Lead Detection & Response Engineer

Lloyds; City of Edinburgh; Hybrid; GBP 90,000 - 140,000; Full time

Benefits offered by this job

Holiday allowance

Flexible working

Private medical insurance

Pension

Share plans

Job summary

Lloyds is seeking a Lead Detection and Response Engineer within our Cyber Defence Centre to defend against evolving cyber threats across the organisation. You will lead investigations into security alerts, analyse attacker behaviours and threat intelligence, and drive improvements in detection and response capabilities while remaining hands-on in cyber defence activities.

You will mentor Security Engineers, promote engineering excellence, and collaborate across teams to raise technical standards

Qualifications

• Experience investigating and responding to cyber security incidents using enterprise security technologies and processes.
• Strong experience within a Security Operations Centre, Cyber Defence, Incident Response, Threat Hunting or a related cyber security environment.
• Ability to influence technical outcomes through expertise, collaboration and credibility, communicating effectively with both technical and non-technical audiences.
• Proven ability to lead, mentor and develop colleagues while fostering an inclusive, high-performing team culture.
• Strong understanding of threat detection lifecycles, attacker behaviours and tactics, techniques and procedures.
• Strong analytical and problem-solving skills with the ability to assess complex situations and determine appropriate actions.
• Experience applying automation or AI-enabled approaches to improve cyber defence outcomes.
• Experience contributing to continuous improvement initiatives within cyber security operations.
• Experience in digital forensics, detection engineering or threat analysis

Responsibilities

• Lead investigations into security alerts, incidents and emerging threats, ensuring effective containment, eradication and recovery activities.
• Analysing security events, attacker behaviours and threat intelligence to identify risks and determine appropriate response actions.
• Conducting threat hunting, forensic investigations and proactive cyber defence activities to identify previously unknown threats.
• Contributing to the ongoing enhancement of detection and response capabilities through continuous improvement initiatives.
• Using automation, AI and modern security tooling to improve operational effectiveness and efficiency.
• Supporting, developing and managing Security Engineers while promoting engineering excellence and knowledge sharing

Skills

Security operations

Incident response

Threat hunting

Leadership

Automation/AI in security

Forensics

Threat intelligence

Communication

Tools

SIEM

SOAR

Job description

• Help defend one of the UK’s largest organisations against evolving cyber threats
• As a Lead Detection and Response Engineer within our Cyber Defence Centre, you’ll play a key role in protecting the organisation through the investigation of security incidents, identification of malicious activity, and continuous improvement of detection and response capabilities
• You’ll combine deep technical expertise with analytical thinking to investigate complex cyber security challenges, strengthen cyber resilience, and help shape how we detect and respond to threats across the Group
• Alongside remaining hands‑on in cyber defence activities, you’ll provide leadership and support to Security Engineers across the team, helping to raise technical standards and foster continuous learning
• Leading investigations into security alerts, incidents and emerging threats, ensuring effective containment, eradication and recovery activities
• Analysing security events, attacker behaviours and threat intelligence to identify risks and determine appropriate response actions
• Conducting threat hunting, forensic investigations and proactive cyber defence activities to identify previously unknown threats
• Contributing to the ongoing enhancement of detection and response capabilities through continuous improvement initiatives
• Using automation, AI and modern security tooling to improve operational effectiveness and efficiency
• Supporting, developing and managing Security Engineers while promoting engineering excellence and knowledge sharing

Benefits

• A generous holiday allowance: You’ll be eligible for a minimum of 22 days holiday (excluding bank holidays), rising to 30 days based on length of service and grade.
• A flexible way of working: Whether you want flexibility over your location or when you log on, together we can create an approach that works for you and for the business.
• Family leave: Up to 63 weeks of maternity or adoption leave. Statutory maternity or adoption pay is available for 39 weeks, and 20 weeks will be enhanced to the equivalent of full pay. Partners can have six weeks of fully paid paternity leave.
• Flex cash: This is 4% of your basic salary and can be used to spend on the benefits of your choice, or you can choose to take it as a cash top up in your monthly salary.
• Health insurance: Our company funded Private Medical Benefit provides all colleagues with access to good quality medical care, including accommodation, nursing care and specialist advice.
• Colleague Offers: Get discounts on everything from electrical items to cinema tickets and weekly food shopping. You can share this benefit with up to ten family members or friends.
• Financial products: Take advantage of our great financial products, some at a discounted rate, including current accounts, home and car insurance and loans.
• Share plans: Participate in Sharematch and receive matching shares of up to £45 a month from the company, and you can choose to participate in Sharesave, our combined savings and share option plan.
• Pension: We offer a generous pension plan, with all joiners being automatically enrolled in our ‘Your Tomorrow’ scheme. You can decide how much you save and get a say in where your contributions are invested.

Experience investigating and responding to cyber security incidents using enterprise security technologies and processesStrong experience within a Security Operations Centre, Cyber Defence, Incident Response, Threat Hunting or a related cyber security environmentAbility to influence technical outcomes through expertise, collaboration and credibility, communicating effectively with both technical and non-technical audiencesProven ability to lead, mentor and develop colleagues while fostering an inclusive, high-performing team cultureStrong understanding of threat detection lifecycles, attacker behaviours and tactics, techniques and proceduresStrong analytical and problem-solving skills with the ability to assess complex situations and determine appropriate actionsExperience applying automation or AI-enabled approaches to improve cyber defence outcomesExperience contributing to continuous improvement initiatives within cyber security operationsExperience in digital forensics, detection engineering or threat analysis