Security Engineer

About Ekco

Founded in 2016, Ekco has quickly become one of Europe’s fastest-growing cloud solution providers and your trusted security-first Managed Service Provider.
IT leaders choose Ekco to drive operational efficiency, scale smarter and stay ahead of risk – powered by local expertise, delivered at European scale.

We specialise in helping organisations advance their cloud maturity guiding transformation, strengthening security, and maximising the value of their technology investments.

☁️ In simple terms: we help organisations modernise with confidence securing their systems, optimising their cloud, and keeping them resilient in a rapidly changing world.

Today, we’re a thriving team of 1,000+ talented and supportive colleagues across the UK, Ireland, Benelux, South Africa, and Malaysia—and we’re continuing to grow.

At Ekco, how we work matters as much as what we deliver. Our people live by four core values that shape everything we do:

• On It : We take ownership, follow through, and get things done.

• All In : We collaborate, support each other, and commit fully to shared goals.

• Connected : We build trusted relationships with colleagues, clients, and partners.

• Hungry to Grow : We stay curious, keep learning, and push ourselves to the next level.

If these values resonate with you, you’ll feel right at home here.

The Role

Day-to-day at Ekco:

As a Security Engineer within our Engineering Operations team, you will manage and enhance the security platforms, toolsets and customer integrations that underpin our managed security services. You will deliver customer deployments, onboard and optimise log sources, configure workflows within Tines SOAR and resolve engineering requests within agreed service levels.

Working across technologies including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon and QRadar, you will help maintain reliable security operations while improving and standardising engineering processes. You will also work closely with customer IT teams to troubleshoot technical issues, strengthen integrations and reduce manual effort through automation.

What you’ll be responsible for:

• Working the Security Engineering ticket queue: platform requests, configuration changes, faults and escalations.

• Deploying and configuring services for new customers across CrowdStrike Falcon and NG-SIEM, Microsoft Sentinel and Defender XDR

• Setting up Sentinel workspaces via Azure Lighthouse, deploying analytic rules and configuring data connectors

• Configuring Defender access through cross-tenant RBAC groups, and guiding customers on baseline policy setup

• Onboarding log sources, including syslog and CEF collectors, Event Hub ingestion for Microsoft cloud sources and API connectors

• Tuning noisy log sources and optimising ingestion to control volume and cost

• Monitoring platform and ingestion health: silent or broken log sources, customers with zero alerts reaching Tines, EPS and data lake flows

• Investigating and fixing broken alert pipelines between customer tools, Tines and our reporting platforms

• Supporting QRadar SIEM infrastructure and BAU tasks

• Working directly with customer IT teams to guide them through the steps they own, such as agent deployment and syslog server setup

• Keeping onboarding runbooks, customer records and asset/log source inventories up to date

• Optimizing repeat tasks through automation and contributing to onboarding automation strategies

Requirements

• Hands-on experience with at least two of Microsoft Sentinel, Defender XDR, CrowdStrike Falcon or QRadar

• Good understanding of log collection: syslog, CEF, Windows events, agents and API-based connectors

• Working knowledge of Azure and Entra ID, including subscriptions, RBAC, app registrations and Azure Lighthouse

• KQL skills for checking data ingestion, troubleshooting and basic detections

• A methodical approach to troubleshooting across networks, Linux and Windows

• Experience working a ticket queue and managing priorities against service levels

• Confidence working with customers, including technical calls and clear written updates

• Strong attention to detail and good documentation habits

Nice to Have's

• Experience in an MSSP or multi-tenant environment

• Experience with Tines or another SOAR platform

• Scripting in PowerShell, Python or Bash

• Infrastructure as code or deployment automation (ARM, Bicep, Terraform)

• Experience with Azure Data Lake, Grafana or similar reporting tools

• Knowledge of Sysmon and endpoint telemetry tuning

• Certifications such as SC-200, AZ-500, AZ-104, CrowdStrike CCFA, or IBM QRadar

Benefits / Perks

• ☀️ Time Off: 14 days annual leave + public holidays
• Birthday Leave: One extra day off to celebrate
• Company Pension Scheme
• Employee Assistance Programme (EAP) for wellbeing support
• ‍♀️ EkcOlympics: Global team activity challenges
• Unlimited access to Pluralsight for continuous development
• Real opportunities to grow, including international progression

Why Ekco

• Company of the year 2026 Tech Excellence Awards

• ⭐️ Microsoft’s 2023 Rising Star Security Partner of the Year

• First Irish Microsoft MSP to achieve all four Microsoft Security Specializations

• A culture rooted in diversity, equality, inclusion & belonging

• A commitment to internal mobility and career progression

• ✨ Flexible, family-friendly working at the heart of our culture

• Proud to be your trusted security-first Managed Service Provider chosen by IT leaders to drive operational efficiency, scale smarter and stay ahead of risk.