Lead Security Engineer - Platform

Expleo is a trusted partner for end-to-end, integrated engineering, quality services, and management consulting for digital transformation. We help businesses harness technological change to deliver innovation, improve resilience, and support the secure delivery of complex products, platforms, and systems.

As part of the Expleo UK Cybersecurity Practice, you will join a managed Cyber Operations service for a major UK energy network operator that forms part of the UK's Critical National Infrastructure (CNI). The service is governed by Expleo in the UK, with a 24/7 UK Security Operations Centre delivered by a specialist partner and an Expleo consultancy team in India providing design, engineering and assurance expertise across the client's security tooling estate.

As Lead Security Engineer | Platform, you will be the subject matter expert for the client's endpoint, application control, email, and web-edge security platforms and will lead the Network and Identity Security Engineers.

This is a design, review and advisory role. You will work within Expleo's offshore consultancy team, outside the client's operational environment. You will not have access to the client's operational systems or data and will not make live changes. Operational changes are implemented by UK-based, security-cleared personnel; your work provides the designs, analysis, recommendations and assurance that those changes depend on. You will work from information released to the team through Expleo's controlled UK service boundary.

• →Act as a subject matter expert in endpoint protection and XDR, application allowlisting, email security gateways, and web-edge platforms (WAF, DDoS, and DNS).
• →Define and maintain secure configuration baselines and hardening standards aligned to vendor best practices and client policy.
• →Review platform configurations, using exports released through the UK service boundary, and recommend improvements.
• →Design platform changes and prepare complete change packages, including implementation, test and back-out plans, for implementation by UK-based personnel.
• →Assess application control exception and policy exclusion requests and provide risk-based recommendations for governance approval.
• →Analyse platform reporting (endpoint coverage and drift, malware trends, email threat trends, application control activity) and produce monthly reports and recommendations.
• →Assess the coverage of security log feeds in the client's retained SIEM against the logging design, and recommend corrective actions and improvements to detection use cases.
• →Track vendor support lifecycles, identify end-of-support risk and produce upgrade plans.
• →Provide platform expertise and forensic-readiness input (runbooks, evidence sources, playbooks) to support the UK SOC and incident response partner.
• →Provide advisory support to incident management when requested, including during major incidents.
• →Contribute platform content to monthly service reports and maintain platform diagrams and documentation.
• →Lead, allocate and quality-review the work of the Network and Identity Security Engineers.
• →Support the growth of Expleo's Cybersecurity Practice through knowledge sharing, technical contribution and client-facing delivery excellence.

• Degree in computer science, cybersecurity or a related discipline, or equivalent professional experience.
• Vendor certification in at least one enterprise endpoint/XDR or SIEM platform (e.g. Palo Alto Cortex, Microsoft SC-200, CrowdStrike, IBM QRadar, Splunk).
• GIAC GCIH/GCIA, CompTIA CySA+ or ITIL 4 Foundation would be advantageous.

• Strong knowledge of EDR/XDR and anti-malware platforms (e.g. Palo Alto Cortex XDR, Microsoft Defender, CrowdStrike, Trellix).
• Application allowlisting and device control (e.g. Carbon Black App Control, Airlock Digital, WDAC).
• Email security gateways (e.g. Cisco Secure Email, Proofpoint, Mimecast).
• Web application firewall, DDoS and DNS protection services (e.g. F5, Cloudflare, Akamai).
• Understanding of SIEM log onboarding and detection use cases (e.g. QRadar, Splunk, Sentinel).
• Producing secure configuration baselines, design documentation and change packages.
• Incident response lifecycle (NIST SP 800-61) and ITIL change and incident management.
• Scripting and data analysis (PowerShell, Python, KQL, AQL or SPL) for reporting.

• Digital forensics and forensic-readiness experience (e.g. EnCase, FTK, Magnet AXIOM) and chain-of-custody practice.
• Energy, utilities or other CNI sector experience.
• Awareness of OT security constraints.

• 10-12 years in security engineering or operations, including 3+ years in a lead role across endpoint, gateway and logging platforms.
• Experience leading and quality-reviewing the work of other engineers.
• Experience supporting managed security services in regulated or CNI environments.