Head of Security Operations

• Foreign Exchange (FX)

You will own security operations at Sokin: build it, run it, and grow it. That covers detection strategy, incident response and management, vulnerability management, and identity governance, with day-to-day L1/L2 triage and a chunk of Sentinel content maintenance handled by an outsourced SOC/MSSP. The exact MSSP scope is still being finalized as part of a broader investment case, so you'll help shape the split between what the MSSP owns and what stays in-house as the function matures, rather than inheriting a fixed operating model.

This is not a queue-management role, and it's not a role where you sit above an MSSP and relay their output. You direct the detection strategy and hold the MSSP to a quality bar on the content they build and tune, you own L3 investigation and forensics, you run vulnerability management as a program rather than a scanner subscription, and you own identity governance and incident management end to end.

Where the MSSP can't cover something - bespoke detections, payments/fraud-specific logic, judgment calls in an active incident - that's you.

Sokin is a next-generation B2B financial services provider, enabling businesses to make and receive global payments with greater speed, lower cost, and total transparency.

Our mission is simple: we're simplifying global business - so businesses thrive wherever they choose to grow. We deliver services across:

• Global payments and receivables
• Foreign Exchange (FX)
• Treasury management
• Finance reconciliations

We are rapidly expanding, with established presence in EMEA, APAC, and North America, backed by a strong global infrastructure and industry-leading partners, we are redefining how businesses move money worldwide.

Our clients span industries from sports and entertainment to logistics and travel, and our community is growing rapidly. As we continue to expand, we're building a team of exceptional people who share our ambition to transform the future of global payments.

• Define and maintain the detection strategy, mapped to MITRE ATT&CK and iterated against real incidents and threat intel, not left as a static framework exercise
• Set the standards and review bar for Microsoft Sentinel content (detection rules, analytics, workbooks, Logic Apps playbooks) whether authored by the MSSP or in-house, and own detection-as-code practices - version control, peer review, testing - for that content
• Own the detections the MSSP can't reasonably build: bespoke, payments/fraud-specific, or identity-driven logic
• Onboard new log sources and systems into the detection pipeline as the platform evolves, and integrate Defender XDR, Wiz, Cloudflare, Zscaler, and other tooling as it's added, including email/data security telemetry (Defender for O365, DLP) once in scope
• Consume threat intelligence (feeds, ISACs, sector-specific sources) and translate it into detection and hunting priorities rather than treating it as a subscription nobody reads
• Build and maintain SOAR automation for alert enrichment, triage, and response actions, so the function scales with the estate rather than with headcount

• Own the MSSP/outsourced SOC relationship end to end: SLAs, triage quality, playbook tuning, and contract renewal or rescoping as the function's needs change
• Actively shape the boundary between MSSP and in-house scope as the team and platform mature, rather than treating today's split as permanent

• Lead incident response: own L3 investigation and forensic analysis across cloud and endpoint, working from MSSP escalations and your own detections
• Own incident management end to end alongside the CISO - major incident declaration, exec/board notification, and coordination with legal/comms on regulatory notification clocks (GDPR 72-hour, DORA incident classification and reporting) - not just the technical investigation
• Develop and maintain incident response playbooks and runbooks, and test them regularly through tabletop exercises rather than leaving them filed and unverified
• Drive post-incident reviews and RCAs, and feed lessons back into detection and playbook updates

• Own vulnerability management as a program: scanning coverage across cloud, endpoint, and applications, risk-based prioritization, remediation SLAs, and exception handling with named owners
• Own identity governance within security operations: privileged access monitoring, access anomaly…