Information Security Engineer, Starling Bank

• Promote cyber security standards, procedures & guidelines, and best practices outside the security functions
• Strong communication and interpersonal skills including the ability to explain complex security concepts to technical and non-technical audiences
• Ability to engage and communicate with senior stakeholders and support teams across any number of business functions
• Understanding of cyber security controls across different technology architectures including cloud (AWS, GCP)
• Design, development (including scripting and configuration) and continuous improvement of security solutions
• Security development lifecycle and deployment
• Champion efforts to secure business processes and data through collaboration
• Understanding and awareness of security principles including privileged access, role based access technologies and approaches
• Innovation mindset
• Enjoy problem solving
• Be self motivated and want to continue to learn and develop and challenge
• Programming skills e.g. Python, Go, Java, Rust
• Engage with the broader security community within and external to the organisation

Desirable

• The opportunity is to develop and deliver your engineering and/or analyst skills within the Cyber security group, we recognise that an individual's professional development, strengths and preferences will change over time and so will the demands and opportunities within the bank
• Provide leadership and direction during High Priority incidents. Demonstrate command and control, whilst maintaining an overall incident perspective and ensuring the Incident Management processes are followed
• Produce clearly written Post-Incident reporting, and conduct Post-Incident Reviews to ensure lessons learned and remediation steps are implemented
• Acting as Engineering liaison, providing SME knowledge on infrastructure during an incident
• Participate and contribute to threat led investigation and exercise activities providing guidance and recommendation on improvements for implementation
• Stay abreast of current industry trends relevant to the business and cybersecurity
• Identify, prioritise, define, and enhance log ingestion (including new sources) into the organisations SIEM & SOAR enabling continuous improvement in event detection, incident analysis and response
• Enable and continuously improve the automation of processes within the wider security operations team leading to effective, timely and scalable response in the evolving threat landscape
• Support the development of log pipelines to the SIEM, collaborating with wider technology teams across requisite architecture, in particular data engineering
• Support the development and continuous improvement of log parsing capabilities
• Ensure technical development within security operations is aligned to wider system development life cycle and operating procedures
• Ensure security operations development and automation is clearly documented providing knowledge share to the wider security operations team as appropriate
• Act as a subject matter expert, review and advise on security log architecture to enable development of effective detection controls and performant log ingestion
• Evaluate new solutions and improvements to existing telemetry and processes based on incident outcomes and capability assessments; identify and propose practicable proportionate improvements
• Continually develop and maintain knowledge and expertise on the Bank proprietary systems, security model and wider security best practices
• Collaborate with the wider Security operations team in the definition and execution of training to ensure effective security event and incident management procedures
• Collaborate with the wider Security and business teams to enable continuous improvement in the efficacy of security information and event management control environment
• Acting as Engineering liaison, providing SME knowledge on security operations infrastructure and information analysis during an incident
• Support and guide further Information Security Engineers within the Security Operations team in the delivery of new capabilities and continuous improvement of team solutions
• Participate in cyber security team hiring procedures as required

• Overall personality and general interview - Reporting manager - 30 minutes
• Role based competency - Security team - 1.5 hours
• Final Interview - Leadership - 30 minutes