Security Operations Lead

Colossus Recruitment Ltd; Birmingham; Remote; GBP 90,000 - 120,000; Full time

Job summary

Colossus Recruitment Ltd in the UK is seeking an experienced Security Operations Lead to drive both security engineering and SOC operations for a large Azure-based SaaS platform. You will mentor three SOC analysts and be the senior escalation point for complex investigations.

This hands-on leadership role focuses on implementing Azure security controls, refining detection logic, incident response, and building DevSecOps tooling with GitHub Actions and Azure Pipelines in collaboration with

Qualifications

• Experience leading or managing a SOC, Security Operations, Detection Engineering or Incident Response function.
• Strong hands-on Microsoft Sentinel experience and Azure security technologies.
• Advanced threat detection engineering and incident response in cloud environments.

Responsibilities

• Lead day-to-day SOC operations and incident response activities.
• Own Microsoft Sentinel administration and optimisation.
• Develop and tune detection logic using KQL and MITRE ATT&CK methodologies.
• Mentor and develop a team of SOC Analysts.
• Collaborate with architecture and engineering to embed security across pipelines and deployments.

Skills

SOC leadership

KQL skills

Azure security

DevSecOps tooling

Incident response

PowerShell/Python

Tools

Terraform

Bicep

GitHub Actions

Azure Pipelines

Job description

Security Operations Lead - SOC, Azure DevSecOps - UK Remote - BPSS (Baseline Personnel Security Standard)

Lead Security Operations. Build Security Engineering. Protect a Global SaaS Platform.

We are partnering with a technology organisation that operates a large-scale, cloud-native SaaS platform serving millions of users globally.

Due to continued growth, they are seeking an experienced Security Engineering & SOC Lead to drive both security engineering and security operations across a modern Microsoft Azure estate.

This is a rare opportunity for a hands‑on cyber security professional who enjoys building security controls, improving SOC effectiveness, mentoring analysts, and leading incident response activities in a complex cloud environment.

Approximately 60% of the role is focused on security engineering, with the remainder centred on SOC leadership, detection engineering, and incident response.

You'll lead a team of three analysts whilst remaining technically hands‑on as the senior escalation point for complex investigations and security challenges.

The Role

As Security Engineering & SOC Lead, you will be responsible for designing, implementing, and continuously improving the security controls, monitoring capabilities, and operational processes that protect a large Azure-based platform.

Working closely with architecture, engineering, and development teams, you'll ensure security is embedded across infrastructure, applications, and delivery pipelines.

Key Responsibilities

Security Engineering

• Implement Azure security controls and platform guardrails.
• Deploy and manage Azure Policy, Defender for Cloud, Conditional Access, Privileged Identity Management (PIM), Key Vault, Managed Identities, Azure Firewall and WAF solutions.
• Deliver DevSecOps tooling across GitHub Actions and Azure Pipelines.
• Implement SAST, SCA, secrets scanning, container security and Infrastructure-as-Code scanning.
• Drive supply chain security initiatives including SBOM generation, artefact signing and policy enforcement.
• Harden AKS and cloud-native services through Infrastructure-as-Code and automated security controls.
• Work with engineering teams to remediate vulnerabilities, penetration test findings, and security risks.
• Support threat modelling, security reviews, and secure software development practices.

Security Operations & Detection Engineering

• Lead day-to-day SOC operations.
• Own Microsoft Sentinel administration and optimisation.
• Develop and tune detection logic using KQL and MITRE ATT&CK methodologies.
• Lead incident response, investigation, containment and post-incident reviews.
• Build automated response workflows using Logic Apps and security playbooks.
• Conduct proactive threat hunting across platform telemetry.
• Manage security monitoring, logging standards and onboarding of new services into the SIEM.
• Produce dashboards, metrics and reporting on SOC performance and security posture.

Team Leadership

• Lead, mentor and develop a team of three SOC Analysts.
• Conduct one-to-ones, objectives and development planning.
• Act as the team's technical escalation point.
• Develop analyst capabilities in threat hunting, detection engineering and advanced investigations.
• Maintain SOC documentation, runbooks and operational procedures.

About You

You will be a hands‑on cyber security professional with a strong background in both security engineering and security operations.

Essential Experience

• Experience leading or managing a SOC, Security Operations, Detection Engineering or Incident Response function.
• Strong hands‑on Microsoft Sentinel experience.
• Advanced KQL skills and detection engineering expertise.
• Experience investigating and responding to security incidents within cloud environments.
• Strong knowledge of Azure security technologies, including: Entra ID Conditional Access PIM Defender for Cloud Azure Policy Key Vault Azure networking and segmentation
• Experience implementing DevSecOps tooling and security automation.
• Infrastructure-as-Code experience using Terraform and/or Bicep.
• Automation experience using PowerShell and/or Python.
• Knowledge of Kubernetes, AKS, container security and OWASP principles.
• Ability to communicate effectively with both technical and business stakeholders.

Desirable Experience

• Multi‑tenant SaaS platform environments.
• Microsoft Defender XDR suite.
• Building or transforming SOC functions.
• Threat hunting and purple team exercises.
• Supply chain security, SBOM, Sigstore, Cosign or SLSA frameworks.
• Policy as Code solutions such as OPA or Kyverno.
• Previous software engineering, platform engineering or infrastructure background.

Certifications (Desirable)

• Microsoft SC-200
• Microsoft AZ-500
• Microsoft SC-300
• CompTIA CySA+
• GIAC GCDA, GCIA, GCIH or GCFA
• HashiCorp Terraform Associate
• CKA / CKS

Why Apply?

• Opportunity to shape and mature a growing security capability.
• Hands‑on technical leadership role.
• Modern Azure cloud and cloud-native environment.
• Significant influence across engineering, security and operations.
• High‑profile platform supporting large‑scale global users.
• Clear opportunity to mentor and develop an expanding security team.

Security Clearance

This role is subject to BPSS (Baseline Personnel Security Standard) screening and successful completion of the relevant checks will be required prior to employment.