Security Engineer (Hybrid or Remote)

About the role

We are seeking a senior Security Engineer to own and improve the security of our internal environment, covering identities, SaaS apps, endpoints, AI tooling, and networks. This hands‑on role involves designing controls, identifying gaps, and building automation to scale security operations.

Key responsibilities

• Own end‑to‑end SIEM alerting: ship logs from endpoints, IdP, VPN, SaaS, and cloud; write and tune detection rules; reduce false positives.
• Act as first responder for security incidents: investigate, contain, close incidents with clear runbooks and feed findings back into preventive controls.
• Administer the IdP (SSO via SAML/OIDC, MFA, conditional access) and run access recertification across IdP, SaaS, AWS, and internal tools.
• Hunt over‑permissive and stale access, enforce least‑privilege, PAM, and address SoD gaps.
• Improve SaaS security posture (Google/Microsoft, Slack, GitHub, etc.) and apply DLP controls.
• Maintain endpoint stack health: MDM, XDR/AV, device‑compliance checks, and automate remediation.
• Defend against phishing and spoofing: manage email gateway rules, DMARC/SPF/DKIM, run simulations and awareness programs.
• Build internal tooling and automate repetitive security operations.

Required profile

• 5+ years in security operations, corporate/IT security, or endpoint engineering.
• Strong experience with SIEM platforms (Splunk, Elastic, Panther, Sumo Logic) and incident response.
• Hands‑on with identity providers (Okta, Entra ID, Google Workspace) and access recertification.
• Practical knowledge of endpoint security (MDM, XDR/EDR/AV) and email/phishing defense.
• Experience securing AI tooling internally, including shadow AI discovery and DLP for AI tools.
• Proficient scripting/automation skills to build tooling against APIs.
• Proven track record of leading security initiatives with minimal oversight.
• Clear written and spoken English for engineers and leadership.

Required skills

• SIEM platforms: Splunk, Elastic, Panther, Sumo Logic
• Identity providers: Okta, Entra ID, Google Workspace
• Cloud: AWS
• Endpoint security: MDM, XDR/EDR/AV
• Email security: DMARC, SPF, DKIM
• Scripting/automation (API integration)

What we offer

• Hybrid model in Limassol office or fully remote; relocation support to Cyprus.
• Learning & development budget.
• Fully paid vacation and sick leave.
• Sports compensation.
• Significant responsibility and growth prospects.