We’re seeking a Preventative & Threat Engineer to proactively prevent, detect, and respond to security incidents across cloud and on-prem environments. You’ll work hands-on with SIEM and SOAR platforms, monitor threat intelligence feeds, and use frameworks like MITRE ATT&CK to understand attacker tactics, techniques, and procedures. From uncovering indicators of compromise to hypothesising new threats, you’ll transform intelligence into actionable defenses that protect critical systems and data.

This is a technical, hands-on role where analysis, automation, and rapid response converge. You’ll examine large data sets for anomalies, develop scripts and tools in Python, deploy countermeasures under pressure, and optimise SOC operations across AWS, Azure, and GCP environments. Supporting incident response and resilience planning, you’ll ensure the organisation stays ahead of evolving cyber threats. If you thrive in dynamic, high-stakes environments and want to shape the front line of defence, this could be your mission.

What You’ll Do

You’ll join the frontline of cyber defence, where intelligence becomes action, and action becomes protection.

In this role, you will:

• Proactively help prevent, detect, and respond to cyber threats across cloud and on‑prem systems.

• Support threat‑hunting missions, hypothesising attacker behaviour and uncovering indicators of compromise.

• Work closely with senior engineers to develop new, innovative defence strategies against emerging threats.

• Monitor global threat intelligence feeds and identify high‑risk indicators, APT activity, and suspicious patterns.

• Analyse attacker TTPs using frameworks like MITRE ATT&CK, shaping detection logic and defensive tactics.

• Use threat-hunting maturity models and structured processes to deepen investigation outcomes.

• Capture attacker behaviours, convert them into detection logic, and recommend improvements to security controls.

• Support incident response teams, helping contain, mitigate, and recover from active threats.

• Participate in an on‑call rotation, responding to security events during critical windows.

Need to Have - Your Essentials

• Hands-on experience with SIEM and SOAR technologies

• Strong understanding of security fundamentals, vulnerabilities, and defensive principles

• Ability to proactively identify and escalate threats in fast-moving environments

• Familiarity with cloud security concepts across AWS, Azure, and GCP

• Understanding of security automation tools, able to streamline SOC workflows

• Ability to analyse large, complex data sets and identify anomalies or behavioural patterns

• Strong scripting experience (especially Python) to automate processes or build investigative tools

Nice to Have

• Experience with threat hunting methodologies or cyber kill-chain analysis

• Familiarity with incident response procedures and playbooks

• Ability to map attacker behaviour using MITRE ATT&CK or similar frameworks

• Experience in SOC environments or high-security operational teams

• Exposure to cloud-native defensive tooling and logging services

You don’t need to be an expert in every tool - we value curiosity, learning mindset, and growth

Why You’ll Love This Role

Because this is where cybersecurity becomes mission‑critical.

You won’t just watch alerts, you’ll outthink attackers.

You’ll work with cutting‑edge tooling, real-time intelligence, and multi-cloud environments to stop threats before they become incidents. You’ll develop scripts, build automations, shape defensive strategies, and play a key role in protecting the organisation’s most valuable assets.

If you want a role where your decisions matter, your actions have impact, and your work strengthens the entire cyber defence posture, this is the place to make your mark.