Senior Cyber Security Engineer

Role Overview:

Senior technical owner of the company’s cybersecurity controls, with particular responsibility for application security and for security audit and compliance.

Key Responsibilities:

• Application security: embed security into the SDLC, threat modelling, secure code review and remediation follow-up.
• Penetration testing: scope and manage internal and third-party application and infrastructure tests, and drive findings to closure.
• Security audit: lead internal and external audits, customer assessments and certification cycles; prepare evidence and close findings.
• Compliance and frameworks: maintain controls, policies and standards against ISO 27001, NIST CSF / CIS Controls and applicable regulation.
• Risk management: identify, assess and report information security risks and track treatment plans.
• Vulnerability management: run the scanning and patching cycle with risk-based prioritization and SLAs.
• SIEM and monitoring: maintain log coverage, correlation rules and alert tuning; ensure critical systems are monitored.
• EDR / endpoint security: administer and tune the EDR/XDR platform, maintain coverage and perform threat hunting.
• Network and perimeter security: manage Fortinet FortiGate firewall policies, IPS and web filtering, SSL inspection, VPN and rule recertification.
• Identity and access management: govern authentication, MFA, SSO, privileged access and periodic access reviews.
• Cloud security: define and verify hardening baselines and configuration for Azure.
• Data protection: set standards for encryption, key management, data classification and DLP.
• Incident response: act as senior responder; maintain and exercise playbooks and lead post-incident reviews.
• Third-party security: assess vendors and SaaS providers and set contractual security requirements.
• Awareness and reporting: deliver security training and phishing simulations; report metrics to management.