Principal Security Engineer (Cybersecurity)

Location: Hybrid in Addlestone, United Kingdom; regional scope across the Americas, EMEA, and APJ. Requires participation in an on-call rotation, weekend support, work outside core hours, approximately 20% travel, and occasional datacenter, lab, and customer-site work.

Company

hirify.global develops and secures applications and digital services, with a focus on cybersecurity and protection of customers and their users.

What you will do

• Lead security incident response, tier 2 and tier 3 support, attack analysis, mitigation, post-mortems, and incident reporting.
• Monitor, triage, assess, and prioritize vulnerabilities and incidents across hirify.global products and services using CVE, threat intelligence, researcher submissions, and bug bounty information.
• Coordinate with Product Engineering, Product Management, Legal, Communications, Incident Response, and Risk Management teams on advisories, remediation, emergency coverage, and security initiatives.
• Develop and maintain PSIRT, QSN, vulnerability-management, and incident-response playbooks and workflows.
• Provide technical leadership, mentor security engineers, identify knowledge gaps, and create security training, workshops, presentations, and awareness content.
• Produce risk metrics and executive dashboards, lead vulnerability steering committees, and improve security processes and product design feedback loops.

Requirements

• At least 15 years of experience in a technical security role, including support, monitoring, consulting, or penetration testing with relevant technologies.
• Information security subject-matter expertise, with expert knowledge of incident handling, offensive and defensive techniques, vulnerability severity assessment, and production security incidents.
• Expert understanding of CVE, CPE, CVSS, CERT, security frameworks, and NIST standards; CISSP or GCIH certification, or demonstrated ability to obtain certification. More than one security certification is preferred.
• Expert experience identifying and mitigating DDoS, web application, DNS, network, and other attacks; knowledge of malware types and infection vectors.
• Expert knowledge of WAFs, firewalls, IPS/IDS, OS hardening, secure architecture, secure coding, security testing, threat modeling, and network vulnerability scanners.
• Hands-on experience with LAN/WAN operations, networking hardware, packet analysis, network and security monitoring tools, load balancers, and common network architectures.
• Working knowledge of TCP/IP, SSL, DNS, HTTP, UNIX/Linux command-line tools, microservices, modern application architecture, and API security.
• Proficiency in Python and knowledge of additional scripting languages; ability to understand vulnerabilities at code and assembly level and create attack proofs of concept.
• Hands-on experience with public clouds such as AWS, Azure, or GCP and container-based deployments and orchestration tools such as Kubernetes, Docker, Terraform, and Ansible.
• BA/BS degree or equivalent experience; ability to work with moderate supervision, collaborate in a team, analyze details, and communicate technical information to customers with varying skill levels.
• Fluent spoken and written English, including technical concepts and terminology; current passport required.

Nice to have

• Public cloud certifications or demonstrated ability to obtain certification.
• Experience with incident tracking software, with Siebel experience as a plus.

Culture & Benefits

• Full-time hybrid role in a normal office environment, with some datacenter, laboratory, and customer-location work.
• Participation in weekend support and an on-call rotation, including possible early morning, late evening, overnight, weekend, and holiday work.
• Approximately 20% travel may be required, including travel by automobile or airplane; some duties may require lifting up to 50 lbs.
• Ongoing security-field and hirify.global-product training, mentoring opportunities, and participation in security community forums and industry initiatives.
• Employment is subject to hirify.global policies, quality-management processes, and business-code-of-ethics requirements.