Security Operations; SOC Engineer

At Engine by Starling, we are on a mission to find and work with leading banks all around the world who have the ambition to build rapid growth businesses, on our technology.

Engine is Starling's software-as-a-service (SaaS) business, the technology that was built to power Starling, and two years ago we split out as a separate business.

Starling has seen exceptional growth and success, and a large part of that is down to the fact that we have built our own modern technology from the ground up. This SaaS technology platform is now available to banks and financial institutions all around the world, enabling them to benefit from the innovative digital features, and efficient back-office processes that has helped achieve Starling's success.

We draw upon our experience as knowledgeable bankers, and best in class technologists to become the chosen option for these banks, and preferred partners for leading consultancies.

As a company, everyone is expected to roll up their sleeves to help deliver great outcomes for our clients. We are an engineering led company and we’re looking for someone who will be excited by the potential for Engine’s technology to transform banking in different markets around the world.

We have a Hybrid approach to working here at Engine - our preference is that you're located within a commutable distance of one of our offices so that we're able to interact and collaborate in person.

To support our rapid growth, we are looking for talented engineers to join our foundational in-house Sec Ops team. This is a "Full-Stack" security role: you will move beyond traditional monitoring to develop and operate our security capabilities.

We are looking for engineers who are masters of automation but remain grounded in analyst fundamentals. You should have a keen interest in leveraging AI and Large Language Models (LLMs) to reduce SOC toil - using AI to summarise complex alerts, auto-generate YARA-L detections, or build intelligent playbooks to stay ahead of modern threats.

• Active Monitoring:
  Monitor security alerts and events generated by the Sec Ops platform and integrated cloud security tools.
• Triage & Analysis:
  Perform deep-dive analysis of security incidents and anomalies, accurately distinguishing between true positives and false positives.
• Prioritisation:
  Manage the incident queue, prioritising alerts based on severity, potential impact, and business criticality.

• Detection as Code:
  Design and maintain sophisticated detection logic using YARA-L. Manage the lifecycle of these rules and configurations using IaC principles for version control.
• SOAR Extension:
  Lead the automation of response playbooks. You will write and extend SOAR capabilities using Python, creating custom integrations and "Managers" to connect Sec Ops with internal APIs.
• Tool Optimisation:
  Identify opportunities for automation to streamline operations and contribute to the continuous tuning and maintenance of SOC tools.

• End-to-End Investigation:
  Investigate incidents thoroughly, leveraging logs from platforms, endpoints, and applications mapped to the Unified Data Model (UDM).
• Incident Lifecycle:
  Lead containment, eradication, and recovery efforts in collaboration with Security and Technology teams.
• Documentation:
  Maintain comprehensive records of incident details, findings, and remediation steps to ensure a high standard of auditability.

• Group
  
  Collaboration:
  
  Work closely with the Group SOC team to align on global security standards and coordinate response efforts during cross-entity incidents.
• Threat Hunting:
  Stay informed about the latest cyber threats and cloud-specific vulnerabilities, conducting proactive threat-hunting activities using available telemetry.

• 3+ years of experience in a SOC or Sec Ops Engineering role, with a strong background in both alert triage and security engineering.
• Proficiency in Python:
  Ability to write clean code to automate workflows or interact with security APIs.
• Cloud Fluency:
  Experience with security monitoring and incident response in cloud environments (AWS/GCP/Azure).
• Infrastructure as Code:
  Familiarity with managing security configurations through Git-based workflows.
• Framework Knowledge:
  Strong understanding of attack vectors and the MITRE ATT & C K framework.
• Education:
  
  A degree in a cyber-related field or relevant certifications (e.g., CompTIA Security+, CySA+, GCIH) is beneficial.

Interviewing is a two way process and we want you to have the time and opportunity to get to know us, as much as we are getting to know you! Our interviews are conversational and we want to get the best from you, so come with questions and be curious. In general you can expect the below, following a chat with one of our Talent Team:

• Stage 1 - 45 mins technical intereview
• Stage 2 - Take home task
• Stage 3 - 60 min with Team…