Security Operations Manager

About the Role

Security Operations Manager to develop and mature the Security Operations capability at IAG Loyalty.

Acting as a bridge between Security Engineering and Security Operations across IAG Group and operating companies, this hands‑on role will influence how Security Operations evolves and shape the roadmap.

Responsibilities

• Lead the continual improvement of the Security Operations capability, working closely with Security Engineering, technology teams and third‑party partners to strengthen monitoring, detection and incident response across the business.
• Own the end‑to‑end incident management lifecycle, coordinating responses to security incidents, driving investigations, facilitating lessons learned and ensuring improvement actions are delivered.
• Configure and optimise SIEM, threat protection and case management platforms, developing new detection rules, alerts and automation to improve the ability to identify and respond to emerging threats.
• Build and maintain operational playbooks and runbooks, helping establish consistent ways of working across internal teams and managed service providers.
• Produce meaningful KPIs and reporting, using operational data to identify trends, improve service performance and demonstrate the effectiveness of security controls.
• Support security testing, assurance activities and resilience exercises, helping ensure the operational security capability continues to evolve in line with business priorities and regulatory expectations.

Qualifications

• Strong experience in Security Operations, Cyber Defence or Incident Response in a complex enterprise environment.
• Proven experience managing the end‑to‑end security incident management lifecycle.
• Hands‑on experience configuring and administering SIEM, threat protection, logging and case management platforms.
• Experience developing threat detection use cases, alerts, dashboards and operational reporting.
• Strong understanding of security monitoring, investigation, triage, containment, recovery and continuous improvement.
• Experience developing operational playbooks, runbooks and standard operating procedures.
• Experience working closely with Security Engineering teams to improve operational capabilities.
• Ability to collaborate with suppliers, technology teams and stakeholders across the business.
• Experience developing KPIs, operational reporting and service metrics.
• Strong analytical and communication skills, with the ability to translate technical information for different audiences.
• Good understanding of security governance, operational resilience and regulatory requirements.

Desirable Qualifications

• Experience supporting Business Continuity and Disaster Recovery activities.
• Experience working with outsourced Security Operations Centres or Managed Security Service Providers.
• Familiarity with Microsoft Sentinel, Splunk, Microsoft Defender, Crowd Strike or similar enterprise security platforms.
• Experience automating security operations using scripting or SOAR technologies.
• We Might Not Be Right for You

You prefer working within a narrow technical specialism rather than owning security operations end‑to‑end.

You enjoy maintaining existing processes more than improving and evolving them.

You prefer working independently rather than collaborating across engineering, operations and business teams.

Location and Working Arrangements

Based in the London office as part of the Loyalty Division.

Hybrid working is supported: at least two days per week in the office with the remainder remote.

You may also work from other IAG or partner locations as required.

Diversity and Inclusion

IAG Loyalty is committed to building a workplace where people feel they belong and are valued for their perspective.

We encourage applications from people with different experiences and backgrounds and aim to make our recruitment process fair, inclusive and accessible.

#J-18808-Ljbffr