Senior Information Security Engineer

About the role

The Senior Information Security Engineer is a senior technical and leadership role within IFS’s global Security Operations Center (SOC). The role drives advanced threat detection, deep‑dive investigation and major cyber incident response for a fast‑growing global SaaS business.

Key responsibilities

• Lead end‑to‑end response to high‑priority and major cyber incidents, acting as senior technical authority.
• Perform advanced forensic, malware and log investigations, applying a hypothesis‑driven approach.
• Design and deliver SOC maturity initiatives, including detection engineering, automation, tooling consolidation and process redesign.
• Build, tune and continuously improve SIEM detection logic and correlation rules (preferably Microsoft Sentinel).
• Conduct intelligence‑led threat hunts using MITRE ATT&CK and emerging TTPs.
• Champion automation, SOAR playbooks and AI‑assisted tooling to increase SOC efficiency.
• Support vulnerability scanning, risk‑based prioritisation and remediation tracking.
• Create and maintain incident and detection runbooks, ensuring documentation quality.
• Mentor Tier 1/2 analysts, coaching investigative techniques and fostering a culture of curiosity.
• Contribute to SOC KPI reporting, ISMS audit readiness and continuous improvement of policies.
• Maintain deep proficiency across SOC tooling and influence tooling strategy and budget planning.

Required profile

• 5+ years experience in a Security Operations Center or cyber‑defence function, preferably in a fast‑growth organization.
• Proven track record of developing SOC capability and delivering transformation programs.
• Hands‑on experience leading major cyber‑incident responses from triage to executive reporting.
• Strong analytical and investigative mindset with a genuine curiosity for root‑cause analysis.
• Excellent written and verbal communication, able to brief non‑technical and executive stakeholders.
• Degree in Cyber Security, IT, Computer Science or equivalent experience.

Required skills

• SIEM platforms – especially Microsoft Sentinel.
• Endpoint Detection & Response – Microsoft Defender for Endpoint.
• SOAR platforms and playbook development.
• KQL query language and scripting (Python preferred).
• Threat intelligence platforms and MITRE ATT&CK framework.
• Cloud security concepts for Azure and AWS.
• Automation and AI‑enhanced detection techniques.
• Relevant certifications such as CISSP, CISM, GCIH, GCIA, CEH, Azure SC‑200, AZ‑500.