Security Operations Lead

Experience:

8+ Yrs.

Work Mode:
Remote

Shift:
UK Shift (1 PM to 9 PM / 2 PM to 10 PM)

Provide practical technical leadership for security monitoring, detection, and operational incident response. Coordinate the security operations service so that credible threats are identified, investigated, and escalated consistently, and agreed response actions are executed safely. Translate attack lessons and service evidence into better detections, response readiness, and prioritised improvement, while coaching colleagues and maintaining dependable operational standards.

• Operational Scope & Authority: Lead day-to-day technical priorities, triage quality, and operational coordination within the scope, policies, and playbooks agreed by the VP Cyber Security Operations. Recommend improvements and allocate operational work within confirmed authority. This role does not assume ownership of security strategy, approved budgets, staffing decisions, or enterprise-wide risk acceptance.
• Incident & Containment Boundaries: Execute authorised response playbooks and elevate incidents, confirmed threats, and exceptions promptly. Disruptive containment (service isolation/shutdown) requires authority specified in approved incident arrangements; urgency does not create additional delegation. Crisis leadership, material business decisions, and external communications remain with designated accountable leaders. Legal and the DPO govern regulatory notifications.
• Governance Accountabilities: The CISO retains security strategy and governance accountability; authorised business owners retain risk acceptance. Formal people-management duties, spending limits, and out-of-hours participation must be explicitly agreed.
• Reporting & Cross-Functional Alignment: Work with the VP Cyber Security Operations on service priorities, escalations, and readiness, and with the CISO on material security issues through agreed reporting routes. Partner with Security GRC on policy interpretation, risk evidence, assurance, and exceptions. Engage Legal, DPO, and crisis leaders through approved procedures.
• Functional Boundaries: Maintain a clear boundary with Security Architecture & Engineering. Operations owns monitoring, detections, and operational response, feeding attack lessons into engineering. Architecture & Engineering owns secure designs, control engineering, and operational handover. Both functions jointly accept logging coverage, runbooks, maintainability, and observability.
• Remediation & Service Management: Asset, application, and platform owners execute assigned remediation/recovery changes, with Operations supplying evidence, priorities, and follow-up. Coordinate with technology service management, business owners, and security service providers (MSSP) to align incident handling with service impact and change control.

• Monitoring & Service Coordination: Coordinate the SOC service, queues, and handovers across internal teams and service providers. Validate alerts, establish severity and business context, oversee investigation quality, and ensure escalation reaches the right accountable owner. Maintain case records, operational procedures, and service health checks; identify monitoring gaps and drive remediation.
• Incident Response & Readiness: Lead technical investigation and coordinate agreed response activities, documenting hypotheses, findings, decisions, and escalation. Preserve evidence integrity, timestamps, provenance, access controls, and chain of custody in accordance with retention and privacy requirements. Maintain and exercise playbooks, coordinate recovery validation with platform owners, and turn post-incident reviews into assigned improvements.…