Security Engineer L3

About the Role

We are seeking an experienced

L3 Security Engineer to lead security engineering, architecture, and continuous improvement across multiple customer environments within a Managed Service Provider (MSP).

This senior technical role goes beyond security monitoring and alert triage. You will design and implement security controls, lead vulnerability remediation, strengthen compliance, resolve complex security incidents, and establish consistent security standards across customer environments.

Working closely with infrastructure teams, service desk engineers, Account Managers, and customers, you will take ownership of security outcomes while mentoring junior engineers and driving a proactive approach to cybersecurity.

About the Client

You will be working with a technology and managed services provider supporting multiple customer environments. The organisation is focused on strengthening cybersecurity, improving service delivery, and developing scalable security standards that help customers reduce risk and maintain resilient IT environments.

Ideal Profile

• Technical Expertise
• Significant experience within an MSP, MSSP, or IT Service Provider environment
• Strong hands-on experience with Microsoft Defender and its security ecosystem
• Advanced experience with Sophos Firewall and endpoint security technologies
• Proven experience managing vulnerability and patch management programs
• Experience implementing security controls across Microsoft 365 environments
• Strong knowledge of Microsoft Entra ID and Zero Trust security principles
• Solid understanding of networking fundamentals, including TCP/IP, DNS, DHCP, VLANs, routing, firewalls, VPNs, and network segmentation
• Strong Windows Server and endpoint troubleshooting capabilities
• Experience handling complex technical escalations and leading remediation activities
• Ability to design and implement practical security improvements rather than simply identify risks
• Security Platforms & Technologies
• Hands-on experience with ConnectSecure and Huntress is highly desirable
• Experience with Sophos ZTNA, Microsoft Intune, Microsoft Defender XDR, and Conditional Access is advantageous
• Familiarity with Microsoft Defender for Endpoint, Office 365, Identity, and Vulnerability Management
• Knowledge of Essential Eight, CIS Controls, NIST Cybersecurity Framework, and ISO 27001
• PowerShell scripting and API-based automation experience is beneficial
• Familiarity with MSP PSA platforms such as HaloPSA, ConnectWise, or Autotask
• Relevant Microsoft, Sophos, or cybersecurity certifications are advantageous
• Security Architecture & Compliance
• Experience assessing security architectures and identifying technical weaknesses
• Ability to translate compliance requirements into practical security controls
• Strong understanding of cybersecurity threats, attack techniques, and defensive measures
• Experience developing remediation strategies, security baselines, and technical standards
• Ability to prioritise vulnerabilities based on exploitability, exposure, asset criticality, and business impact
• Leadership & Communication
• Strong written and verbal English communication skills
• Excellent technical documentation and reporting capabilities
• Ability to lead complex remediation activities and provide technical direction
• Confidence making technical decisions and challenging inadequate security practices
• Strong problem-solving skills and a methodical approach to incident investigation
• Ability to remain calm during critical incidents while considering customer priorities and operational impact
• A proactive mindset focused on root causes, automation, standardisation, and preventing recurring issues

