
- Software development
Information Security Engineer (CISO track)
Tangible —London
- Full-time
- Remote
- Master's degree
- AWS
- APIs
- Flexible schedule
Quick apply
Sr. Backend Engineer, Cloud - Threat Detection / Incident Response (Hybrid, London)
CrowdStrike —London
- Full-time
- Java
- Master's degree
- AWS
Senior Detection & Threat Engineer
Checkout.com —London
- Full-time
- Hybrid work
- Python
Quick apply
SecOps Engineer
Trainline —London
- £55,000 - £65,000 a year
- Full-time
- Hybrid work
- Computer networking
- AI
- Communication skills
8d

I want to receive the latest job alerts for detection & security engineer in ockham, sry

By signing in to your account, you agree to SimplyHired's Terms of Service and consent to our Cookie and Privacy Policy.

Detection & Security Engineer

CSS Labs
London

Quick apply

Job details

Full-time
£80,000 - £100,000 a year
7 days ago

Qualifications

Authentication
Rust (programming language)
Go
Node.js
CSS
C#
Firewall
Incident response
Virtualisation
Computer networking
APIs
Linux
Cybersecurity
Python
PowerShell
Active Directory

Full job description

Company Summary

CSS Labs is building Praesidius, a deep-tech cybersecurity platform for behaviour-triggered lateral movement prevention in enterprise environments. Praesidius is designed for the assume-breach era: the operating assumption is that an attacker may already be inside the perimeter, and the job of the platform is to make their next move economically and operationally impossible.

The product uses virtual decoy assets called phantoms. Phantoms have no legitimate business purpose. Any interaction with a phantom is treated as malicious by construction. Signals are observed by watchdog agents, correlated by an on-prem control plane, and converted into containment actions through customer tooling such as Microsoft Defender for Endpoint, Microsoft Entra ID, Active Directory, Cisco Meraki and other security, identity, network and virtualisation platforms.

The immediate company milestone is to take Praesidius from concept and prototype into an enterprise proof of concept with academic/semi-academic support and enterprise design partner engagement. The first funded build is the on-prem version of the platform: a single-node customer-deployable system that proves discovery, phantom placement, malicious-touch detection, provenance mapping, response recommendation/execution and audit evidence generation.

What this person will build

A repeatable adversary-emulation test plan that can be run with design partners and technical evaluators.
Response workflows through Microsoft Defender for Endpoint, Entra ID/Active Directory and selected network controls where available.
Provenance logic that identifies originating asset, source identity, source zone, target phantom and related activity.
A simple but credible yellow/red alert model aligned to reconnaissance versus confirmed malicious behaviour.
Detection logic for high-signal phantom interactions, including SMB enumeration, phantom share access, service touch, authentication attempt and phantom credential use.
A first watchdog/observer capability for Windows-first environments, with Linux support where practical.

What this person will build

Support customer/design-partner conversations with credible practitioner-level security knowledge.
Produce technical evidence for the funding and design-partner process: time-to-detect, time-to-contain, false-positive analysis and evidence-bundle inputs.
Build lab attack scenarios for discovery, credential use, share enumeration and lateral movement simulation.
Integrate response actions such as Defender device isolation, Entra account disablement, Active Directory actions and network containment where available.
Create provenance chain logic that links source asset, source identity, source zone, target phantom and response actions.
Develop phantom interaction tests for SMB shares, identity objects and simple service endpoints.
Implement yellow/red alert classification for the POC, with deterministic rules as the floor and AI-assisted context as an enhancement.
Define signal schemas, normalisation logic and detection rules in collaboration with the platform engineer.
Build or co-build the watchdog prototype that observes endpoint, identity, network and phantom signals at the edge.
Design and implement the POC detection strategy for phantom interactions and lateral movement behaviours.

Required Experience

Strong hands-on cybersecurity experience in threat hunting, detection engineering, incident response, purple teaming, EDR, NDR or SOC engineering.
Practical experience with Microsoft Defender for Endpoint, Microsoft Sentinel, Microsoft Graph, Entra ID and/or Active Directory security
Strong understanding of Windows enterprise environments, authentication flows, endpoint telemetry and common lateral movement techniques.
Ability to write production-quality scripts/services in Python, PowerShell, Go, Rust, C# or similar. Python plus PowerShell is especially relevant for the POC.
Ability to design detections that are explainable, testable and tied to concrete attacker behaviours.
Comfortable working with logs, event pipelines, APIs, endpoint agents, test harnesses and lab environments.
Good understanding of MITRE ATT&CK post-compromise tactics, especially Discovery, Credential Access and Lateral Movement.
Strong judgement around containment risk: when to isolate automatically, when to recommend, when to require operator approval.

Desirable Experience

Experience building or extending EDR/XDR/NDR products, not just using them.
Red team or adversary simulation experience in enterprise Windows environments.
Experience with Sysmon, ETW, Windows event logs, Defender Advanced Hunting, KQL and identity telemetry.
Experience with deception technology, honeypots, honeytokens, decoy credentials or ransomware containment
Experience with network controls such as Meraki, firewalls, NAC, host firewalls or segmentation platforms.
Experience producing evidence for SOC 2, ISO 27001, NIS2 or regulated security reviews.

Pay: £80,000.00-£100,000.00 per year

Work Location: Hybrid remote in London

Quick apply

Refine Your Search

detection & security engineer jobs in ockham, sry

Detection & Security Engineer

Senior Security Operational Centre Engineer

Head of Regional Service

Security Engineer, Detection & Response

Security Engineer

Senior Security Engineer

Security Engineer (SIEM) – SC Eligible – Government Projects

Threat Detection Engineer

Cyber Security Engineer

Infrastructure Engineer

Security Operations Engineer

Security Engineer - Vulnerability

Security Systems Engineer

Graduate Programme 2027: Information Security Engineer (Operations)

Senior Security Engineer, Detection and Response

Protection Scientist Engineer, Integrity

Information Security Engineer (CISO track)

Sr. Backend Engineer, Cloud - Threat Detection / Incident Response (Hybrid, London)

Senior Detection & Threat Engineer

SecOps Engineer

I want to receive the latest job alerts for detection & security engineer in ockham, sry

Related Searches

Explore jobs in more locations

Jobseeker tools

Employer Tools

Browse

Stay Connected