Security Monitoring & Detection Engineering Lead

Job Description Help protect the trust behind investing.

At AJ Bell, we believe investing should feel good. For our customers to feel confident about their investments, they need to know that the technology, data and services behind them are secure.

As our Security Monitoring & Detection Engineering Lead, you'll play a critical role in making that possible. You'll be the principal technical authority for our Security Monitoring & Detection Engineering capability, shaping how we monitor, detect and respond to threats across AJ Bell.

This is a senior, hands-on technical role. You'll own the architecture and engineering of Microsoft Sentinel and our wider security monitoring estate, lead complex investigations and technical incident response, and turn real-world adversary behaviour into effective detection and response.

You'll work across Cyber Defence Operations, Technology and our Managed Security Service Provider (MSSP), bringing people, technology and intelligence together to reduce the potential for customer, operational, financial and regulatory harm.

The role would particularly suit an experienced detection engineering, security operations, red-team, purple-team or offensive-security leader who wants to combine deep technical expertise with meaningful leadership and measurable security outcomes.

What you'll doSet the direction for security monitoring

You'll provide the technical leadership and direction that keeps our monitoring and detection capability effective, relevant and aligned to the threats we face.

Own the technical direction, quality and delivery performance of Security Monitoring & Detection Engineering, translating CDO priorities into a clear roadmap for monitoring, detection, investigation and response.

Lead the architecture, engineering and continued development of our SIEM solution, ensuring the SIEM remains resilient, scalable, cost-effective and aligned with AJ Bell’s technology estate and threat profile.

Define and govern the onboarding of security telemetry across on-premises, Microsoft Azure, AWS and third-party services, ensuring log sources address genuine visibility gaps and provide reliable value for detection and investigation.

Own the detection engineering lifecycle across requirements, design, testing, deployment, tuning, performance assessment and retirement, supported by version control, peer review and controlled release practices.

Build better detection and response

You'll lead the engineering discipline behind our detection capability, continually improving how we identify, investigate and respond to threats.

Lead the development of analytics rules, hunting queries, workbooks and automated investigation and response workflows.

Own the operational effectiveness of security solutions managed by CDO ensuring configurations, integrations, detections and workflows deliver measurable security outcomes.

Drive threat-informed defence with Cyber Threat Intelligence and Cyber Threat Exposure Management, translating relevant threat actors, campaigns, TTPs, IOCs, critical vulnerabilities and attack paths into detections, targeted threat hunts and automated defensive actions.

Identify and deliver appropriate uses of automation and AI across detection engineering, enrichment, investigation and response, measuring the resulting improvement in quality, speed, consistency or coverage.

Lead complex investigations and incidents

When a significant threat emerges, you'll provide the senior technical judgement needed to understand what has happened, contain the threat and reduce its impact.

Act as the senior technical escalation point for complex, ambiguous and high-severity security events, leading investigations through scoping, attack reconstruction, business-impact assessment,…