Security Architect Lead

Job summary

We are seeking an experiencedSplunk Engineer / Security Architectto lead strategic and tactical improvements to the SIEM and associated components across a large-scale hybrid security environment.

Key skills required for this role

Splunk SaaS SIEM Architecture Cyber Security Operations Centre (CSOC) AWS Infrastructure MITRE ATT&CK Framework SOAR Integration

Important

Splunk SaaS SIEM Architecture Cyber Security Operations Centre (CSOC) AWS Infrastructure MITRE ATT&CK Framework SOAR Integration

Job description

Splunk Engineer / Security Architect
Location:Hybrid - Remote with up to 2 days/week in
Contract Duration:9 months (192 working days)
Active SC clearance required

Role Overview

We are seeking an experiencedSplunk Engineer / Security Architectto lead strategic and tactical improvements to the SIEM and associated components across a large-scale hybrid security environment. You'll play a pivotal role in enhancing monitoring capabilities, driving SIEM convergence, and supporting the maturity of security operations.

This role is aligned to a national programme improving the government's ability to detect and respond to cyber threats across multiple portfolios. You'll work alongside the SIEM Product Owner and CSOC teams to define and deliver architectural and engineering enhancements using Splunk SaaS and related technologies.

Key Responsibilities

Produce and maintain architecture diagrams, high- and low-level design documentation

Lead configuration of Splunk and associated infrastructure (AWS EC2, S3, SQS, etc.)
Drive use case development aligned with CSOC and MITRE ATT&CK framework
Attend and represent the project at key technical forums (ADF, TDA, workshops)
Deliver improvements to SIEM architecture, use cases, automation, and data enrichment
Improve onboarding processes for directorates and manage onboarding QA
Lead integration of SOAR, Attack Analyzer, and other tooling into operational use
Standardise collection tier components using Infrastructure as Code (IaC) where possible

Essential Skills & Experience

Strong experience inSplunk SaaSas a lead engineer and/or architect

Deep understanding ofSIEM Engineering & Architecture, particularly in CSOC environments
Demonstrated experience leadingend-to-end SIEM improvement initiatives
Proven ability to define and implement change within complex cyber environments
Excellent documentation, communication, and stakeholder engagement skills
Solid AWS infrastructure knowledge (EC2, S3, SQS, etc.)

Desirable Skills & Experience

Experience with SIEM convergence from legacy platforms

Familiarity with tools such as JIRA, Confluence, Git
Background in Ethical Hacking, IDAM, PKI, or broader information security disciplines
A team-oriented, adaptable mindset with a problem-solving approach

Required Qualifications

Splunk Cloud Administrator

Splunk Enterprise Security
Splunk SOAR Administrator
Splunk Certified Cybersecurity Defence Analyst
Cloud Security Architecture (CSA)
Microsoft Azure Infrastructure Solutions

Desirable Certifications

Certified Information Systems Security Professional (CISSP)

Ethical Hacking & Intrusion Prevention
Information Security Management Systems (ISMS)
Identity Access & Management (IDAM) Share

manages this role

Matchtech is a STEM Recruitment Specialist, with over 40 years’ experience