Cyber Security Engineering Lead

Creation Recruitment Ltd.; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Creation Recruitment Ltd. is seeking a Cyber Security Engineering Lead to establish the technical foundations of a new Security Operations capability.

This hands-on leadership role will be the first dedicated SOC engineer, owning architecture, platforms, tooling and engineering roadmap. As the function grows, you may recruit and lead a broader SOC engineering team, reporting to the SOC Manager in a co-leadership model.

Qualifications

• Hands-on SOC engineering experience with strong focus on detection.
• Proven ability to design and implement a SIEM from the ground up.
• Experience deploying and tuning EDR/XDR architectures.
• Ability to build technical roadmaps, budgets and delivery plans.
• Strong scripting skills (Python, PowerShell) and automation mindset.

Responsibilities

• Designing and evolving the SOC architecture, tooling, integrations and standards.
• Leading the build of SIEM infrastructure, including data ingestion and normalization.
• Developing detection capabilities aligned with MITRE ATT&CK and customer needs.
• Establishing validation processes, red/blue exercises and threat emulation.
• Deploying and tuning EDR/XDR across endpoints and cloud environments.
• Interfacing with stakeholders to define operating models and timelines.
• Recruiting and mentoring future SOC engineers as the team grows.

Job description

We’re looking for an Cyber Security Engineering Lead to help build the technical foundations of a new Security Operations capability from the ground up.

This is a , hands-on role for someone who enjoys both building and leading. Initially, you’ll be the first dedicated technical SOC hire, taking ownership of the architecture, platforms, tooling and engineering roadmap. As the function grows, you’ll have the opportunity to recruit and lead the wider SOC engineering team.

You’ll work closely with the SOC Manager in a genuine co-leadership model. While they focus primarily on people, process and service delivery, you’ll take ownership of the technical environment. Together, you’ll define priorities, investment decisions, delivery timelines and the operating model for a scalable SOC.

What you’ll be doing

You’ll take responsibility for building and evolving the SOC’s technical capability, including:

• Designing and implementing the SOC architecture, tooling, integrations and engineering standards
• Building and managing SIEM infrastructure, including log ingestion, parsing, normalisation, retention and cost management
• Developing and refining detection capabilities aligned with MITRE ATT&CK, threat intelligence and customer requirements
• Establishing detection testing and validation processes, including purple-team and adversary-emulation exercises
• Deploying and tuning EDR/XDR solutions across endpoint environments
• Implementing and managing MDM/UEM, BYOD controls and remote device management
• Integrating endpoint, identity, cloud, network and application telemetry into SOC platforms
• Supporting and improving IAM, SSO, MFA, PAM, conditional access and secrets management
• Building automation around alert enrichment, investigations, ticketing and containment
• Providing senior technical leadership during complex investigations and major incidents
• Evaluating, selecting and managing security technology vendors and platforms
• Creating the engineering standards, documentation and workflows needed to scale the function
• Recruiting, mentoring and leading future SOC engineering hires as the team develops. SOC Engineering Manager SOC Engineering Manager

What we’re looking for

You’ll ideally bring:

• A strong background in SOC engineering, detection engineering or blue-team operations
• Hands-on experience designing and implementing a SIEM from the ground up, alongside SIEM administration
• Experience deploying and tuning EDR/XDR
• The ability and willingness to remain hands-on while building processes and laying the foundations for a future team
• Experience developing technical roadmaps, budgets and delivery plans
• Practical scripting and automation experience, ideally using Python, PowerShell or similar
• Experience evaluating, selecting and managing technology vendors
• Strong knowledge of MITRE ATT&CK, threat intelligence, detection validation and adversary emulation
• The ability to lead complex technical work while communicating effectively with both technical and non-technical stakeholders. SOC Engineering Manager