M05 - IT Security Engineer

Role Overview

We are seeking an experienced IT Security Officer to support day-to-day cybersecurity operations, vulnerability management, incident response, security service management, and compliance monitoring across on-premises and cloud environments.

The role involves working closely with infrastructure, application, and security teams, as well as external vendors, to identify security risks, coordinate remediation activities, and ensure compliance with established cybersecurity policies and government security requirements.

Key Responsibilities

Vulnerability Management

• Coordinate vulnerability assessments and remediation activities across servers, endpoints, applications, infrastructure, and Azure cloud environments.
• Utilise vulnerability management tools such as TenableOne, Cloudscape, and equivalent solutions to identify and monitor security vulnerabilities.
• Review vulnerability assessment results, patch compliance reports, and remediation progress.
• Track outstanding vulnerabilities, risk acceptance requests, and remediation exceptions.
• Escalate high-risk vulnerabilities and overdue remediation activities to relevant stakeholders.
• Ensure vulnerability management activities comply with IM8 requirements and internal security policies.

Security Incident Management

• Support cybersecurity incident investigations, response coordination, containment, recovery, and resolution.
• Collaborate with internal teams, the CISO, and external security service providers during security incidents.
• Maintain incident records, investigation findings, and remediation documentation.
• Track post-incident corrective actions and support continuous improvement initiatives.
• Monitor incident trends and recommend improvements to security operations.

DDoS and Web Application Firewall (WAF) Operations

• Support the administration and monitoring of DDoS protection and WAF services.
• Review security alerts, attack reports, and service performance metrics.
• Coordinate WAF policy updates, security rule changes, and service improvements.
• Support investigations involving suspicious web traffic, application attacks, and DDoS incidents.
• Liaise with security vendors to resolve operational issues and maintain service effectiveness.

Security Operations and Stakeholder Coordination

• Coordinate cybersecurity activities across infrastructure, application, facilities management, and external security teams.
• Maintain security risk registers, remediation trackers, and compliance documentation.
• Follow up on action items arising from security assessments, incidents, audits, and service reviews.