Security Operations Engineer (9B0754D)

Referment; Manchester; Hybrid; GBP 60,000 - 90,000; Full time

Job summary

Referment is working with a UK-based fintech to strengthen its Cyber Security team. You’ll join the Cyber Security team as a Security Operations Engineer, collaborating with the Cyber Security Manager and Engineering, protecting people, platform, and customers.

It’s a hands-on role with ownership across cloud, endpoint, network and application security, embedding security throughout the software development lifecycle in a secure-by-design culture.

Qualifications

• Experience in Security Operations, Cyber Security or Information Security.
• Strong scripting or programming skills (Python/PowerShell) for automations.
• Hands-on with SAST/DAST/SCA/SBOM for application security testing.
• Knowledge of SIEM, vulnerability management and incident response.
• Familiarity with ISO 27001, PCI DSS, SOC 2 or Cyber Essentials.
• Clear communication across technical and non-technical teams.

Responsibilities

• Monitor and continually improve security operations across cloud, endpoints, networks, and apps.
• Lead investigation, triage and response to security incidents, minimising risk.
• Develop and optimise detection rules, automations and tooling.
• Coordinate vulnerability management from scanning to remediation.
• Work with Engineering to embed security across the development lifecycle.
• Identify opportunities to leverage AI-powered security tooling.

Skills

Security Operations

Python/PowerShell

SAST/DAST/SCA/SBOM

SIEM

ISO 27001/PCI DSS

Cross-functional communication

Job description

Referment is working with a UK-based fintech that connects corporate finance and treasury teams directly with their banks, automating payments, collections, statement retrieval and cash management on one secure platform. You'll join the Cyber Security team as a Security Operations Engineer, working closely with the Cyber Security Manager and Engineering teams to protect the company's people, platform and customers. It's a hands-on role with real ownership: you'll run security operations across cloud, endpoint, network and application environments, and help embed security throughout the software development lifecycle in a secure-by-design culture.

The Role

• Monitor, manage and continually improve security operations across cloud, endpoint, network and application environments.
• Lead the investigation, triage and response to security incidents, minimising risk and improving resilience.
• Develop and optimise detection rules, automations and security tooling to strengthen threat detection and response.
• Coordinate vulnerability management end to end, from scanning and prioritisation through to remediation and reporting.
• Work with Engineering to identify vulnerabilities and embed security across the development lifecycle.
• Identify opportunities to leverage AI-powered security tooling and automation for proactive threat management.

What We're Looking For

• Experience in a Security Operations, Cyber Security or Information Security role.
• Strong scripting or programming skills (e.g. Python or PowerShell) for building automations and integrations.
• Hands-on experience with application security testing methodologies such as SAST, DAST, SCA and SBOM.
• Knowledge of security monitoring technologies, SIEM platforms, vulnerability management and incident response.
• Familiarity with frameworks and standards such as ISO 27001, PCI DSS, SOC 2, Cyber Essentials or SWIFT CSP.
• Clear communication, comfortable working across technical and non-technical teams.

Cloud security, security automation, Continuous Threat Exposure Management and AI-enabled security tooling experience would be advantageous, not essential.

This could suit a SOC or security analyst who has outgrown alert triage and wants broader ownership of detection engineering, incident response and vulnerability management in a modern cloud-first fintech. The role is hybrid, with 1-2 days a week in the Manchester office.

#Referment