Responsibilities

• Security Architecture & Technical Leadership
• Act as a senior technical authority for security across multiple customer environments
• Design, review, and improve customer security architectures
• Establish security standards, recommended configurations, and repeatable best practices
• Identify architectural weaknesses and develop remediation roadmaps for complex or high-risk issues
• Review security solution designs and support customer onboarding, migrations, and major infrastructure changes
• Mentor L1 and L2 engineers and strengthen internal security capabilities
• Lead complex security escalations and configuration investigations
• Microsoft Defender
• Administer, configure, and optimise Microsoft Defender security solutions across customer environments
• Design and implement Defender policies and standard configurations
• Configure and maintain Attack Surface Reduction rules, endpoint detection and response, automated investigation, web filtering, endpoint firewall policies, device control, antivirus, and tamper protection
• Investigate complex security incidents involving endpoints, identities, email, and cloud environments
• Use Microsoft Defender XDR to conduct advanced threat analysis
• Review Secure Score, vulnerability data, and security exposure to identify improvement opportunities
• Support migrations from third-party endpoint security platforms where appropriate
• Identify opportunities to improve Microsoft licensing utilisation and security capabilities
• Sophos Firewall & Endpoint Security
• Provide senior technical support and architecture guidance across Sophos security environments
• Design and review firewall deployments and establish standard configuration baselines
• Configure and optimise firewall rules, network segmentation, NAT, intrusion prevention, web filtering, application control, VPNs, SD-WAN, high availability, logging, and monitoring
• Troubleshoot complex firewall, connectivity, and endpoint security issues
• Review configurations for security weaknesses and unnecessary exposure
• Manage Sophos Central and endpoint security policies
• Support firmware upgrades, migrations, firewall refreshes, and security platform consolidation
• Zero Trust Network Access
• Design, implement, and maintain Zero Trust Network Access (ZTNA) solutions
• Develop secure application access models based on user identity, device health, application requirements, location, authentication risk, and access needs
• Apply least-privilege principles and integrate ZTNA with Microsoft Entra ID
• Reduce reliance on traditional VPN technologies where appropriate
• Troubleshoot complex ZTNA and authentication issues
• Assess existing remote access environments and develop Zero Trust migration strategies
• Establish repeatable ZTNA deployment standards across customer environments
• Vulnerability Management
• Own and improve the vulnerability management approach across customer environments
• Review ConnectSecure findings and prioritise remediation based on exploitability, internet exposure, asset criticality, and business impact
• Lead remediation of critical vulnerabilities and investigate recurring issues
• Develop remediation strategies involving patching, configuration changes, network segmentation, application upgrades, compensating controls, firewall changes, platform migrations, or software replacement
• Identify unsupported and end-of-life systems and develop remediation or replacement plans
• Track unresolved vulnerabilities and ensure appropriate risk decisions are made
• Validate remediation through rescanning and verification
• Develop vulnerability dashboards, reporting, remediation standards, and technical security roadmaps
• Huntress Security
• Provide senior-level support for Huntress deployments across customer environments
• Investigate advanced detections and SOC escalations
• Analyse persistent footholds, suspicious applications, and unusual system activity
• Ensure agents and services are deployed correctly and endpoints are appropriately protected
• Assess SOC recommendations and coordinate suitable technical responses
• Identify recurring trends and use findings to strengthen security standards
• Establish processes for resolving escalations within agreed timeframes
• Patch Management
• Provide technical oversight of operating system and application patch management
• Define and optimise patching standards and review compliance across customer environments
• Investigate systemic patching failures and complex Windows Update or application patching issues
• Develop strategies for critical and zero-day vulnerability remediation
• Ensure critical security patches are deployed within agreed service-level agreements
• Identify systems and applications that cannot be reliably patched and develop alternative remediation or upgrade plans
• Coordinate patching for servers and critical business systems
• Monitor supported operating system versions and end-of-life dates
• Identify opportunities to improve patching through automation and technology refresh initiatives
• Compliance Management & Remediation
• Lead technical initiatives to improve customer security compliance
• Assess environments against relevant frameworks, including Essential Eight, CIS Controls, NIST Cybersecurity Framework, ISO 27001, and cyber insurance requirements
• Identify compliance gaps and develop practical remediation strategies
• Implement or oversee required security controls and maintain progress through to completion
• Assist with audit evidence collection and customer security assessments
• Develop security baselines, technical policies, and configuration standards
• Recommend alternative controls where compliance requirements cannot be met directly
• Identity & Access Security
• Design and improve identity security controls across customer environments
• Review Microsoft Entra ID configurations and implement Conditional Access, multi-factor authentication, Privileged Identity Management, and secure authentication methods
• Manage role-based access, administrative accounts, device compliance, and privileged permissions
• Identify excessive access and implement least-privilege controls
• Investigate complex authentication and access incidents
• Support compromised identity investigations and establish standard identity security configurations
• Endpoint Security & Hardening
• Design and maintain secure endpoint configurations and security baselines
• Ensure security controls are deployed consistently across devices
• Manage security integration across Microsoft Defender, Sophos Endpoint, Huntress, Microsoft Intune, and Microsoft Entra ID
• Implement device hardening, endpoint encryption, BitLocker, and application control where appropriate
• Review Attack Surface Reduction policies and local administrative privileges
• Identify unmanaged or non-compliant endpoints and develop remediation plans for legacy devices
• Security Incident Escalation
• Lead technical investigations into complex security incidents
• Coordinate containment, remediation, endpoint isolation, and account protection
• Determine incident scope, affected systems, root causes, persistence, and potential lateral movement
• Collaborate with third-party SOCs, vendors, and internal engineers during incident response
• Support customer communications and provide clear technical guidance
• Develop post-incident recommendations to reduce the risk of recurrence
• Security Automation & Continuous Improvement
• Identify opportunities to automate recurring security activities
• Use PowerShell, APIs, and other automation technologies to improve security operations
• Automate security configuration checks and appropriate vulnerability remediation workflows
• Develop reusable deployment processes, internal tools, scripts, and templates
• Improve documentation and standardise security processes across customer environments
• Turn recurring incidents and vulnerabilities into improvements in architecture, automation, and security standards
• MSP Service Delivery & Customer Engagement
• Support multiple customer environments and act as a senior escalation resource for service desk and infrastructure teams
• Manage complex security incidents and projects through the PSA platform
• Maintain detailed technical documentation and participate in solution design and technical reviews
• Assist with customer onboarding, security assessments, and pre-sales activities for security projects and managed security services
• Work with Account Managers and vCIOs to develop customer security roadmaps and estimate remediation effort
• Participate in customer security reviews and strategic technology discussions
• Explain security risks and recommendations in clear business language
• Help customers prioritise security investments and understand the impact of unresolved vulnerabilities
• Build customer confidence through accountability and ownership of security outcomes
• How we take care of our team
• 💰 Get paid in Australian Dollars
• 🏥 Medical insurance from day one for you + spouse (or parents if unmarried)
• 🩺 Generous OPD coverage from doctor visits to all your medical needs
• 🏡 Home office setup allowance to build your ideal workspace
• 🌐 Internet allowance to keep you connected
• 💪 Gym & wellness allowance to stay fit and balanced
• 🎉 Work hard, play hard – regular team events & engagement activities
• 🧠 Diji Assist – Mental health & counseling support when you need it
• 📚 We invest in you – reimbursement for industry certifications
• 🗣️ Open-door culture – your ideas and feedback always matter
• 🌍 Flexible work – home or office, wherever you do your best work
• 🏆 Rewards & recognition that actually recognize you
• 🥳 Great christmas & financial year-end parties to unwind with your loved ones