Security Operations Engineer - Hybrid

Full-time Permanent Associate

Posted 01 Apr 2026

Detect, investigate, respond and help build the platform that does it better next time.

Location: UK (Hybrid)

Reports to: Head of Security Operations

Type: Permanent, Full-Time

Cyba Verse operates a lean, automation-driven security operations function built on our Cyba Ops platform. We do not run a traditional tiered SOC. There is no conveyor belt of copy-paste alerts, no rigid escalation chain, and no ceiling on what you can get involved in.

As a Security Operations Engineer you will work directly within the operations function, handling real investigations, contributing to detection improvement, and getting hands‑on with the tooling that powers the service. You will be expected to think, not just triage. When you spot something that should be automated or improved, you will have the space to say so and help fix it.

This role suits someone who has a solid grounding in security operations, is hungry to develop beyond alert handling, and wants to work in an environment where quality of thinking matters more than time‑on‑console.

We are not looking for someone to sit in a queue. We are looking for someone who wants to understand what they are seeing, improve how we see it, and get better every week.

• Investigating security alerts and incidents across endpoint, network, cloud, and identity environments using the Cyba Ops platform
• Conducting structured threat investigations: building timelines, identifying root cause, and producing clear, client‑ready findings
• Contributing to detection improvement: identifying gaps, raising tuning recommendations, and helping write or refine SIEM rules
• Supporting incident response activity, including containment actions and post‑incident documentation
• Performing threat hunting across client environments based on intelligence or anomaly‑driven hypotheses
• Working with threat intelligence feeds to enrich investigations and identify emerging attacker behaviour
• Documenting findings to a high standard for both internal records and client‑facing outputs
• Collaborating with the Head of Security Operations and wider team to improve processes, runbooks, and automation workflows
• Supporting onboarding of new clients including log source validation and initial detection tuning

• Hands‑on experience in a security operations or incident response role, whether in‑house, MSSP, or consultancy
• Solid understanding of the attack lifecycle and common attacker techniques, with working knowledge of MITRE ATT&CK
• Practical experience with SIEM platforms: log analysis, query writing, alert investigation
• Ability to investigate across multiple data sources and piece together a coherent picture of what happened
• Clear written communication — you can explain a technical finding to someone non‑technical without losing accuracy
• Genuine curiosity about how things work and why attacks succeed
• Experience with EDR platforms (Crowd Strike, Sentinel One, Microsoft Defender or similar)
• Exposure to SOAR tooling or any scripting/automation for operational tasks (Python, Power Shell)
• Familiarity with cloud environments:
  Azure, AWS, or GCP log sources and common misconfigurations
• Experience with network‑traffic analysis or IDS/IPS alert investigation
• Any threat intelligence or CTI exposure: indicator enrichment, threat actor research
• Relevant certifications such as BTL1, SC‑200, CySA+, CEH, or GCIH — useful context but not a barrier

The team is small and the work is varied. You will not spend years in a defined lane before being allowed to do anything interesting. From early on you will be handling real investigations, contributing to how we improve, and working alongside senior practitioners who will invest time in your development.

We use automation to handle the repetitive so that the team can focus on the work that requires judgement. If you have ideas about how to do something better, we want to hear them.

• A rigid tier‑1 alert queue with no room for independent thinking
• A siloed role with a narrow remit and no path to grow
• A culture where junior team members are seen and not heard

• Real investigations from day one, not filtered‑down leftovers
• A team that values quality of thinking over volume of tickets closed
• Genuine support for your development and clear progression into more senior work
• A company in active growth with interesting clients and a product that is actively evolving

GBP 50,000 - 70,000

Salary is dependent on experience. We will assess the full range based on what you bring to the role.