Staff Security Operations Engineer

Description

The company builds spend management solutions that make company money easier to handle for finance teams and employees alike.

It has been operating for 10 years, serves over 40,000 customers, and has more than 850 people from over 100 nationalities.

The company is pre-IPO, and this role sits in the Cybersecurity team.

You will report to the VP of Fraud & Security and work closely with Fraud, DevSecOps, Engineering, and Risk & Compliance.

You will set the direction and deliver the SecOps roadmap, building detection, response, and investigation capability for a fast-growing fintech.

You will partner with teams across the company and help less experienced security engineers grow as the function matures.

The interview process has four stages: a 30-minute intro call with the Talent Partner, a 60-minute hiring manager interview on your experience, your approach to security operations, and how you communicate, a 60-minute technical deep dive with 2 SecOps engineers on SIEM, detection engineering, and your coding and automation work, and a 45-minute cross-functional interview with DevSecOps and Engineering leadership.

In your first 6 months, you will learn the security landscape, detection coverage, logging estate, and cloud footprint, then form your own view of the biggest risks.

Within that period, you will publish a SecOps roadmap mapped to MITRE, NIST, and CIS, agree it with Engineering, Risk & Compliance, and leadership, and begin delivering against it.

You will also set up the on-call rotation and the alert response SLAs that go with it, ship your first detection and automation improvements, and define the KPIs that show what changed.

The scope of the role can grow into bigger projects, leadership, or new skills, including people leadership.

This role suits you if you want a large blast radius and real business metrics affected by your projects, you prefer building a function to maintaining one, you enjoy raising the bar and growing specialists, and you are as comfortable in a threat model discussion as writing the automation that acts on it.

This role is not a good fit if you need a groomed backlog and assigned tasks to do your best work, prefer to stay purely strategic, or are not willing to take part in an on-call rotation.

Responsibilities

• Build and own a structured SecOps roadmap based on frameworks such as MITRE ATT&CK, NIST, and CIS benchmarks.
• Lead security investigations and digital forensics, from suspicious traffic through full incident response, and feed the findings back into detection and prevention.
• Design, tune, and scale the SIEM and logging pipeline, using standardised log ingestion across services so real signals are not lost.
• Strengthen perimeter and authentication controls, including WAF configuration, authorisation tuning, and monitoring for suspicious traffic.
• Protect sensitive data with DLP controls, making sure coverage matches where the data is actually stored.
• Improve the team's on-call rotation by defining alerting, escalation paths, and response SLAs.
• Automate detection and response workflows with code and AI to cut manual toil and shorten time to resolution.
• Reduce SecOps-attributed risk tied to compliance gaps, and gather the evidence that proves it.
• Build dashboards and reports that give the team and leadership clear visibility into response times, coverage, and risk reduction.
• Work with engineers who lack a security background, turning threat models into changes they can ship.

Requirements

• 10+ years in security operations, incident response, or a closely related field, with a record of measurable risk reduction such as financial impact, contained incidents, or forensics that changed outcomes.
• A strong development background, so you can write the automation yourself rather than only specify it.
• Hands-on experience managing a SOC and SIEM, including detection engineering and log pipeline design.
• Experience in scale-up environments, where you built capability rather than inheriting a mature one.
• A strong understanding of cloud architecture on AWS, plus part of the estate on GCP, and how infrastructure choices shape detection and response.
• Proven use of AI and or coding automation to build, implement, and run security controls in practice.
• Backgrounds that tend to do well here include incident response, IR management, SOC engineering, security engineering, DevSecOps, and red or blue team.
• Fintech, payments, fraud, or trust & safety experience is a real advantage, and so is exposure to highly regulated environments.

Conditions

The role can be remote, hybrid, or in person in any of the listed locations.

You must be physically based in the country you choose and hold a valid right to work there.

Visa sponsorship is not available for this role in any listed location.

The team offers both hybrid and fully remote working options.

Taking part in the on-call rotation is part of the role.

Applicants from every background and experience are encouraged to apply.

Benefits

• A company card for your own spending, so you do not pay out of pocket.
• Lunch on work days, either catered meals or a lunch allowance based on your local office.
• Comprehensive private healthcare, with coverage options depending on your location.
• 25-28 days of holiday depending on location, plus public holidays.
• An option to buy 5 additional days of holiday through salary sacrifice.
• Free mental health and well-being support.
• Paid parental leave.