Security Operations Engineer (Europe - Remote)
SpotMe
WorldwideremotePosted 1 month ago
Skill Required
Security-OperationsIT-SecurityIAMEndpoint-SecuritySecurity-EngineeringSecurity-Operations-EngineerCybersecurity-Operations-EngineerSecurity EngineersecuritybuildingwrittenTestNGdesignOAuthCloudAPIsandFulltime
Key highlights
- Role: Security Operations Engineer
- Reports to: Chief Security and Trust Officer
- Primary Identity Platform: Google Workspace
- Endpoint Fleet: macOS
- Tooling built with: Claude Code
- Scale: Over 500,000 monthly active HCP users on Onomi
Role overview
SpotMe is a leading B2B event platform that helps enterprises increase the impact of their events by delivering CRM-connected, high-quality experiences across in-person, virtual, hybrid events, and webinars. With a strong focus on life sciences, SpotMe powers Onomi: an HCP engagement product that enables medical and commercial teams to run impactful congresses, symposia, advisory boards, and webinars. Together, SpotMe and Onomi turn events into a company’s most effective engagement channel. This position is the ideal role for someone who wants to raise the level of IT security in an environment where it carries real weight. As a Security Operations Engineer, you will set and run the security configuration of the company across different tools, ensuring that accounts, laptops, and tools are secured for a platform where more than half a million healthcare professionals engage monthly.
Responsibilities
- Report to the Chief Security and Trust Officer.
- Allocate approximately 35% of time to Identity, access and lifecycle: manage joiners, movers and leavers, access requests and approvals, associate access, security hygiene across SaaS tools, and access reviews using Google Workspace as the identity layer.
- Allocate approximately 20% of time to Endpoint management and protection: implement both across the macOS fleet, keep the fleet in a known state, and triage reports once the tooling is live.
- Allocate approximately 30% of time to Security controls and access models inside tools: manage configurations, design role and permission structures for around a dozen SaaS applications (each with unique permission models, security controls, tier limits, and logging capabilities), compensate for tool blind spots, and manage alerts, logs, and threat intelligence.
- Allocate approximately 15% of time to Building internal tooling: develop access reporting, cross-tool investigation, and a small, deliberately tuned detection layer built primarily with Claude Code, jointly with the CSTO, against an existing written specification.
- Participate in reactive security event response when a security event happens (which may occur outside of office hours, though it is not a shift pattern, formal on-call rotation, or frequent).
- Achieve Month 1 Objectives: Establish a complete inventory of tools and how access is granted and removed; know which accounts exist and map to real people; run onboarding, offboarding, and access requests independently without escalation; provide an initial assessment of the environment identifying three or four priority fixes, their importance, and what is required to address them.
- Achieve Month 3 Objectives: Formulate a view of security settings, capabilities, and current enforcements in each cloud/SaaS tool; recommend changes in priority order and apply the first of them; produce a plan and recommendations for new endpoint management and protection (including options, obstacles, and mitigation strategies).
- Achieve Month 6 Objectives: Ensure new endpoint management and protection are running across the fleet and report on coverage; establish a single source showing who has access to what across all tools, running access reviews from it and producing evidence exports; build the new Security Dashboard to the point where real investigations can be conducted.
Requirements
- Ability to work across multiple areas of security (Identity, endpoints, tool configuration, and logging) rather than specialising in one, in combination with standard IT activities.
- Ability to judge the balance between security restrictions and business needs, identifying which controls are worth the friction and which will be bypassed.
- Ability to triage and prioritize user requests, distinguishing between those that can wait and those requiring immediate action (e.g., Slack messages during live customer events) without treating everything as urgent or forcing escalations.
- Proficiency with Google Workspace as an identity platform, including SSO and SAML app integration, groups and org units, admin roles and delegation, context-aware access, security and admin audit logs, and alerts built on them.
- Understanding of API usage, minimally possessing knowledge of REST and HTTP methods, status codes, authentication via API keys, and OAuth 2.0.
Additional details
- This is an IT security role covering identity, device management, and internal telemetry, with a real build component. It sits in security rather than IT because the work is judged on risk rather than on service.
- The company is curious to learn about your decision-making process between buying and building tools, and how those decisions hold up in practice.
- The company is curious about where you believe security effort belongs, which attack vectors matter most for a company of this nature, and your process for selecting and testing security tools.
- The company is curious about how you adapt your views and actions based on public security incidents and breaches.
- The company is curious about how you handle human pressure to override security requirements.
- The company is curious about a detection or alert you previously decided to switch off, and what convinced you to do so.
- SpotMe recruits, compensates, and promotes regardless of race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, parental status, or veteran status.
- Originally posted on Himalayas