Senior SecOps Engineer

The role

You will take ownership of security operations, including alert triage, incident response, and detection engineering. You will manage the relationship with a managed SOC provider and build automation using Microsoft Sentinel and Defender.

What you will do

• Take ownership of SOC operations and report performance to stakeholders
• Run investigations and incident response for complex or high severity alerts
• Manage the detection engineering backlog using Microsoft Sentinel and Defender
• Turn threat intelligence into detection logic and hunting activity
• Drive automation and SOAR maturity by building Logic App playbooks
• Manage the managed SOC relationship, defining scope and escalation criteria
• Review performance against SLAs and act as a technical escalation point
• Maintain playbooks, escalation paths, and documentation
• Track metrics like triage time, false positive rate, and coverage gaps
• Explore and introduce AI assisted tooling into SOC workflows

Required qualifications

• 5+ years in a SOC, security operations or detection engineering role, with progression into a senior IC position
• Hands-on experience with Microsoft Sentinel and Defender, building detections rather than just consuming alerts
• Experience owning a Sentinel platform, including data connectors, ingestion and SIEM integrations
• Experience running investigations and incident response, including communicating with stakeholders under pressure
• Experience building SOAR and automation content (for example Sentinel Logic Apps), including monitoring for silent failure
• Experience owning or building a detection-as-code pipeline, with detections managed in Git and deployed through CI/CD
• Scripting skills e.g. Python or PowerShell
• A strong grasp of attack patterns and MITRE ATT&CK, and how to turn them into a detection coverage model
• Experience directing a managed or outsourced SOC or MDR provider, setting scope, SLAs and escalation criteria
• Practical experience applying AI or LLM tooling to SecOps work
• Strong communication and stakeholder skills, with the confidence to influence senior stakeholders
• Critical thinking and a real curiosity for new technologies and frameworks

Nice to have

• Experience in regulated financial services
• Exposure to identity centric detection (Entra ID) and cloud native threat detection
• GCIH, GCFA or an equivalent hands-on IR or detection certification
• Links to the SOC and detection engineering community, through conferences, speaking or open source detection content such as Sigma rules

Benefits

• Hybrid working - Spend at least 1 day a week with your team in our collaborative London office
• Competitive bonus scheme
• Flexible benefits budget
• Salary sacrifice options for electric cars, nursery schemes, home and tech goods
• Around the World scheme - 3 months work from anywhere scheme
• Mental wellbeing support – Access therapy and mental health sessions through Spill
• £1,000 personal development budget
• Private health care via AXA
• Medical cash plan for dental and optical expenses
• Life insurance and Income Protection - four times your annual salary
• Matched pension contributions up to 5%
• 25 days holiday plus bank holidays, well-being days and volunteering days

About the company

Flagstone is an online savings platform that reinvents how individuals, businesses, and charities manage, protect, and grow their cash. It is a thriving, profitable business with a collaborative culture.