Cyber Security Engineer

First Central

25d•Hybrid

About The Position

At 1st Central, everything starts with our people. As one of the UK’s leading motor and home insurers, we use smart technology, data and great service to make insurance fast, fair and simple for over 1.4 million customers. We’re proud to create an environment where people feel supported, trusted and able to grow - whether that’s developing new skills, taking on fresh challenges or making a real impact every day. If you’re looking for a role where you can make a difference, we’d love to hear from you. We’re looking for a Cyber Security Engineer to join our Cyber and Information Security team, this technically focused role is responsible for implementing, maintaining and improving specialist cyber security controls, tooling, telemetry and automation across the organisation. Working closely with teams across Technology & Data you’ll ensure that security controls are designed in line with best practice and are effective, scalable and aligned to business and regulatory requirements. We’re big on flexible hybrid working. This role is predominantly home-based, with just one day a week in the office in either Salford Quays (Manchester), Haywards Heath (West Sussex) or Guernsey. Of course, if you’d like to spend more time working alongside the team, you’re always welcome to come into the office more frequently.

Requirements

Practical experience in cyber security engineering, security platform engineering or a closely related technical security role.
Hands-on experience with Microsoft security technologies, such as Defender XDR, Purview, Sentinel, Defender for Cloud, Entra security capabilities.
Experience with Security Copilot and other AI defence capabilities highly desirable.
Experience implementing and maintaining security telemetry, integrations, automation and response workflows.
Knowledge of cloud security controls and Azure security concepts, while working effectively with separate cloud platform and operations teams.
Understanding of identity security, workload identities, privileged access, Conditional Access and non-human or agent identity risks.
Experience supporting detection engineering, incident response, vulnerability or exposure management and control validation.
Understanding of DevOps, CI/CD and secure delivery practices in an Agile, value-stream environment.
Understanding of security frameworks, such as ISO27001, NIST and PCI-DSS.
Relevant technical security qualification or equivalent experience, for example AZ-500, SC-200, SC-300, SC-100, CISSP or similar.
Strong technical troubleshooting and analytical skills.
Ability to automate security activities using scripting, APIs, workflow tools or infrastructure-as-code approaches.
Excellent communication and stakeholder management skills, with the ability to explain technical security matters clearly.
Good organisational skills and the ability to manage engineering priorities across multiple stakeholders.

Nice To Haves

Experience with Security Copilot and other AI defence capabilities highly desirable.

Responsibilities

Engineer, configure and maintain cyber security controls across the Microsoft security estate, including Microsoft Defender XDR, Microsoft Sentinel, Microsoft Defender for Cloud, Entra, Microsoft Purview and associated integrations.
Develop and maintain security telemetry, data connectors, alerting integrations, workbooks and technical monitoring coverage across cloud, identity, endpoint, email, applications and agentic services.
Build, test and maintain security automation, orchestration and response workflows, including SOAR playbooks and approved automated containment actions.
Implement and maintain technical security policies, baselines and guardrails defined by Information Security, Cyber and Architecture.
Work with Cyber and the SOC to translate threat intelligence, incident learning and detection requirements into effective technical controls and monitoring capabilities.
Support the engineering and continuous improvement of security controls for end users, Azure workloads, cloud services, identities, workloads and non-human or agent identities.
Integrate security controls into DevOps and value-stream delivery practices, including relevant security tooling, telemetry and automated control checks.
Contribute to the implementation of runtime controls, monitoring, containment and security guardrails for AI agents, autonomous workflows and connected tools.
Contribute to the implementation and maintenance of AI defence capabilities.
Monitor the health, coverage, effectiveness and lifecycle of cyber security tooling, identifying control gaps, technical debt and opportunities for rationalisation or automation.
Provide technical support to cyber incident investigations, threat hunting, control validation and recovery activities when required.
Remediate and/or work with Technology teams and value streams to support the remediation of security weaknesses and confirm that corrective controls have been implemented effectively.
Undertake Cyber control reviews of 3rd party platforms and integrations against best practice.
Maintain technical documentation, configuration standards, operating procedures and evidence relating to security platforms and controls.
Assess proposed technical changes to security tooling and controls, identifying risks, dependencies and implementation requirements.
Contribute to cyber metrics and reporting, including control coverage, platform health, automation effectiveness and remediation progress.
Ensure compliance with company policies, security standards and relevant regulatory requirements at all times.
Comply with the requirements, and act in accordance with, the Group Code of Conduct and Fitness and Propriety policies at all times.