Head of Security Monitoring & Detection Engineering

Aj Bell; Manchester; On-site; GBP 90,000 - 120,000; Full time

Job summary

AJ Bell is seeking a hands-on Cyber Defence Operations Lead to own the architecture, engineering and operational performance of Microsoft Sentinel and the wider security monitoring estate, based in Manchester.

You will translate real-world adversary behaviour into effective monitoring and response, drive complex investigations, develop playbooks and ensure coordinated action with the MSSP and internal teams to reduce risk.

Responsibilities

• Own the technical direction, quality and delivery performance of Security Monitoring & Detection Engineering, translating priorities into a clear roadmap for monitoring, detection, investigation and response.
• Lead the architecture, engineering and continued development of the SIEM solution, ensuring resilience, scalability and alignment with technology estate and threat profile.
• Define onboarding of security telemetry across on-premises, Azure, AWS and third-party services, ensuring value for detection and investigation.
• Own the detection engineering lifecycle from requirements to retirement, with version control and controlled release practices.
• Lead analytics rules, hunting queries, workbooks and automated investigation and response workflows.
• Ensure operational effectiveness of security solutions managed by CDO with measurable outcomes.
• Drive threat-informed defence with Threat Intelligence and Exposure Management, translating adversaries into detections and defensive actions.
• Maintain evidence-based service performance through KPIs and MI, driving corrective actions to measurable outcomes.
• Lead technical escalation for complex security events, guiding investigations and containment.
• Lead tabletop, purple-team and practical exercises to test detection coverage and readiness.
• Operate the internal team and MSSP as one integrated monitoring and response capability, ensuring escalation consistency and performance.
• Maintain alert demand, detection quality and MTTA/MTTR metrics to prioritise improvements.
• Lead service reviews with vendors to maximise value of investments to CDO's objectives.
• Identify and deliver automation opportunities across detection, enrichment, investigation and response.

Job description

AJ Bell is seeking a hands-on Cyber Defence Operations Lead to own the architecture, engineering and operational performance of Microsoft Sentinel and the wider security monitoring estate, based in Manchester.

You will translate real-world adversary behaviour into effective monitoring and response, drive complex investigations, develop playbooks and ensure coordinated action with the MSSP and internal teams to reduce risk.