Senior Security Engineer

In this role you will own threat detection, response and prevention for Duco’s AWS-hosted SaaS platform. You’ll lead the SIEM and managed SOC, shaping detection strategy and incident response. You’ll ensure run-time security across our AWS estate and collaborate with Engineering, Platform and IT to strengthen security. This is a hands-on, impact-focused opportunity in a collaborative security team.

• competitive salary
• annual performance-based bonus
• private medical insurance
• life assurance
• unlimited annual holiday
• flexible working policy

• Own run-time security posture of the AWS environment, including IAM, guardrails, logging, and remediation
• Secure corporate environment (Google Workspace, endpoints, SaaS apps) with defined identity and device security standards
• Lead infrastructure vulnerability management and prioritise remediation with Platform and IT teams
• Develop and oversee external attack surface management
• Coordinate infrastructure and external penetration testing from scoping to remediation
• Own the SIEM platform: onboard log sources, develop detections, align coverage with MITRE ATT&CK
• Manage the internal SOC relationship, including escalation runbooks, reviews, triage, and SLAs
• Lead end-to-end security incident response and post-incident analysis
• Monitor threat landscape and propose enhancements to detection/response
• Automate security processes via scripting and infrastructure-as-code
• Deliver operational security metrics for risk reporting and KRIs
• Support audits and client assurance by evidencing control effectiveness

• Proven experience in security operations or cloud security engineering
• Hands-on SIEM experience: design/tune detections and respond to alerts
• In-depth AWS security knowledge: IAM, Organizations/SCPs, CloudTrail, GuardDuty, Security Hub, KMS, VPC
• Experience with container/Kubernetes runtime security, ideally on Amazon EKS
• Track record leading security incident response in cloud environments
• Experience with managed SOC/MDR providers
• Python or equivalent scripting for automation
• Working knowledge of infrastructure-as-code
• Ability to communicate risk clearly to non-technical stakeholders

• Clear communicator
• Collaborative mindset
• Problem-solving with a risk-focused approach
• SIEM design and tuning
• AWS security services and architecture
• EKS/Kubernetes security