The Grant Thornton Cyber Defence Centre is an award-winning* managed security services provider operating at the forefront of cyber security, using industry-leading technologies to protect and support our clients. Alongside our SOC capability, we have cutting-edge incident response teams delivering rapid cyber breach investigations for clients through insurance panels and direct engagements, supporting organisations at their most critical moments.
We invest heavily in our people, offering clear progression opportunities and encouraging initiative within a collaborative, cross-functional environment with a strong team ethos. Support is always available across the SecOps, DFIR, MSS and wider cyber teams.
We’re seeking an experienced Network Engineer to join our Cyber Defence Centre. This is a hands-on technical role that spans live incident response, security assessment and hardening, and the design and delivery of managed security solutions in client environments. You will be one of the people clients rely on to shut an attacker out of their estate and then help make sure it does not happen again.
As a Network Engineer within the Cyber Defence Centre, you will deliver the containment and recovery phases of live client incidents, and work on assessment, hardening and implementation engagements between them.
Incident response, containment and recovery
Delivering the containment and recovery phases of live client security incidents, including ransomware, business email compromise and perimeter device exploitation.Isolating affected systems and accounts, restricting compromised identities, closing off attacker access routes, and preventing further spread across the estate.Preserving logs and evidence for the forensic investigation team, and working alongside them as the investigation develops.Supporting client recovery, including rebuild and restoration sequencing driven by business priority, and ensuring known weaknesses are not reintroduced.Implementing the remediation and hardening work identified through the incident, where clients engage us to deliver it.Working to the NIST Cyber Security Framework and incident response lifecycle, with CIS Benchmarks used for technical control recommendations.Security assessment and hardening
Performing security reviews and configuration hardening across Microsoft 365 and Entra ID, Microsoft Azure, Amazon Web Services, on-premise Active Directory, and perimeter firewall estates.Conducting firewall security assessments across multiple vendor platforms: rule base review, management plane exposure, VPN and remote access configuration, IPS/IDS posture, logging, and firmware currency.Assessing cloud configuration against CIS Benchmarks and NIST using tooling including Prowler, ScubaGear and PingCastle, and turning technical findings into prioritised, business-contextualised remediation plans.Reviewing third-party software, cloud applications and SaaS platforms as part of supplier and technology assurance work.Supporting client compliance and assurance requirements including GDPR, Cyber Essentials Plus and PCI DSS.Security solution design and implementation
Designing and implementing security solutions in client environments, from discovery and requirements gathering through build, testing, rollout and handover.Working as part of the delivery team on a Zero Trust access programme built on Netskope One SASE, covering Secure Web Gateway, CASB (inline and API), Private Access (ZTNA) and Data Loss Prevention, integrated with Microsoft Entra ID and endpoint management.Designing and deploying Microsoft 365 conditional access policy sets, including MFA enforcement, legacy authentication blocking, device compliance conditions, geolocation restriction, and Privileged Identity Management for just-in-time privileged access.Designing network segmentation across cloud and on-premise environments: Azure Network Security Groups and subnet-level control, VLAN segregation, DMZ isolation, and layer 2 / layer 3 access control.Designing data classification and DLP policy, working with client data and business process owners to define label sets and handling outcomes, and validating policy behaviour in simulation before enforcement.Producing security architecture artefacts, hardening standards, deployment guides, operating procedures and SOC playbooks so client teams can operate and extend what you have built.Knowing you’re right for us
Joining us as an experienced Network Engineer, the minimum criteria you’ll need is a background in network engineering with demonstrable experience of applying it to security outcomes, ideally with 36 months in a security-focused role, together with the Netskope Certified Cloud Security Integrator (NCCSI), which you must be actively working towards if you do not already hold it. You should also be able to demonstrate the following during the interview process.
