Head of Security Operations & Detection

Sokin; Greater London; Hybrid; GBP 120,000 - 180,000; Full time

Job summary

Sokin is hiring a Head of Security Operations to build, run, and mature a unified security program. You will own detection strategy, L1/L2 triage, incident response, vulnerability management, and identity governance, coordinating with an outsourced SOC and MSSP.

You’ll shape the operating model and ensure quality across in-house and partner teams. You will lead the end-to-end security lifecycle, from detection engineering to post-incident RCAs, working with executives on regulatory deadlines and

Qualifications

• Experience building and running security operations programs.
• Ability to own L3 investigations and forensics.
• Ability to manage MSSP relationships and in-house engineering.
• Experience onboarding new data sources into SIEM/detection pipelines.
• Familiarity with MITRE ATT&CK and detection engineering.

Responsibilities

• Define and maintain detection strategy aligned to MITRE ATT&CK.
• Review and own Sentinel content and detection-as-code practices.
• Own MSSP oversight and boundary between outsourced and in-house work.
• Lead incident response, including major incident declarations and RCAs.
• Oversee vulnerability management and identity governance as a program.

Skills

Sentinel expertise

Incident response

Threat detection

MSSP management

Identity governance

Tools

Defender XDR

Wiz

Cloudflare

Zscaler

Entra ID/Okta

Job description

Sokin is hiring a Head of Security Operations to build, run, and mature a unified security program. You will own detection strategy, L1/L2 triage, incident response, vulnerability management, and identity governance, coordinating with an outsourced SOC and MSSP.

You’ll shape the operating model and ensure quality across in-house and partner teams. You will lead the end-to-end security lifecycle, from detection engineering to post-incident RCAs, working with executives on regulatory deadlines and