Security Operations Lead

Salary: £90,000 - 95,000 per year

• Experience leading or managing a SOC, Security Operations, Detection Engineering, or Incident Response function
• Strong hands-on Microsoft Sentinel experience
• Advanced KQL skills and detection engineering expertise
• Experience investigating and responding to security incidents in cloud environments
• Strong knowledge of Azure security technologies, including Entra ID, Conditional Access, PIM, Defender for Cloud, Azure Policy, Key Vault, and Azure networking and segmentation
• Experience implementing DevSecOps tooling and security automation
• Infrastructure-as-Code experience using Terraform and/or Bicep
• Automation experience using PowerShell and/or Python
• Knowledge of Kubernetes, AKS, container security, and OWASP principles
• Ability to communicate effectively with technical and business stakeholders
• BPSS screening and successful completion of the relevant checks prior to employment
• Desirable: experience in multi-tenant SaaS platform environments, with Microsoft Defender XDR, building or transforming SOC functions, threat hunting and purple team exercises, supply chain security, policy-as-code solutions, or software, platform, or infrastructure engineering
• Desirable certifications include Microsoft SC-200, AZ-500, or SC-300; CompTIA CySA+; GIAC GCDA, GCIA, GCIH, or GCFA; HashiCorp Terraform Associate; and CKA or CKS. Practical experience is valued above qualifications.

• Implement Azure security controls and platform guardrails
• Deploy and manage Azure Policy, Defender for Cloud, Conditional Access, PIM, Key Vault, Managed Identities, Azure Firewall, and WAF solutions
• Deliver DevSecOps tooling across GitHub Actions and Azure Pipelines
• Implement SAST, SCA, secrets scanning, container security, and Infrastructure-as-Code scanning
• Drive supply chain security initiatives, including SBOM generation, artefact signing, and policy enforcement
• Harden AKS and cloud-native services through Infrastructure-as-Code and automated security controls
• Work with engineering teams to remediate vulnerabilities, penetration test findings, and security risks
• Support threat modelling, security reviews, and secure software development practices
• Lead day-to-day SOC operations and own Microsoft Sentinel administration and optimisation
• Develop and tune detection logic using KQL and MITRE ATT&CK methodologies
• Lead incident response, investigation, containment, and post-incident reviews
• Build automated response workflows using Logic Apps and security playbooks
• Conduct proactive threat hunting across platform telemetry
• Manage security monitoring, logging standards, and onboarding of new services into the SIEM
• Produce dashboards, metrics, and reporting on SOC performance and security posture
• Lead, mentor, and develop a team of three SOC Analysts; conduct one-to-ones, set objectives, and support development planning
• Act as the teams technical escalation point and develop analysts capabilities in threat hunting, detection engineering, and advanced investigations
• Maintain SOC documentation, runbooks, and operational procedures
• Work with architecture, engineering, and development teams to embed security across infrastructure, applications, and delivery pipelines

• Azure
• Cloud
• DevSecOps
• Firewall
• GitHub
• Support
• Kubernetes
• OWASP
• PowerShell
• Python
• Security
• Terraform
• WAF
• Embedded

More:

We are partnering with a technology organisation operating a large-scale, cloud-native SaaS platform serving millions of users globally. We are seeking a hands-on Security Engineering & SOC Lead to drive security engineering and operations across a modern Microsoft Azure environment. The role is approximately 60% security engineering, with the remainder focused on SOC leadership, detection engineering, and incident response. It offers the opportunity to shape a growing security capability, influence engineering, security, and operations, and mentor an expanding team. The position is UK-based and remote.

last updated 44 week of 2026