Lead, Security Operations & Incident Response

You will be accountable for building a resilient, intelligence-led defence operation. This includes leading a team of internal analysts, governing external SOC/MSSP partners, and partnering with technology teams to embed security across cloud, on-premise, and media production environments.

• Manage, coach and develop a team of 4-5 security analysts; provide direction, prioritization and quality oversight.
• Govern third-party SOC / MSSP relationships — drive SLA adherence, service improvement and value realization.
• Own the end-to-end Sec Ops process and drive automation to improve MTTD / MTTR.
• Manage budgets, vendor contracts, and evaluation / rollout of new defence tooling.

• Take ownership of real-time monitoring, alert triage and proactive hunting activities to pre-empt threats.
• Serve as the senior escalation for critical incidents (SIRM function) — orchestrate containment, eradication, recovery and lessons-learned.
• Engineer and continuously tune detections, correlation logic and hunt playbooks across SIEM and EDR stacks.
• Author and regularly exercise IR playbooks, escalation matrices and crisis communication plans; ensure readiness through tabletop exercises.

• Operationalize threat intelligence — ingest, contextualize and apply intel to detection and response.
• Keep abreast of emerging threats, adversary TTPs and threat actor campaigns, particularly those targeting media & content platforms.
• Engage with external intel-sharing forums, regulators, and technology partners to strengthen collective defence.
• Work in lockstep with Cloud, Dev Ops, IT and Infrastructure teams to ensure security controls (firewall, IDS/IPS, encryption, IAM) are architected and operated effectively.

• Report Sec Ops performance, risk posture and improvement roadmaps to the CISO and senior leadership through clear metrics and KPIs.
• Ensure operations remain compliant with NIST CSF, ISO 27001, GDPR, SOC 2 and other applicable standards.

• 7+ years of progressive experience in Cyber Security, with at least 3 years managing a Sec Ops / SOC team in an enterprise or hybrid outsourced model.
• Demonstrated success leading complex incident response, crisis management and threat hunting at scale.
• Strong practitioner-level expertise across SIEM (Splunk, Sentinel etc.), SOAR, EDR and TIP.
• Solid grasp of cloud security across AWS / Azure / GCP; experience securing streaming, OTT or content delivery workflows is highly desirable.
• Deep understanding of MITRE ATT&CK and how to operationalize it for detection coverage.
• Working knowledge of scripting & analytics — Python, Power Shell, KQL, SPL or similar.
• Outstanding leadership, communication and stakeholder influence — able to brief senior executives under pressure.
• Industry certifications are a plus: CISSP, CISM, GCIH, ECIH, CCSP, AWS Security Specialty, Azure Security Engineer.