Lead Detection & Response Engineer

Lloyds Banking Group; Leeds; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

30 days holiday

Discretionary award

Flexible benefits

Colleague support initiatives

Job summary

Lloyds Banking Group is seeking a Lead Detection and Response Engineer to defend one of the UK's largest organisations from evolving cyber threats. You will lead investigations, analyse threats, and shape detection and response capabilities while remaining hands-on and mentoring Security Engineers.

In this hybrid role, you will balance technical delivery with leadership, driving continuous improvement and leveraging automation and AI-enabled tooling to enhance security operations across the

Qualifications

• Strong experience within a Security Operations Centre, Cyber Defence, Incident Response, Threat Hunting or a related cyber security environment.
• Experience investigating and responding to cyber security incidents using enterprise security technologies and processes.
• Strong understanding of threat detection lifecycles, attacker behaviours and tactics, techniques and procedures.
• Proven ability to lead, mentor and develop colleagues while fostering an inclusive, high-performing team culture.

Responsibilities

• Leading investigations into security alerts, incidents and emerging threats, ensuring effective containment, eradication and recovery activities.
• Analysing security events, attacker behaviours and threat intelligence to identify risks and determine appropriate response actions.
• Conducting threat hunting, forensic investigations and proactive cyber defence activities to identify previously unknown threats.
• Contributing to the ongoing enhancement of detection and response capabilities through continuous improvement initiatives.
• Using automation, AI and modern security tooling to improve operational effectiveness and efficiency.
• Supporting, developing and managing Security Engineers while promoting engineering excellence and knowledge sharing.

Skills

Security operations

Incident response

Threat hunting

Leadership

Mentoring

Analytical thinking

Communication

Job description

WORKING PATTERN: Our work style is hybrid, which involves spending at least two days per week, or 40% of your time, at one of our office sites.

About this opportunity

Help defend one of the UK's largest organisations against evolving cyber threats. As a Lead Detection and Response Engineer within our Cyber Defence Centre, you'll play a key role in protecting the organisation through the investigation of security incidents, identification of malicious activity, and continuous improvement of detection and response capabilities.

You'll combine deep technical expertise with analytical thinking to investigate complex cyber security challenges, strengthen cyber resilience, and help shape how we detect and respond to threats across the Group. Alongside remaining hands‑on in cyber defence activities, you'll provide leadership and support to Security Engineers across the team, helping to raise technical standards and foster continuous learning.

Key responsibilities include:

• Leading investigations into security alerts, incidents and emerging threats, ensuring effective containment, eradication and recovery activities.
• Analysing security events, attacker behaviours and threat intelligence to identify risks and determine appropriate response actions.
• Conducting threat hunting, forensic investigations and proactive cyber defence activities to identify previously unknown threats.
• Contributing to the ongoing enhancement of detection and response capabilities through continuous improvement initiatives.
• Using automation, AI and modern security tooling to improve operational effectiveness and efficiency.
• Supporting, developing and managing Security Engineers while promoting engineering excellence and knowledge sharing.

About us / Why Lloyds Banking Group

Like the modern Britain we serve, we're evolving. Investing in the technologies, people and capabilities needed to make a real difference for our customers, we're building a more sustainable and inclusive future.

Our focus is on creating better outcomes for customers, colleagues and communities. By joining us, you'll have the opportunity to work on meaningful challenges, develop your skills and contribute to the security and resilience of one of the UK's largest organisations.

What you'll need

• Strong experience within a Security Operations Centre, Cyber Defence, Incident Response, Threat Hunting or a related cyber security environment.
• Experience investigating and responding to cyber security incidents using enterprise security technologies and processes.
• Strong understanding of threat detection lifecycles, attacker behaviours and tactics, techniques and procedures.
• Proven ability to lead, mentor and develop colleagues while fostering an inclusive, high-performing team culture.
• Strong analytical and problem-solving skills with the ability to assess complex situations and determine appropriate actions.
• Ability to influence technical outcomes through expertise, collaboration and credibility, communicating effectively with both technical and non-technical audiences.

And any experience of this would be really useful

• Experience in digital forensics, detection engineering or threat analysis.
• Experience applying automation or AI-enabled approaches to improve cyber defence outcomes.
• Experience contributing to continuous improvement initiatives within cyber security operations.

This is a place for you...

Our ambition is to be the leading UK business for diversity, equity and inclusion, supporting our customers, colleagues and communities. We are committed to creating an environment in which everyone can thrive, learn and develop.

We were one of the first major organisations to set goals on diversity in senior roles, create a menopause health package, and launch a dedicated Working with Cancer initiative.

We offer reasonable workplace adjustments for colleagues with disabilities, including flexibility in office attendance, location and working patterns. As a Disability Confident Leader, we guarantee interviews for a fair and proportionate number of applicants who meet the minimum criteria for the role and have a disability, long‑term health or neurodivergent condition, through the Disability Confident Scheme.

We provide reasonable adjustments throughout the recruitment process to reduce or remove barriers - just let us know what you need.

• 30 days' holiday, with bank holidays on top.
• Discretionary annual performance‑related award.
• Flexible benefits designed to support your health, wellbeing and lifestyle.
• Access to a range of colleague and family support initiatives.