Remote Forward Deployed Engineer

Salary: £52,500 - 68,000 per year

• 3–6 years of experience in a technical cybersecurity role, ideally spanning Security Operations and an engineering or customer-facing function.
• Demonstrable software development capability with the ability to write, review, and deploy code in a production context;
  Python is strongly preferred.
• Proven ability to write and tune detection rules in one or more SIEM platforms such as Splunk, Microsoft Sentinel, Elastic, or QRadar.
• Hands‑on experience building and troubleshooting integrations with cloud platforms such as AWS, Azure, or GCP, REST APIs, and common security tooling including SIEMs, EDRs, XDRs, and NDRs.
• Strong understanding of networking fundamentals, operating systems including Windows and Linux, and identity and access management concepts.
• Experience deploying or operating software in containerised environments such as Docker or Kubernetes.
• Excellent written and verbal communication skills with the ability to engage credibly with technical engineers and non‑technical stakeholders up to C‑level.
• Based in the United Kingdom with the right to work in the UK.
• Prior experience in a Forward Deployed Engineer, Customer Success Engineer, or Technical Account Manager role at a security or SaaS company is highly desirable.
• Experience supporting customer renewal engagements from a technical perspective, including building business cases, evidencing value, and closing coverage gaps ahead of renewal conversations, is highly desirable.
• Familiarity with log ingestion at scale and the operational and architectural challenges of onboarding diverse log sources across complex enterprise environments is highly desirable.
• Experience with CI/CD pipelines, Infrastructure‑as‑Code such as Terraform or Ansible, and modern Dev Sec Ops  practices is highly desirable.
• Exposure to machine learning or AI‑driven security analytics platforms is highly desirable.
• Relevant industry certifications such as CISSP, AWS Solutions Architect, GCIH, or equivalent are highly desirable.
• Experience supporting or replacing incumbent security platforms within enterprise customer transitions is highly desirable.

• Lead end‑to‑end Sense On platform deployments and complex log ingestion rollouts without customer disruption.
• Conduct architectural reviews to define deployment strategies and identify integration opportunities.
• Own the post‑sale technical relationship into steady‑state operations, delivering against technical success criteria tied to quantifiable security outcomes.
• Travel to UK and international customer sites approximately 25% of the time.
• Provide the technical evidence base and build business cases for renewals and expansions, translating platform telemetry and incident response data into clear customer outcomes.
• Proactively health‑check environments, close technical gaps, and resolve visibility issues ahead of renewal conversations.
• Collaborate with Sales Engineering to ensure continuity from pre‑sale technical validation through to post‑sale deployment.
• Write production‑quality software to build and maintain integrations across third‑party security tools, SIEMs, identity platforms, and AWS, Azure, and GCP environments.
• Contribute reusable connectors to our integration library and create custom automation to optimise security operations workflows.
• Work across backend languages, with Python preferred, and use Go, JavaScript, and Bash where valuable, leveraging RESTful APIs, webhooks, and data pipeline patterns.
• Write, tune, and maintain high‑fidelity, low‑noise SIEM detection rules by translating threat intelligence and attacker behaviour.
• Map coverage to the MITRE ATT&CK framework to address visibility gaps, and develop new detection logic with Security Operations.
• Iterate on rules post‑deployment to reduce false positives, and provide expert guidance to customers regarding their detection strategy and risk posture.
• Develop deep relationships with customer security leadership, acting as a trusted adviser across their security architecture.
• Proactively mitigate adoption risks, resolve deployment blockers, and conduct structured onboarding from platform fundamentals to advanced threat…