Cyber Security Engineer SoC / SIEM (Contract)

Methods Business and Digital Technology Limited

Methods is a £100M+ IT Services Consultancy who has partnered with a range of central government departments and agencies to transform the way the public sector operates in the UK. Established over 30 years ago and UK-based, we apply our skills in transformation, delivery, and collaboration from across the Methods Group, to create end-to-end business and technical solutions that are people-centred, safe, and designed for the future.

Our human touch sets us apart from other consultancies, system integrators and software houses - with people, technology, and data at the heart of who we are, we believe in creating value and sustainability through everything we do for our clients, staff, communities, and the planet.

We support our clients in the success of their projects while working collaboratively to share skill sets and solve problems. At Methods we have fun while working hard; we are not afraid of making mistakes and learning from them.

Predominantly focused on the public-sector, Methods is now building a significant private sector client portfolio.

Methods was acquired by the Alten Group in early 2022.

Requirements

Responsibilities & Requirements

• Elastic Stack Expertise :

Demonstrable expertise across the Elastic Stack, particularly in the use of Kibana for creating advanced visualisations, dashboards, queries, and alerts. You must hold a valid Elastic Certified Analyst certification, with full working knowledge of the competencies it covers, including anomaly detection, dashboard tuning, and timeline analysis.

Build, manage and optimise complex Logstash pipelines , utilising a wide range of plugins to handle diverse log formats, transform data, and enrich security telemetry. Ensure reliable ingestion of logs from both structured and unstructured sources into Elasticsearch.

Configure, manage rsyslog and configure centralised logging for network appliances , firewalls, and infrastructure components to ensure visibility and completeness of data collection.

Administer and troubleshoot Linux-based systems, with command-line fluency and scripting ability (e.g. Bash, Python) to support SIEM operations, log parsing, and agent deployment.

Develop and tune custom detection rules using ESQL , EQL , and Lucene syntax to identify malicious activity. Use MITRE ATT&CK-aligned techniques and contribute to the design of the detection roadmap. Create and maintain bespoke investigation guides to assist SOC analysts in conducting triage and escalation.

Contribute to the development of SOC processes and policies , including detection logic lifecycle, alert tuning procedures, and SIEM configuration governance. Play a key role in maturing the operational use of SIEM tooling and automation within the SOC environment.

Prepare formal documentation in line with Defence Writing principles , with an understanding of Joint Service Publications (JSPs) , particularly in areas related to cybersecurity governance, incident response, and monitoring operations.

Support the incident response lifecycle through alert review, case triage, evidence handling, escalation, and forensic data support. Ensure cases are documented comprehensively and aligned with operational SOPs and client expectations.

Communicate technical information clearly and confidently to both internal stakeholders and external clients. Collaborate with multidisciplinary teams, report findings effectively, and represent security operations during client interactions and project reviews.

Desirable Skills and Experience

Qualifications :

This role will require you to hold active SC and / or DV - If DV isn't held, then you will have to be eligible for DV.

Benefits