SOC Platform Engineer (AI, Wazuh, Graylog and Linux)

About the role

UK Cyber Defence Ltd is looking for a mid-level SOC Platform Engineer to help run the platform that underpins our Security Operations Centre. You will work directly with our Head of Threat Disruption, who built the platform, and you will learn it thoroughly, share its day-to-day running and progressively take ownership of parts of it, so that the knowledge lives in a team rather than in one head.

This is a platform and infrastructure role rather than a triage-desk role. First and second line alert analysis is carried out by Emily, our AI analyst. You will make sure the alerts she works from arrive, are correct and can be trusted, and you will be the engineer she turns to when she meets something she cannot close herself. The role is also client-facing: speaking to customers by telephone, on Teams and in chat is a normal part of the week.

Your first year is a structured training year. We do not expect you to know our platform or Emily on the first day. By the end of the year, we expect you to be able to run the platform and handle Emily's escalations without needing to ask.

Key responsibilities

You will operate and maintain our multi-tenant Wazuh manager estate, including the managers, the load-balanced agent enrolment and event paths, agent groups and the per-client portals. You will run the Graylog and OpenSearch logging tier behind it, keeping the cluster healthy, managing index lifecycle policies and hot, warm and cold tiers, and planning capacity. You will administer the hardened Ubuntu hosts, load balancers, collectors and telemetry receivers that make up the platform, in our own data centre and in the cloud.

You will write and tune Wazuh decoders and rules, including PCRE2-based decoders for awkward log formats, mapping detections to MITRE ATT&CK. You will onboard new client log sources, from endpoint agents and firewalls to cloud tenants and Microsoft Sentinel integrations, and make sure each feed is parsed correctly and monitored for silence. You will maintain the Nagios monitoring that watches the platform itself, and help manage our Cyber Essentials Plus and DCC technical compliance programmes.

You will operate Emily day to day and help maintain her, keeping her data feeds healthy and feeding back the cases where she got it wrong. You will investigate the escalations she raises, take them through to closure where you can, and escalate to the Head of Threat Disruption with a clear account of your findings where you cannot. You will deal directly with clients, walking their IT staff through an agent installation, explaining what an alert means in plain language and keeping them informed while an incident is worked.

You will also diagnose difficult problems such as file descriptor exhaustion or misrouted enrolment traffic, write up the root cause, and produce and improve scripts, run-books and documentation. You will take part in change control and patching cycles.

Essential skills and experience

Solid, practical Linux administration on Ubuntu or a comparable distribution, including systemd, networking, storage, process limits, TLS certificates and a full working day in the shell. Experience running at least one SIEM or log management platform in production; Wazuh is preferred, but Elastic, OpenSearch, Graylog, Splunk or Security Onion experience transfers well. A working understanding of how logs travel from source to searchable index. Bash and Python scripting sufficient to automate operational tasks safely, and confidence with regular expressions.

You should be able to diagnose problems methodically under pressure, verify rather than assume, and write a clear post-incident summary in plain English. You should take direct technical challenge without taking it personally and give it back with the same honesty. You should have a hardened-by-default mindset: least privilege, minimal attack surface and secrets kept out of scripts. You must be comfortable dealing with clients by telephone, on Teams and in chat, including when the news is unwelcome. You must have the right to work in the United Kingdom without sponsorship and be willing to undergo background checks to BPSS level.

Desirable

• Hands-on Wazuh decoder and rule writing;
• Graylog and OpenSearch or Elasticsearch cluster administration;
• HAProxy;
• Nagios, Zabbix or similar;
• Microsoft Sentinel or Azure Log Analytics;
• familiarity with MITRE ATT&CK;
• MySQL and PHP;
• Linux or SIEM certifications such as Linux+, LPIC, RHCSA, Security+ or CySA+;
• managed service provider experience;
• involvement in the security community;
• and an interest in working alongside AI-driven analysis.

The working arrangement

The role is permanent, full-time and fully remote within the United Kingdom, working UK office hours. Our SOC runs on UTC. Out-of-hours work is occasional and by arrangement, for planned maintenance windows and major incidents, and is not a standing on-call rota. We provide the equipment you need, and you will be mentored by a veteran of the field who wants you to be able to do everything he can do.

If you would like to apply, please include a short note on a problem you diagnosed that you were proud of, and links to any talks, repositories or write-ups you would like us to see.