Head of Security Operations in London

You will own security operations at Sokin: build it, run it, and grow it. That covers detection strategy, incident response and management, vulnerability management, and identity governance, with day-to-day L1/L2 triage and a chunk of Sentinel content maintenance handled by an outsourced SOC/MSSP. The exact MSSP scope is still being finalized as part of a broader investment case, so you'll help shape the split between what the MSSP owns and what stays in-house as the function matures, rather than inheriting a fixed operating model.

This is not a queue-management role, and it's not a role where you sit above an MSSP and relay their output. You direct the detection strategy and hold the MSSP to a quality bar on the content they build and tune, you own L3 investigation and forensics, you run vulnerability management as a program rather than a scanner subscription, and you own identity governance and incident management end to end. Where the MSSP can't cover something - bespoke detections, payments/fraud-specific logic, judgment calls in an active incident - that's you.

About Us

Sokin is a next-generation B2B financial services provider, enabling businesses to make and receive global payments with greater speed, lower cost, and total transparency. Our mission is simple: we’re simplifying global business - so businesses thrive wherever they choose to grow. We deliver services across:

• Global payments and receivables
• Foreign Exchange (FX)
• Treasury management
• Finance reconciliations

We are rapidly expanding, with established presence in EMEA, APAC, and North America, backed by a strong global infrastructure and industry-leading partners, we are redefining how businesses move money worldwide. Our clients span industries from sports and entertainment to logistics and travel, and our community is growing rapidly. As we continue to expand, we’re building a team of exceptional people who share our ambition to transform the future of global payments.

What you'll do

• Detection strategy & engineering
  • Define and maintain the detection strategy, mapped to MITRE ATT&CK and iterated against real incidents and threat intel, not left as a static framework exercise.
  • Set the standards and review bar for Microsoft Sentinel content (detection rules, analytics, workbooks, Logic Apps playbooks) whether authored by the MSSP or in-house, and own detection-as-code practices - version control, peer review, testing - for that content.
  • Own the detections the MSSP can't reasonably build: bespoke, payments/fraud-specific, or identity-driven logic.
  • Onboard new log sources and systems into the detection pipeline as the platform evolves, and integrate Defender XDR, Wiz, Cloudflare, Zscaler, and other tooling as it's added, including email/data security telemetry (Defender for O365, DLP) once in scope.
  • Consume threat intelligence (feeds, ISACs, sector-specific sources) and translate it into detection and hunting priorities rather than treating it as a subscription nobody reads.
  • Build and maintain SOAR automation for alert enrichment, triage, and response actions, so the function scales with the estate rather than with headcount.
• MSSP & outsourced SOC
  • Own the MSSP/outsourced SOC relationship end to end: SLAs, triage quality, playbook tuning, and contract renewal or rescoping as the function's needs change.
  • Actively shape the boundary between MSSP and in-house scope as the team and platform mature, rather than treating today's split as permanent.
• Incident response & management
  • Lead incident response: own L3 investigation and forensic analysis across cloud and endpoint, working from MSSP escalations and your own detections.
  • Own incident management end to end alongside the CISO - major incident declaration, exec/board notification, and coordination with legal/comms on regulatory notification clocks (GDPR 72-hour, DORA incident classification and reporting) - not just the technical investigation.
  • Develop and maintain incident response playbooks and runbooks, and test them regularly through tabletop exercises rather than leaving them filed and unverified.
  • Drive post-incident reviews and RCAs, and feed lessons back into detection and playbook updates.
• Vulnerability management & identity governance
  • Own vulnerability management as a program: scanning coverage across cloud, endpoint, and applications, risk-based prioritization, remediation SLAs, and exception handling with named owners.
  • Own identity governance within security operations: privileged access monitoring, access anomaly detection, joiner/mover/leaver assurance from a security lens, and identity-related detection coverage across Entra ID/Okta and cloud IAM.
• Metrics, team, and reporting
  • Own MTTD, MTTR, and other operational metrics: baseline them, track them, and drive them down.
  • Manage the security operations team, including direct line management of the Security Analyst, and build the hiring/leveling plan as team and MSSP scope evolve.
  • Manage SOC systems, tooling, and processes end to end, including budget and licensing conversations with the CISO.
  • Support the CISO on incident communication, board/customer reporting, and post-incident reviews.

What we're looking for

• Essential:
  • Deep Microsoft Sentinel experience: KQL proficient, able to author and critically review detection rules, workbooks, and playbooks, even where day-to-day content maintenance sits with a third party.
  • Experience onboarding new data sources into a SIEM and scaling detection coverage as an environment grows.
  • Hands-on incident response and digital forensics experience across cloud and endpoint, including running an incident through containment, eradication, and RCA, not just triage.
  • Experience sharing ownership of the incident management process: major incident declaration, exec communication, and regulatory notification timelines (GDPR, DORA, or equivalent), typically alongside a CISO or equivalent.
  • Applied MITRE ATT&CK knowledge used in detection engineering, not just framework familiarity.
  • Experience running or managing vulnerability management as a program: tooling, prioritization, remediation tracking, and reporting.
  • Working knowledge of identity governance and access risk (privileged access, JML, IAM/entitlement review) as it applies to security operations.
  • Experience managing an MSSP/outsourced SOC relationship, including SLAs, contract or scope negotiation, and holding a third party accountable for quality.
  • Experience running tabletop exercises or equivalent IR plan testing.
  • Cloud security telemetry: AWS CloudTrail, Azure Monitor, GCP audit logs.
  • Strong written communication for incident reports and RCAs aimed at non-technical readers.
• Nice to have:
  • Prior people management or mentoring experience in a SOC or detection engineering team.
  • Experience with Defender XDR (Defender for Endpoint, Identity, Cloud Apps).
  • Wiz or equivalent CSPM integration into detection pipelines.
  • Fintech, payments, or regulated environment background.
  • Formal threat intelligence platform experience (beyond consuming feeds).
  • Python or PowerShell for automation.
  • Certifications (valued, not required): SC-200, AZ-500, GCIA, GCIH, GCFE, GCFA, or equivalent applied experience.

Why this role

Real ownership of security operations from day one, with direct CISO access and a mandate to define - not just inherit - the split between an outsourced SOC and in-house engineering as the function scales. You'll build detection strategy, IR, vulnerability management, and identity governance as one coherent function, with real influence over how the operating model is shaped.

Please note, candidates will need to have the right to work in the jurisdiction that they are looking to work in. The main responsibilities of this role are outlined above; however, this description is not exhaustive, and the job holder may be required to undertake additional duties from time to time to ensure the smooth running of the department. The role may require some working outside our normal working hours.