Security Operations Engineer

We are looking for a Security Operations Engineer to own day-to-day operational security for our EMEA region. You join a young regional Information Security function in a high-tech manufacturing business, working alongside the Regional Information Security Officer, who leads security governance, risk and compliance. Our environment spans corporate IT, plants and OT systems across several countries, with central security services provided by our global HQ. Security here is risk-based and proportionate i.e. improvements are planned, prioritized and delivered through system owners, IT Operations and HQ Security, not by owning the systems yourself. You will help build and mature our operational security processes rather than run an established SOC. Improvement work moves at the pace of change windows and production; incident response does not, and you will be the person who acts quickly when it counts.   Key responsibilities Security monitoring and triage • Act as EMEA's operational point of contact for HQ Security and its monitoring services like triage alerts, notifications and findings, route them to the right system owner and follow them through to evidenced closure. • Use the security monitoring tools (SIEM, EDR/XDR, email security, Microsoft 365/Entra ID) to investigate suspicious activity in EMEA. • Identify detection gaps for EMEA and define use cases and tuning requests for the centrally operated platforms. Incident response • Handle EMEA security incidents end to end including initial assessment, investigation, evidence collection, containment and coordination with HQ Security, IT Operations and the business. • Build and maintain incident response runbooks for the most likely EMEA scenarios (e.g. account compromise, phishing and business email compromise, malware, supplier fraud). • Analyze root causes, track remediation actions and prepare clear incident reports covering technical findings, impact and lessons learned. • Provide the technical input for regulatory and customer notifications; the decision to notify seats with the Regional ISO, Legal and management Vulnerability management • Run the regional vulnerability management cycle: authenticated scanning, prioritization by risk, routing to owners and verification of remediation by rescan. • Scope, coordinate and follow up external penetration tests. • Keep endpoint protection and EDR coverage of the EMEA estate complete and healthy, working with IT Operations and HQ. Security architecture and change review • Review IT and network changes and new solutions from a security perspective and set security requirements, including input to the Change Advisory Board. • Support IT Operations and network teams on firewalls, IDS/IPS, VPN and remote access by reviewing designs and validating that controls work as intended; implementation and operation remain with those teams. Policies, compliance and audits • Contribute to the regional ISMS led by the Regional ISO: technical input to standards and procedures, control testing and evidence. • Support internal and external audits (e.g. ISO 27001, TISAX, NIS2) with technical evidence and follow up on corrective actions. Customer compliance support • Provide technical answers and evidence for customer security questionnaires and assessments, in coordination with the Regional ISO. Awareness • Support awareness activities such as phishing simulations and short, practical guidance for employees and IT staff. How you will work with our tools You will have investigation and search access to the security tools in scope for EMEA, plus defined containment actions for incidents (for example isolating an endpoint or revoking a compromised session) under agreed runbooks. Changes to security policies, detection rules and platf