Security Engineer

Comply365; Bristol; On-site; GBP 40,000 - 80,000; Full time

Job description

About Comply365

Comply365 is a leading provider of Operational Content Management, Safety Management, and Training Management in the highly regulated industries of Aviation, Defense, and Rail. We provide a powerful combination of expertise and products underpinned by unified best practices, empowering airlines, rail, and defense organizations with the most comprehensive product portfolio to elevate operational excellence, and transform safety management and training, with closer integration of data across these domains. Comply365 ensures our customers' teams and assets are always geared for peak operational performance and unlocks unparalleled financial and operational gains through more streamlined, robust, and agile operations.

Our culture truly sets us apart at Comply365. In addition to our unwavering dedication to our customers and products that we offer, we are, first and foremost, a diverse team of driven, energetic, and passionate individuals who work together to make a direct impact on the future of our company. We have built, and continue to build a world-class, dynamic, and people-first culture. We believe in celebrating one another's achievements, open communication, and transparent leadership.

About the Position

We're seeking a Security Engineer to join our team and ensure our rapidly growing platform remains secure for users worldwide. In this role, you'll handle security assessments, prioritise remediation actions, and work closely with Product and Operations teams. You'll also design and maintain security controls, enhance monitoring, and foster a security-first culture across the company.

As a person, you'll be proactive rather than reactive, able to build cross functional relationships and be able to articulate value and represent data in a way that can be consumed at all levels.

Key Duties and Responsibilities

• Conducting security assessments and prioritising findings for remediation.
• Designing and maintaining application and infrastructure security controls.
• Enhancing security monitoring to detect abnormal behaviour.
• Implementing firewalling to add extra layers of protection against security breaches.
• Reviewing and troubleshooting parts of the system to identify how to enhance security.
• Reporting results of security metrics to the Technology Operations management.
• Developing documentation for external threats.
• Responding to security incidents.
• Coordinating incident response across teams.
• Performing security assessments and work with development teams on application security.
• Promoting security awareness and working with our training team to develop effective training within the company.

Key Skills and Qualifications

• Strong knowledge of system and network security, protocols, and best practices, including ISO27001, SOC2 and Cyber Essentials controls.
• Experience with firewalls, intrusion detection systems, anti-virus software, and data encryption.
• Knowledge of risk assessment tools, technologies, and methods.
• Experience designing secure networks, systems, and application architectures.
• Eligible for SC Clearance (lived in the UK for 5 years or more).

Vulnerability Management

• Carry out internal vulnerability assessments in line with industry best practice.
• Manage our 3rd party penetration testing (Continuous Security Testing) service, review of reports and ensure technical teams resolve defects in a timely manner.
• Ensuring our automated scanning tools (Nessus and Qualys) are maintained, provide the right coverage, and all findings are notified to relevant teams.
• Ensuring AWS Shield / AWS WAF / Akamai / Firewalls and other similar tools/configuration are operating effectively.

SIEM

• Lead and improve SIEM processes across the business.

Logging and Auditing

• Ensuring standards are updated and clearly understood across the business.
• Ensure collected data is useful and actionable.

Office 365, DLP and Endpoint Security

• Policy changes to secure devices are in place and suitable.
• Security updates are applied to protect the business.
• Data loss prevention and labelling for the classification and protection of data.

Security Benchmarks

There are several key security benchmarks that we base our current security programs on, these are:

• Centre for Internet Security (CIS - non-profit cross industry body),
• National Cyber Security Centre (NCSC - UK Government Backed) and,
• National Institute of Standards and Technology (NIST (800-53) - US Government backed).

Why come aboard?

We can't promise you a bar in far Bombay, but we have a range of benefits including considerations for healthcare, private medical insurance, 27 days holiday rising with length of service, buy/sell up to 3 days holiday, work life balance, and many more! For more information on our full range of benefits, please visit our website Comply365_Benefits_UK.pdf.