About this role
About Ekcoš Founded in 2016, Ekco has quickly become one of Europeās fastest-growing cloud solution providers and your trusted security-first Managed Service Provider. IT leaders choose Ekco to drive operational efficiency, scale smarter and stay ahead of risk ā powered by local expertise, delivered at European scale.We specialise in helping organisations advance their cloud maturity guiding transformation, strengthening security, and maximising the value of their technology investments.āļø In simple terms: we help organisations modernise with confidence securing their systems, optimising their cloud, and keeping them resilient in a rapidly changing world.š Today, weāre a thriving team of 1,000+ talented and supportive colleagues across the UK, Ireland, Benelux, South Africa, and Malaysiaāand weāre continuing to grow.At Ekco, how we work matters as much as what we deliver. Our people live by four core values that shape everything we do:On It: We take ownership, follow through, and get things done.All In : We collaborate, support each other, and commit fully to shared goals.Connected: We build trusted relationships with colleagues, clients, and partners.Hungry to Grow: We stay curious, keep learning, and push ourselves to the next level.š If these values resonate with you, youāll feel right at home here.The RoleDay-to-day at Ekco:As a Security Engineer within our Engineering Operations team, you will manage and enhance the security platforms, toolsets and customer integrations that underpin our managed security services. You will deliver customer deployments, onboard and optimise log sources, configure workflows within Tines SOAR and resolve engineering requests within agreed service levels.Working across technologies including Microsoft Sentinel, Defender XDR, CrowdStrike Falcon and QRadar, you will help maintain reliable security operations while improving and standardising engineering processes. You will also work closely with customer IT teams to troubleshoot technical issues, strengthen integrations and reduce manual effort through automation.What youāll be responsible for:Working the Security Engineering ticket queue: platform requests, configuration changes, faults and escalations.Deploying and configuring services for new customers across CrowdStrike Falcon and NG-SIEM, Microsoft Sentinel and Defender XDRSetting up Sentinel workspaces via Azure Lighthouse, deploying analytic rules and configuring data connectorsConfiguring Defender access through cross-tenant RBAC groups, and guiding customers on baseline policy setupOnboarding log sources, including syslog and CEF collectors, Event Hub ingestion for Microsoft cloud sources and API connectorsTuning noisy log sources and optimising ingestion to control volume and costMonitoring platform and ingestion health: silent or broken log sources, customers with zero alerts reaching Tines, EPS and data lake flowsInvestigating and fixing broken alert pipelines between customer tools, Tines and our reporting platformsSupporting QRadar SIEM infrastructure and BAU tasksWorking directly with customer IT teams to guide them through the steps they own, such as agent deployment and syslog server setupKeeping onboarding runbooks, customer records and asset/log source inventories up to dateOptimizing repeat tasks through automation and contributing to onboarding automation strategiesRequirements Hands-on experience with at least two of Microsoft Sentinel, Defender XDR, CrowdStrike Falcon or QRadarGood understanding of log collection: syslog, CEF, Windows events, agents and API-based connectorsWorking knowledge of Azure and Entra ID, including subscriptions, RBAC, app registrations and Azure LighthouseKQL skills for checking data ingestion, troubleshooting and basic detectionsA methodical approach to troubleshooting across networks, Linux and WindowsExperience working a ticket queue and managing priorities against service levelsConfidence working with customers, including technical calls and clear written updatesStrong attention to detail and good documentation habitsNice to Have'sExperience in an MSSP or multi-tenant environmentExperience with Tines or another SOAR platformScripting in PowerShell, Python or BashInfrastructure as code or deployment automation (ARM, Bicep, Terraform)Experience with Azure Data Lake, Grafana or similar reporting toolsKnowledge of Sysmon and endpoint telemetry tuningCertifications such as SC-200, AZ-500, AZ-104, CrowdStrike CCFA, or IBM QRadarBenefits / Perksā¢ āļø Time Off: 14 days annual leave + public holidays ā¢ š Birthday Leave: One extra day off to celebrate ā¢ š° Company Pension Scheme ā¢ š Employee Assistance Programme (EAP) for wellbeing support ā¢ šāāļø EkcOlympics: Global team activity challenges ā¢ š Unlimited access to Pluralsight for continuous development ā¢ š± Real opportunities to grow, including international progressionWhy Ekcoš Company of the year 2026 Tech Excellence Awardsāļø Microsoftās 2023 Rising Star Security Partner of the Yearš First Irish Microsoft MSP to achieve all four Microsoft Security Specializationsš A culture rooted in diversity, equality, inclusion & belongingš A commitment to internal mobility and career progressionāØ Flexible, family-friendly working at the heart of our cultureš Proud to be your trusted security-first Managed Service Provider chosen by IT leaders to drive operational efficiency, scale smarter and stay ahead of risk.