Security Operations Engineer

About this role

We are looking for a Security Operations Engineer to own day-to-day operational security for our EMEA region. You join a young regional Information Security function in a high-tech manufacturing business, working alongside the Regional Information Security Officer, who leads security governance, risk and compliance. Our environment spans corporate IT, plants and OT systems across several countries, with central security services provided by our global HQ.

Security here is risk-based and proportionate i.e. improvements are planned, prioritized and delivered through system owners, IT Operations and HQ Security, not by owning the systems yourself. You will help build and mature our operational security processes rather than run an established SOC. Improvement work moves at the pace of change windows and production; incident response does not, and you will be the person who acts quickly when it counts.

Key responsibilities Security monitoring and triage Act as EMEA's operational point of contact for HQ Security and its monitoring services like triage alerts, notifications and findings, route them to the right system owner and follow them through to evidenced closure. Use the security monitoring tools (SIEM, EDR/XDR, email security, Microsoft 365/Entra ID) to investigate suspicious activity in EMEA. Identify detection gaps for EMEA and define use cases and tuning requests for the centrally operated platforms.

Incident response Handle EMEA security incidents end to end including initial assessment, investigation, evidence collection, containment and coordination with HQ Security, IT Operations and the business. Build and maintain incident response runbooks for the most likely EMEA scenarios (e.g. account compromise, phishing and business email compromise, malware, supplier fraud). Analyze root causes, track remediation actions and prepare clear incident reports covering technical findings, impact and lessons learned.

Provide the technical input for regulatory and customer notifications; the decision to notify seats with the Regional ISO, Legal and management Vulnerability management Run the regional vulnerability management cycle: authenticated scanning, prioritization by risk, routing to owners and verification of remediation by rescan. Scope, coordinate and follow up external penetration tests. Keep endpoint protection and EDR coverage of the EMEA estate complete and healthy, working with IT Operations and HQ.