Security Operations Engineer (Engine by Starling) in London

Requirements:

• 3+ years of experience in a SOC or SecOps Engineering role, with a strong background in both alert triage and security engineering.
• Proficiency in Python: Ability to write clean code to automate workflows or interact with security APIs.
• Cloud Fluency: Experience with security monitoring and incident response in cloud environments (AWS/GCP/Azure).
• Infrastructure as Code: Familiarity with managing security configurations through Git-based workflows.
• Framework Knowledge: Strong understanding of attack vectors and the MITRE ATT&CK framework.
• Education: A degree in a cyber-related field or relevant certifications (e.g., CompTIA Security+, CySA+, GCIH) is beneficial.

We are looking for engineers who are masters of automation but remain grounded in analyst fundamentals. You should have a keen interest in leveraging AI and Large Language Models (LLMs) to reduce SOC toil - using AI to summarise complex alerts, auto-generate YARA-L detections, or build intelligent playbooks to stay ahead of modern threats.

What the job involves:

• Active Monitoring: Monitor security alerts and events generated by the SecOps platform and integrated cloud security tools.
• Triage & Analysis: Perform deep-dive analysis of security incidents and anomalies, accurately distinguishing between true positives and false positives.
• Prioritisation: Manage the incident queue, prioritising alerts based on severity, potential impact, and business criticality.
• Detection as Code: Design and maintain sophisticated detection logic using YARA-L. Manage the lifecycle of these rules and configurations using IaC principles for version control.
• SOAR Extension: Lead the automation of response playbooks. You will write and extend SOAR capabilities using Python, creating custom integrations and “Managers” to connect SecOps with internal APIs.
• Tool Optimisation: Identify opportunities for automation to streamline operations and contribute to the continuous tuning and maintenance of SOC tools.
• End-to-End Investigation: Investigate incidents thoroughly, leveraging logs from platforms, endpoints, and applications mapped to the Unified Data Model (UDM).
• Incident Lifecycle: Lead containment, eradication, and recovery efforts in collaboration with Security and Technology teams.
• Documentation: Maintain comprehensive records of incident details, findings, and remediation steps to ensure a high standard of auditability.
• Group Collaboration: Work closely with the Group SOC team to align on global security standards and coordinate response efforts during cross-entity incidents.
• Threat Hunting: Stay informed about the latest cyber threats and cloud-specific vulnerabilities, conducting proactive threat-hunting activities using available telemetry.