Area Lead - Security Engineering

Area Lead owns the security operations, vulnerability management, identity governance, and NIS2 compliance posture for the managed infrastructure estate.

Responsibilities

• Own end-to-end security service delivery: SIEM monitoring, alert triage, vulnerability scanning, patch compliance tracking, endpoint protection, and identity/access governance
• Hold EPAM's NIS2 compliance sign-off chain for managed infrastructure - own audit evidence and regulatory reporting
• Lead security transition-in: tooling onboarding, runbook authorship, current-state risk assessment, and knowledge transfer from incumbent vendors
• Govern a team of 6 offshore security engineers across operations, incident response, and change security reviews
• Interface directly with the client's CISO team and retained SOC function
• Drive security posture improvement - KPIs, metrics, and continuous improvement cycles
• Manage security incidents through the escalation chain to the client

Requirements

• 7+ years in security engineering or SOC operations
• Microsoft Sentinel - SIEM administration, detection rule authoring, alert triage
• Microsoft Defender - EDR management and policy governance
• Tanium - endpoint visibility and remediation
• Tenable - vulnerability scanning, prioritisation, and reporting
• Microsoft Entra ID - PIM, conditional access, identity governance
• CyberArk - PAM vault operations and onboarding
• CyberArk EPM - shadow IT and endpoint privilege management
• Palo Alto Cortex / Prisma - cloud security posture (migration from Prisma to Cortex in progress)
• NIS2 Directive - working knowledge of compliance requirements and evidence chains
• MSP or outsourcing background - experience governing remote delivery teams
• English - fluent; German or Czech - strong asset

Nice to have

• CISSP, CISM, or equivalent
• Microsoft SC-200 (Security Operations Analyst)