3 hours ago
London, United KingdomSenior
Responsibilities
- Own SOC operations and report on performance and health to business stakeholders.
- Lead investigations and incident response for complex or high-severity alerts, including stakeholder communication and post-incident reviews.
- Build, tune, and retire detections across Microsoft Sentinel and Defender.
- Translate threat intelligence into detection logic and hunting activity using a coverage model such as MITRE ATT&CK.
- Build and monitor SOAR automation and Sentinel Logic App playbooks.
- Manage the managed SOC relationship, including scope, SLAs, escalation criteria, and technical escalations.
- Maintain playbooks, escalation paths, and documentation while tracking triage time, false-positive rates, and coverage gaps.
- Evaluate and introduce AI-assisted SOC tooling for triage, enrichment, detection authoring, and alert summarization while retaining human judgment for nuanced cases.
Requirements
- 5+ years of experience in a SOC, security operations, or detection engineering role, with progression into a senior individual contributor position.
- Hands-on experience with Microsoft Sentinel and Defender, including building detections.
- Experience conducting investigations and incident response while communicating with stakeholders under pressure.
- Experience building SOAR and automation content, such as Sentinel Logic Apps, including monitoring for silent failures.
- Strong understanding of attack patterns and MITRE ATT&CK and how to create a detection coverage model.
- Experience directing a managed or outsourced SOC or MDR provider, including setting scope, SLAs, and escalation criteria.
- Practical experience applying AI or LLM tooling to SecOps work.
- Strong communication, stakeholder management, critical thinking, and influencing skills.
- Curiosity about new technologies and frameworks.
- Preferred: experience in regulated financial services.
- Preferred: exposure to identity-centric detection with Entra ID and cloud-native threat detection.
- Preferred: GCIH, GCFA, or an equivalent hands-on incident response or detection certification.
- Preferred: participation in the SOC and detection engineering community through conferences, speaking, or open-source detection content such as Sigma rules.
Benefits
- Hybrid working with at least one day per week in the London office.
- Competitive bonus scheme.
- Flexible benefits budget and salary sacrifice options for electric cars, nursery schemes, home goods, and technology.
- Three-month work-from-anywhere scheme.
- Mental wellbeing support through Spill.
- £1,000 personal development budget.
- Private healthcare through AXA and a medical cash plan for dental and optical expenses.
- Life insurance and income protection at four times annual salary.
- Matched pension contributions up to 5%.
- 25 days of holiday plus bank holidays, wellbeing days, and volunteering days.
- Enhanced maternity, paternity, and adoption leave.
Categories
About Flagstone
Flagstone operates a UK cash-deposit platform that lets individuals, businesses, advisers, and charities open and manage savings across multiple banks through one account, including Instant Access, Fixed Term, and ISA products. It earns revenue by facilitating deposits and partnerships with banks and via adviser and API distribution. Founded in 2013 and headquartered in London, the platform connects clients to 65+ banks and has 75,000+ customers with around £19bn held.