Security Operations Engineer (8F97705)

Referment; Manchester; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

Referment is recruiting for a Security Operations Engineer to join a UK-based fintech in Manchester. You will work with the Cyber Security Manager and Engineering teams to protect people, platform and customers, running security operations across cloud, endpoint, network and applications.

You will lead investigations, develop detections, automation and tooling, and coordinate end-to-end vulnerability management while embedding security in the SDLC.

Qualifications

• Experience in a Security Operations, Cyber Security or Information Security role.
• Strong scripting or programming skills (e.g. Python or PowerShell) for building automations and integrations.
• Hands-on experience with application security testing methodologies such as SAST, DAST, SCA and SBOM.
• Knowledge of security monitoring technologies, SIEM platforms, vulnerability management and incident response.
• Familiarity with frameworks and standards such as ISO 27001, PCI DSS, SOC 2, Cyber Essentials or SWIFT CSP.
• Clear communication, comfortable working across technical and non-technical teams.

Responsibilities

• Monitor, manage and continually improve security operations across cloud, endpoint, network and application environments.
• Lead the investigation, triage and response to security incidents, minimising risk and improving resilience.
• Develop and optimise detection rules, automations and security tooling to strengthen threat detection and response.
• Coordinate vulnerability management end to end, from scanning and prioritisation through to remediation and reporting.
• Work with Engineering to identify vulnerabilities and embed security across the development lifecycle.
• Identify opportunities to leverage AI-powered security tooling and automation for proactive threat management.

Skills

Security operations

Python

PowerShell

SAST

DAST

SCA

SBOM

SIEM

Vuln mgmt

Incident response

ISO 27001

Tools

SIEM platforms

Vulnerability scanners

Automation tooling

Job description

Referment is working with a UK-based fintech that connects corporate finance and treasury teams directly with their banks, automating payments, collections, statement retrieval and cash management on one secure platform. You'll join the Cyber Security team as a Security Operations Engineer, working closely with the Cyber Security Manager and Engineering teams to protect the company's people, platform and customers. It's a hands-on role with real ownership: you'll run security operations across cloud, endpoint, network and application environments, and help embed security throughout the software development lifecycle in a secure-by-design culture.

The Role

• Monitor, manage and continually improve security operations across cloud, endpoint, network and application environments.
• Lead the investigation, triage and response to security incidents, minimising risk and improving resilience.
• Develop and optimise detection rules, automations and security tooling to strengthen threat detection and response.
• Coordinate vulnerability management end to end, from scanning and prioritisation through to remediation and reporting.
• Work with Engineering to identify vulnerabilities and embed security across the development lifecycle.
• Identify opportunities to leverage AI-powered security tooling and automation for proactive threat management.

What We're Looking For

• Experience in a Security Operations, Cyber Security or Information Security role.
• Strong scripting or programming skills (e.g. Python or PowerShell) for building automations and integrations.
• Hands-on experience with application security testing methodologies such as SAST, DAST, SCA and SBOM.
• Knowledge of security monitoring technologies, SIEM platforms, vulnerability management and incident response.
• Familiarity with frameworks and standards such as ISO 27001, PCI DSS, SOC 2, Cyber Essentials or SWIFT CSP.
• Clear communication, comfortable working across technical and non-technical teams.

Cloud security, security automation, Continuous Threat Exposure Management and AI-enabled security tooling experience would be advantageous, not essential.

This could suit a SOC or security analyst who has outgrown alert triage and wants broader ownership of detection engineering, incident response and vulnerability management in a modern cloud-first fintech. The role is hybrid, with 1-2 days a week in the Manchester office.

#Referment