Security Operations Engineer - Cloud & Incident Response

Referment; Manchester; Hybrid; GBP 60,000 - 90,000; Full time

Job summary

Referment is partnering with a UK-based fintech to enhance security across cloud, endpoints and applications. You’ll join the Cyber Security team as a Security Operations Engineer, working with the Cyber Security Manager and Engineering teams to protect the company’s people, platform and customers.

It’s a hands-on, ownership-led role in a hybrid setting with 1–2 days in Manchester. You’ll monitor security operations, lead incident response, develop detection tooling and drive end-to-end

Qualifications

• Experience in a Security Operations, Cyber Security or Information Security role.
• Hands-on scripting for automations and integrations.
• Experience with application security testing methods (SAST, DAST, SBOM, etc.).
• Knowledge of security monitoring technologies, SIEM, vulnerability management and incident response.
• Familiarity with ISO 27001, PCI DSS, SOC 2, Cyber Essentials or SWIFT CSP.
• Clear communication across technical and non-technical teams.

Responsibilities

• Monitor, manage and improve security operations across cloud, endpoint, network and applications.
• Lead investigation, triage and response to security incidents.
• Develop and optimise detection rules, automations and tooling.
• Coordinate vulnerability management from scanning to remediation.
• Work with Engineering to embed security across the development lifecycle.
• Identify opportunities to leverage AI-powered security tooling.

Skills

Security operations

Python/PowerShell

SAST/DAST/SCA/SBOM

SIEM/Vulnerability/IR

Standards & frameworks

Clear communication

Job description

Referment is partnering with a UK-based fintech to enhance security across cloud, endpoints and applications. You’ll join the Cyber Security team as a Security Operations Engineer, working with the Cyber Security Manager and Engineering teams to protect the company’s people, platform and customers.

It’s a hands-on, ownership-led role in a hybrid setting with 1–2 days in Manchester. You’ll monitor security operations, lead incident response, develop detection tooling and drive end-to-end