Security Operations Lead

A highly regulated financial services organisation operating in the insurance sector, with a growing technology footprint and a strong focus on cyber resilience. The business operates in a complex, always-on environment and is investing in modern security tooling, automation, and proactive threat prevention as part of a broader transformation.

This is a hands‑on Security Operations Lead role responsible for leading day‑to‑day security operations while owning and evolving the organisation’s core security tooling. Sitting between IT leadership and a centralised security function, the role manages a small team of L1/L2 analysts and acts as the technical escalation point above a 24/7 managed SOC. The focus is on prevention, detection quality, and continuous capability improvement rather than reactive alert handling. You will act as a Senior Engineer as well as management of a small team, therefore you will demonstrate the ability and willingness to get involved in both.

• Lead and develop a small team of Security Operations analysts, providing technical guidance, mentoring, and day‑to‑day operational leadership.
• Own and continuously improve the organisation’s security tooling, including EDR, SIEM, web proxy/zero trust, and email security platforms.
• Act as the internal escalation point for security incidents raised by the managed SOC, leading investigations and response activities.
• Build and refine SIEM use cases, detection rules, dashboards, and automation to improve signal quality and reduce noise.
• Manage the relationship with the managed security service provider, ensuring effective escalation, clear accountability, and value delivery.
• Drive a prevention‑led security posture by identifying control gaps and implementing improvements aligned to real‑world threat activity.
• Engage with technology and business stakeholders to ensure security controls support operational needs in a regulated environment.

• Strong hands‑on experience in a Security Operations or Security Engineering role, with some responsibility for managing or leading others.
• Deep practical knowledge of modern security tooling, including EDR platforms (e.g. CrowdStrike, Carbon Black), SIEM, and email security.
• Experience working alongside a managed SOC or MSSP, including handling escalations and improving detection and response processes.
• Ability to translate threat intelligence and frameworks such as MITRE ATT&CK into pragmatic, effective operational controls.
• Experience in regulated environments such as financial services, insurance, banking, or similar.
• Exposure to zero trust, web proxy, or secure access technologies.

This role is suited to candidates who enjoy being technically involved while still leading and developing others. It will appeal to Security Operations Managers or senior SOC engineers ready to step into a broader ownership and leadership position.