Staff Security Operations Engineer

Description

The company provides spend management solutions that make company money easier for finance teams and employees to manage. It has operated for 10 years, serves over 40,000 customers and employs more than 850 people from over 100 nationalities. It is a pre-IPO fintech, and its decisions affect every customer.

The Cybersecurity team is looking for a Staff Security Operations Engineer to set the SecOps roadmap and build the detection, response and investigation capability that protects the company. The role covers everything from framework-based strategy to the code that puts it into practice.

You report to the VP of Fraud & Security and work with Fraud, DevSecOps, Engineering, and Risk & Compliance. You will also work across the wider organisation and help less experienced security engineers grow as the function matures.

In your first six months you will map the security landscape, detection coverage, logging estate and cloud footprint, then publish a roadmap aligned with MITRE, NIST and CIS. You will agree it with Engineering, Risk & Compliance and leadership, set up the on-call rotation and alert response SLAs, and ship the first detection and automation changes along with KPIs that show their effect. The role can grow, including into people leadership.

The role suits you if you want high-impact work whose results show up in business metrics, prefer building a function to maintaining one, enjoy raising the standard around you and growing specialists, and move comfortably between threat modelling and writing automation. It is not a good fit if you need a groomed backlog and assigned tasks to do your best work, want purely strategic work without hands-on tooling, or are unwilling to take part in on-call.

The interview process has four steps: a 30-minute intro call with a Talent Partner; a 60-minute hiring manager interview on your experience, your approach to security operations and how you communicate; a 60-minute technical deep dive with two SecOps engineers covering SIEM, detection engineering, and your coding and automation work; and a 45-minute cross-functional interview with DevSecOps and Engineering leadership on working across teams.

Responsibilities

• Define and deliver a structured SecOps roadmap based on MITRE ATT&CK, NIST and CIS benchmarks.
• Own security investigations and digital forensics, from suspicious traffic through to full incident response, and feed the findings back into detection and prevention.
• Design, tune and scale the SIEM and logging pipeline, standardising log ingestion across services so real signals are not buried in noise.
• Strengthen the perimeter and authentication, covering WAF configuration, authorisation tuning and monitoring of suspicious traffic.
• Protect sensitive data with DLP controls, and match coverage to where the data actually sits.
• Set up the team's on-call rotation, defining alerting, escalation paths and response SLAs.
• Automate detection and response with code and AI to cut manual work and shorten time to resolution.
• Reduce SecOps-attributed risk arising from compliance gaps, and gather the evidence that proves it.
• Build dashboards and reports on response times, coverage and risk reduction for the team and leadership.
• Turn threat models into changes that engineers without a security background can ship.

Requirements

• Over 10 years in security operations, incident response or a closely related field, with a record of reducing risk in measurable ways such as money protected, incidents contained, or forensic work that changed outcomes.
• A strong development background, and you write the automation yourself rather than only specifying it.
• Hands-on experience running a SOC and SIEM, including detection engineering and log pipeline design.
• Experience in scale-up companies, where you built capability rather than inheriting a mature one.
• A solid grasp of cloud architecture on AWS, plus GCP for part of the estate, and how infrastructure choices shape detection and response.
• Proven use of AI and/or coding automation to build, deploy and run security controls in practice.
• Fintech, payments, fraud or trust and safety experience is a real advantage, as is exposure to highly regulated environments.
• Relevant backgrounds include incident response, IR management, SOC engineering, security engineering, DevSecOps, and red or blue team work.

Conditions

The role can be remote, hybrid or in-office in any of the listed locations, but you must be physically based in your chosen country with a valid right to work there.

Visa sponsorship is not available for this role in any of the listed locations.

Taking part in the on-call rotation is part of the role.

English is the company language, so you will work in English day to day.

The company encourages applications from people of all backgrounds, including those who do not meet every requirement.

Benefits

• A the company card of your own for company spending, so no more paying out of pocket.
• Lunch on work days, either catered meals or a lunch allowance based on your local office.
• Comprehensive private healthcare, with coverage options such as Vitality, Alan or Médis depending on location.
• 25-28 days of holiday depending on location, plus public holidays.
• Option to buy 5 additional days of holiday through salary sacrifice.
• Hybrid or fully remote working options.
• Free access to MyndUp mental health and well-being support.
• Paid parental leave.