Job Title: Cyber Defense Engineer
Company: BeyondTrust Location: Remote (Headquarters: Manchester, UK) Source: We Work Remotely
About BeyondTrust
BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio. Our culture of flexibility, trust, and continual learning means you will be recognized for your growth and the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.
BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats. We are trusted by 20,000 customers, including 75 of the Fortune 100.
The Role
As a Cyber Defense Engineer on our Cyber Defense Operations team, you will serve as a front-line defender responsible for protecting both BeyondTrust’s enterprise infrastructure and the integrity of the products our customers depend on. You will monitor, investigate, and respond to security events in an environment where the stakes are real and the adversaries are capable.
This team is building toward an AI-augmented operating model. You will be expected to use AI-driven tools in your daily work and contribute to how we integrate these capabilities into our detection, triage, and response workflows.
What You’ll Do
Alert Triage & Monitoring
- Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments.
- Investigate alerts to determine scope, severity, and whether escalation is warranted.
- Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect.
- Classify, document, and track alerts through the full lifecycle using ticketing and case management systems.
Incident Response & Investigation
- Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication.
- Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources.
- Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows.
- Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures.
- Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences.
Detection Engineering & Threat Intelligence
- Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms.
- Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins) into actionable detection content.
- Help maintain and evolve detection coverage mapped to MITRE ATT&CK.
- Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts.
AI Integration & Automation
- Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations.
- Contribute to the evaluation, integration, and optimization of AI and automation capabilities.
- Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities.
- Partner with engineering teams to improve log ingestion, data quality, and tool integrations.
Operational Excellence
- Maintain daily operational notes and shift handoff documentation.
- Refine IR runbooks, playbooks, and standard operating procedures.
- Participate in on-call rotation for after-hours incident escalation.
- Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate).
- Participate in tabletop exercises, purple team activities, and post-incident reviews.
What You’ll Bring
- 4+ years of experience in a SOC, security operations, or incident response role.
- Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior.
- Experience with at least one SIEM platform and familiarity with writing search or detection queries.
- Familiarity with EDR platforms and cloud environments (IaaS preferred).
- Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows.
- Strong written communication skills; able to document findings clearly for technical and non-technical audiences.
Nice to Have
- Experience leading or co-leading complex incident response engagements.
- Experience with identity and access management (IAM) and cloud security posture management (CSPM) tools.
- Scripting and automation skills (Python, PowerShell, or equivalent).
- Familiarity with SOAR platforms.
- Experience designing or implementing AI agent architectures or prompt engineering for security use cases.
- Experience building threat intelligence programs or detection-as-code pipelines.
What We Offer
- Competitive salary and pension with up to a 10% annual bonus.
- 25 days’ holiday (increases with length of service) + three weeks' additional leave at seven years' service.
- Fully remote in the UK with up to 4 weeks per year under our Working Abroad policy.
- Bupa Private Healthcare for you and family.
- Medicash Benefit (including opticians and dental cover).
- Life insurance at 4x salary and income protection.
- Paid parental leave and enhanced maternity leave.
- Employee Assistance Programme.
- Opportunity to co-invest and become a BeyondTrust shareholder.
- Investment in AI skills, with Claude Code and Copilot centres of excellence.
- Pluralsight and LinkedIn Learning licenses.
How to Apply
Apply via the BeyondTrust Careers Portal
Learn more at: www.beyondtrust.com