Sr. Security Operations Engineer in London

About CloudBees

CloudBees provides the leading software delivery platform for enterprises, enabling them to continuously innovate, compete, and win in a world powered by the digital experience. Designed for the world's largest organizations with the most complex requirements, CloudBees enables software development organizations to deliver scalable, compliant, governed, and secure software from the code a developer writes to the people who use it.

About the Role

We are growing quickly and have a new opening for a Sr. Security Operations Engineer to join our global security team. This is not a traditional SOC role - it sits at the intersection of security operations, detection engineering, and AI-driven automation, with a direct influence on how CloudBees products are secured by design.

You will own the engineering of our detection capability end-to-end: building detection logic, authoring and maintaining SOAR playbooks, and leveraging AI/ML to reduce manual workload and improve response fidelity. Critically, you will act as a bridge between the Security team and Product Engineering, embedding security detection requirements early in the product lifecycle and ensuring our platform's telemetry supports world-class threat visibility.

If you are a proactive self-starter who thinks in pipelines and playbooks - not just tickets - we would love to hear from you.

What You'll Do:

• Detection Engineering
  • Design, build, and continuously tune detection rules across endpoint, cloud (AWS), SaaS, and application layers, aligned to the MITRE ATT&CK framework.
  • Own the full detection lifecycle: hypothesis - log analysis - rule authoring - testing - deployment - retrospective tuning.
  • Develop and maintain a detection-as-code library (version-controlled, peer-reviewed, tested in CI/CD).
  • Convert threat intelligence, red team findings, and incident post-mortems into actionable, high-fidelity detections.
  • Map detection coverage against MITRE ATT&CK and maintain visibility gap analyses, reporting coverage metrics to security leadership.
• SOAR & Automation Engineering
  • Lead the design, development, and maintenance of SOAR playbooks to automate alert triage, enrichment, containment, and notification workflows.
  • Identify high-volume, repetitive SOC workflows and engineer automated responses that reduce analyst toil and mean time to respond (MTTR).
  • Build integrations between security tooling (SIEM, EDR, CNAPP, DLP, ticketing, threat intel platforms) using APIs, Python scripts, and SOAR connectors.
  • Champion AI-assisted analysis (e.g., LLM-based alert summarisation, anomaly detection, automated IOC correlation) to improve detection quality and analyst efficiency.
• Security Operations & Incident Response
  • Provide security monitoring and incident response for cyber security events within a highly available SOC supporting internal and external stakeholders.
  • Participate in the SOC on-call rotation, only on weekends, to support 24/7 security operations.
  • Lead and support incident response activities: triage, containment, eradication, recovery, and post-incident review.
  • Monitor and analyse SIEM alerts, correlating signals across log sources to identify true positives and reduce false positive rates.
  • Conduct proactive threat hunting exercises to identify attacker presence, lateral movement, and novel TTPs not covered by existing detections.
• Product & Engineering Collaboration
  • Act as the Security team's embedded partner with Product Engineering, participating in sprint planning, architecture reviews, and design discussions to ensure security telemetry and logging are built into the product by default.
  • Define and advocate for security observability requirements (log schemas, event types, audit trails) that enable detection rules to fire accurately against CloudBees platform activity.
  • Collaborate with Product teams to establish security acceptance criteria and threat model coverage for new features and services.
  • Contribute to the security roadmap for the CloudBees platform, translating operational threat intelligence into product-level security improvements.
  • Provide clear, developer-friendly documentation and guidance so engineering teams can self-serve on security logging and instrumentation requirements.
• Vulnerability & Threat Intelligence
  • Contribute to vulnerability assessment and management processes, prioritising findings based on threat context and exploitability.
  • Consume and operationalise threat intelligence feeds, translating indicators and TTPs into detection logic and hunting hypotheses.
  • Participate in red team/purple team exercises, using findings to validate and improve the detection stack.

What You'll Bring:

• Required
  • 5+ years of experience in security operations, detection engineering, or security engineering roles.
  • Proven hands-on experience building and tuning detection rules in a SIEM platform (e.g., Splunk, Microsoft Sentinel, Chronicle, Elastic SIEM).
  • Practical experience developing and maintaining SOAR playbooks and automated response workflows (e.g., Palo Alto XSOAR, Splunk SOAR, Tines, Sentinel Logic Apps).
  • Strong coding or scripting ability in Python and/or other scripting languages for automation and API integrations.
  • Deep understanding of AWS security services (GuardDuty, CloudTrail, Security Hub, VPC Flow Logs) and cloud-native logging (CNAPP).
  • Experience applying the MITRE ATT&CK framework to detection coverage mapping and gap analysis.
  • Solid understanding of incident response methodologies and hands-on experience leading or supporting IR activities.
  • Strong engineering mindset: comfortable working with version control (Git), CI/CD pipelines, and infrastructure-as-code concepts.
  • Ability to communicate complex security requirements clearly to non-security engineering audiences.
• Preferred
  • Experience with AI/ML-assisted detection or triage workflows (e.g., anomaly detection models, LLM-based alert enrichment, AI-driven SOAR).
  • Familiarity with detection-as-code methodologies and testing frameworks (e.g., Sigma rules, Atomic Red Team, Caldera).
  • Experience working embedded within or closely alongside Product or Engineering teams, influencing logging standards and security telemetry.
  • Knowledge of container and Kubernetes security (log sources, detection patterns, runtime security tools).
  • Relevant certifications: GCIA, GCIH, GCDA, GCED, AWS Security Specialty, or equivalent.
  • Experience in a DevOps or software delivery company, with an appreciation of developer workflows and CI/CD security.

WHAT YOU'LL GET:

• Highly competitive benefits and vacation package.
• Ability to work for one of the fastest growing companies with some of the most talented people in the industry.
• Team outings.
• Fun, Hardworking, and Casual Environment.
• Endless Growth Opportunities.

At CloudBees, we truly believe that the more diverse we are, the better we serve our customers. A global community like Jenkins demands a global focus from CloudBees. Organizations with greater diversity - gender, racial, ethnic, and global - are stronger partners to their customers.