Security Engineer L3

About the Role

We are seeking an experienced L3 Security Engineer to lead security engineering, architecture, and continuous improvement across multiple customer environments within a Managed Service Provider (MSP).

This senior technical role goes beyond security monitoring and alert triage. You will design and implement security controls, lead vulnerability remediation, strengthen compliance, resolve complex security incidents, and establish consistent security standards across customer environments.

Working closely with infrastructure teams, service desk engineers, Account Managers, and customers, you will take ownership of security outcomes while mentoring junior engineers and driving a proactive approach to cybersecurity.

About the Client

You will be working with a technology and managed services provider supporting multiple customer environments. The organisation is focused on strengthening cybersecurity, improving service delivery, and developing scalable security standards that help customers reduce risk and maintain resilient IT environments.

Ideal Profile

Technical Expertise

Significant experience within an MSP, MSSP, or IT Service Provider environment

Strong hands-on experience with Microsoft Defender and its security ecosystem

Advanced experience with Sophos Firewall and endpoint security technologies

Proven experience managing vulnerability and patch management programs

Experience implementing security controls across Microsoft 365 environments

Strong knowledge of Microsoft Entra ID and Zero Trust security principles

Solid understanding of networking fundamentals, including TCP/IP, DNS, DHCP, VLANs, routing, firewalls, VPNs, and network segmentation

Strong Windows Server and endpoint troubleshooting capabilities

Experience handling complex technical escalations and leading remediation activities

Ability to design and implement practical security improvements rather than simply identify risks

Security Platforms & Technologies

Hands-on experience with ConnectSecure and Huntress is highly desirable

Experience with Sophos ZTNA, Microsoft Intune, Microsoft Defender XDR, and Conditional Access is advantageous

Familiarity with Microsoft Defender for Endpoint, Office 365, Identity, and Vulnerability Management

Knowledge of Essential Eight, CIS Controls, NIST Cybersecurity Framework, and ISO 27001

PowerShell scripting and API-based automation experience is beneficial

Familiarity with MSP PSA platforms such as HaloPSA, ConnectWise, or Autotask

Relevant Microsoft, Sophos, or cybersecurity certifications are advantageous

Security Architecture & Compliance

Experience assessing security architectures and identifying technical weaknesses

Ability to translate compliance requirements into practical security controls

Strong understanding of cybersecurity threats, attack techniques, and defensive measures

Experience developing remediation strategies, security baselines, and technical standards

Ability to prioritise vulnerabilities based on exploitability, exposure, asset criticality, and business impact

Leadership & Communication

Strong written and verbal English communication skills

Excellent technical documentation and reporting capabilities

Ability to lead complex remediation activities and provide technical direction

Confidence making technical decisions and challenging inadequate security practices

Strong problem-solving skills and a methodical approach to incident investigation

Ability to remain calm during critical incidents while considering customer priorities and operational impact

A proactive mindset focused on root causes, automation, standardisation, and preventing recurring issues

Responsibilities

Security Architecture & Technical Leadership

Act as a senior technical authority for security across multiple customer environments

Design, review, and improve customer security architectures

Establish security standards, recommended configurations, and repeatable best practices

Identify architectural weaknesses and develop remediation roadmaps for complex or high-risk issues

Review security solution designs and support customer onboarding, migrations, and major infrastructure changes

Mentor L1 and L2 engineers and strengthen internal security capabilities

Lead complex security escalations and configuration investigations

Microsoft Defender

Administer, configure, and optimise Microsoft Defender security solutions across customer environments

Design and implement Defender policies and standard configurations

Configure and maintain Attack Surface Reduction rules, endpoint detection and response, automated investigation, web filtering, endpoint firewall policies, device control, antivirus, and tamper protection

Investigate complex security incidents involving endpoints, identities, email, and cloud environments

Use Microsoft Defender XDR to conduct advanced threat analysis

Review Secure Score, vulnerability data, and security exposure to identify improvement opportunities

Support migrations from third-party endpoint security platforms where appropriate

Identify opportunities to improve Microsoft licensing utilisation and security capabilities

Sophos Firewall & Endpoint Security

Provide senior technical support and architecture guidance across Sophos security environments

Design and review firewall deployments and establish standard configuration baselines

Configure and optimise firewall rules, network segmentation, NAT, intrusion prevention, web filtering, application control, VPNs, SD-WAN, high availability, logging, and monitoring

Troubleshoot complex firewall, connectivity, and endpoint security issues

Review configurations for security weaknesses and unnecessary exposure

Manage Sophos Central and endpoint security policies

Support firmware upgrades, migrations, firewall refreshes, and security platform consolidation

Zero Trust Network Access

Design, implement, and maintain Zero Trust Network Access (ZTNA) solutions

Develop secure application access models based on user identity, device health, application requirements, location, authentication risk, and access needs

Apply least-privilege principles and integrate ZTNA with Microsoft Entra ID

Reduce reliance on traditional VPN technologies where appropriate

Troubleshoot complex ZTNA and authentication issues

Assess existing remote access environments and develop Zero Trust migration strategies

Establish repeatable ZTNA deployment standards across customer environments

Vulnerability Management

Own and improve the vulnerability management approach across customer environments

Review ConnectSecure findings and prioritise remediation based on exploitability, internet exposure, asset criticality, and business impact

Lead remediation of critical vulnerabilities and investigate recurring issues

Develop remediation strategies involving patching, configuration changes, network segmentation, application upgrades, compensating controls, firewall changes, platform migrations, or software replacement

Identify unsupported and end-of-life systems and develop remediation or replacement plans

Track unresolved vulnerabilities and ensure appropriate risk decisions are made

Validate remediation through rescanning and verification

Develop vulnerability dashboards, reporting, remediation standards, and technical security roadmaps

Huntress Security

Provide senior-level support for Huntress deployments across customer environments

Investigate advanced detections and SOC escalations

Analyse persistent footholds, suspicious applications, and unusual system activity

Ensure agents and services are deployed correctly and endpoints are appropriately protected

Assess SOC recommendations and coordinate suitable technical responses

Identify recurring trends and use findings to strengthen security standards

Establish processes for resolving escalations within agreed timeframes

Patch Management

Provide technical oversight of operating system a