security engineer in legal services

Kennedys provides legal, legal services, and alternative dispute resolution services. Its IT team maintains technology systems, security, and managed bespoke and off-the-shelf applications across the firm.

• Maintain and optimise the security platform, including configuring EDR policies, tuning SIEM rules, and optimising system performance;
• Monitor security threats, analyse alerts, respond to incidents, conduct vulnerability scans, and support remediation and risk mitigation;
• Lead and participate in incident response, conduct root cause analysis, and develop incident-handling runbooks;
• Oversee WAF, DDoS, VPN, and perimeter firewalls;
• Manage email and web security gateways;
• Maintain security certificates, encryption keys, and IDS/IPS systems;
• Perform security scanning and vulnerability management to reduce operational risk;
• Work with network engineers to implement posture management, ICE/NAC segmentation, lateral movement controls, and firewalls;
• Work with the Endpoints team to administer MFA, SSO, PAM, MDM/MAM, and Conditional Access;
• Manage Identity and Access Management solutions;
• Develop and deploy automation tools and scripts for common IT Security Operations tasks;
• Collaborate with third-party penetration testers to identify, prioritise, and remediate security vulnerabilities;
• Create reports on detected threats, incidents, and response actions;
• Document configurations, processes, and runbooks;
• Keep informed about cybersecurity trends, emerging threats, and updates;
• Comply with relevant legal and regulatory obligations, including Solicitors Regulation Authority standards, regulations, and principles.

• Experience managing EDR platforms, configuring EDR policies, and tuning SIEM;
• Experience with Microsoft Security, including Defender ATP, Azure Security Centre, Entra ID, Intune, and Conditional Access;
• Experience configuring and managing next-generation firewalls, preferably Palo Alto Prisma or similar;
• Experience with email security, including Mimecast, Exchange Online, DMARC, and email DLP such as Tessian or equivalent;
• Experience with Identity and Access Management, including CyberArk, Entra ID, SSO, MFA, and PAM solutions;
• Experience with SIEM tools such as Sentinel, Exabeam, Splunk, or equivalent;
• Experience with vulnerability management using Tenable or equivalent enterprise toolsets;
• Experience with scripting and automation, preferably PowerShell, and KQL or similar;
• Experience with Data Loss Prevention solutions, including MS Purview Compliance Manager;
• Nice to have: CISSP, CREST Practitioner Security Analyst (CPSA), Palo Alto Networks Certified Security Operations Professional, CEH, OSCP, SANS, or ISACA certifications.

• Work is based in Greater London, England, United Kingdom;
• The global IT team works flexibly and remotely.