Asks for

The ad says“Solid understanding of cloud-native infrastructure (AWS, Kubernetes/EKS) sufficient to assess and prioritise risk and to direct Platform Ops on remediation, without owning infrastructure changes directly”
The ad says“Understanding of endpoint protection technologies and policy configuration, including Microsoft 365 security tooling (e.g. Defender, Intune, Conditional Access)”
The ad says“Understanding of endpoint protection technologies and policy configuration, including Microsoft 365 security tooling (e.g. Defender, Intune, Conditional Access)”
The ad says“This is a security role built for someone who wants to own the threat, not just log it. As Security Engineer, you’ll be the person who understands what’s actually at risk across a modern Cloud native microservice platform and our internal IT estate, from SIEM alerts to Microsoft 365 endpoint security, and who sets the priorities that matter. You won’t be buried in compliance paperwork. You’ll direct a capable Platform Ops team on remediation while you stay focused on the threat picture, the tooling and the DevSecOps thinking that keeps CV-Library ahead of it.”
The ad says“Apply GDPR and data protection principles to ensure security controls, processes and documentation meet regulatory expectations”
The ad says“Working knowledge of Identity and Access Management principles”
The ad says“Strong incident response and threat intelligence skills, including SIEM-based monitoring and triage”
The ad says“Understanding of endpoint protection technologies and policy configuration, including Microsoft 365 security tooling (e.g. Defender, Intune, Conditional Access)”
The ad says“You’ll report directly to the Platform & Service Operations Manager, with a genuine mandate to shape how security is done, not just document it. Compliance still matters, and you’ll keep ISO 27001 documentation and audit evidence in good shape as you go, but it’s the by-product of doing security well, not the job itself.”
The ad says“Solid understanding of cloud-native infrastructure (AWS, Kubernetes/EKS) sufficient to assess and prioritise risk and to direct Platform Ops on remediation, without owning infrastructure changes directly”
The ad says“This is a security role built for someone who wants to own the threat, not just log it. As Security Engineer, you’ll be the person who understands what’s actually at risk across a modern Cloud native microservice platform and our internal IT estate, from SIEM alerts to Microsoft 365 endpoint security, and who sets the priorities that matter. You won’t be buried in compliance paperwork. You’ll direct a capable Platform Ops team on remediation while you stay focused on the threat picture, the tooling and the DevSecOps thinking that keeps CV-Library ahead of it.”
The ad says“Understanding of endpoint protection technologies and policy configuration, including Microsoft 365 security tooling (e.g. Defender, Intune, Conditional Access)”
The ad says“Experience with penetration testing engagement and vulnerability management processes”
The ad says“This is a security role built for someone who wants to own the threat, not just log it. As Security Engineer, you’ll be the person who understands what’s actually at risk across a modern Cloud native microservice platform and our internal IT estate, from SIEM alerts to Microsoft 365 endpoint security, and who sets the priorities that matter. You won’t be buried in compliance paperwork. You’ll direct a capable Platform Ops team on remediation while you stay focused on the threat picture, the tooling and the DevSecOps thinking that keeps CV-Library ahead of it.”
The ad says“Strong incident response and threat intelligence skills, including SIEM-based monitoring and triage”
The ad says“Working knowledge of UK GDPR and data protection principles, particularly as they relate to security control and audit documentation”
The ad says“Experience with penetration testing engagement and vulnerability management processes”

At CV-Library, we have a simple vision: to help the world to work and we are looking for exceptional and talented people to help us realise this vision in both UK and overseas markets.

We are in a period of focused internal investment, following a year of key strategic acquisitions and significant investment across all parts of the business, from Tech and Data to People and HR, there’s never been a more exciting time to join us or a better place to grow your career!

The Role

Hours: Monday-Friday, 9:00-17:30
Location: Fleet
Working Pattern: Hybrid

This is a security role built for someone who wants to own the threat, not just log it. As Security Engineer, you’ll be the person who understands what’s actually at risk across a modern Cloud native microservice platform and our internal IT estate, from SIEM alerts to Microsoft 365 endpoint security, and who sets the priorities that matter. You won’t be buried in compliance paperwork. You’ll direct a capable Platform Ops team on remediation while you stay focused on the threat picture, the tooling and the DevSecOps thinking that keeps CV-Library ahead of it.

You’ll report directly to the Platform & Service Operations Manager, with a genuine mandate to shape how security is done, not just document it. Compliance still matters, and you’ll keep ISO 27001 documentation and audit evidence in good shape as you go, but it’s the by-product of doing security well, not the job itself.

Responsibilities:

Own the day-to-day management of security alerts, investigations and incidents across CV-Library’s technology estate
Monitor emerging cyber threats and threat intelligence, assessing potential risks and recommending improvements to security controls
Lead the initial response to security incidents, coordinating containment and remediation activities with relevant technical teams
Maintain incident records, conduct post-incident reviews and ensure lessons are learned are embedded into processes, tooling and controls
Manage and continuously improve the organisation’s security tooling, including SIEM, endpoint protection, vulnerability management and cloud security solutions
Take ownership of endpoint and Microsoft 365 security, including device security, conditional access policies and identity protection controls
Define and maintain security standards and guardrails for cloud infrastructure and software delivery, working closely with Platform DevOps teams
Manage identity and access management processes, supporting user provisioning, access reviews and least-privilege principles
Act as the security subject matter expert, providing guidance on infrastructure, platform and application changes
Oversee the vulnerability management lifecycle, ensuring security weaknesses are identified, prioritised and remediated effectively
Coordinate external penetration testing activities and track remediation actions through to completion
Maintain security documentation, policies and audit evidence, supporting ongoing ISO 27001 compliance and certification requirements
Apply GDPR and data protection principles to ensure security controls, processes and documentation meet regulatory expectations
Support supplier and third-party security assessments, helping to identify and manage external risks
Assess the secure use of AI technologies across the business and champion a strong security culture by promoting best practice across best technology and non-technical teams

What we’re looking for

Strong technical knowledge of security tools, frameworks and best practice
Solid understanding of cloud-native infrastructure (AWS, Kubernetes/EKS) sufficient to assess and prioritise risk and to direct Platform Ops on remediation, without owning infrastructure changes directly
Experience with penetration testing engagement and vulnerability management processes
Understanding of endpoint protection technologies and policy configuration, including Microsoft 365 security tooling (e.g. Defender, Intune, Conditional Access)
Working knowledge of Identity and Access Management principles
Strong incident response and threat intelligence skills, including SIEM-based monitoring and triage
Familiarity with security accreditations such as ISO 27001 and what they require operationally
Working knowledge of UK GDPR and data protection principles, particularly as they relate to security control and audit documentation
Excellent communication skills, able to convey security matters clearly to both technical and non-technical audiences

We are actively committed to promoting a fully diverse and inclusive workforce and we welcome applications for this role from all candidates who meet the key requirements.

Please do not hesitate to get in touch should you require any reasonable adjustments to assist with your application.