Security Operations Lead

Beam; Greater London; On-site; GBP 90,000 - 100,000; Full time

Job summary

Beam builds AI tools for frontline public services and operates across the UK, US, Australia and the EU. We’re seeking a Security Operations Lead to own detection, response, vulnerability management, pen testing, and security controls across multiple regions.

You will drive incident response readiness, oversee third‑party security assessments, and coordinate with auditors for ISO 27001, SOC 2, and related standards. Competitive salary and equity on offer.

Qualifications

• Experience running detection and response in a cloud‑native environment.
• Proven vulnerability management program with SLA adherence.
• Familiar with ISO 27001, SOC 2 or NIST 800‑53 controls.
• Ability to influence engineers and communicate security posture clearly.

Responsibilities

• Run detection and response; own the SIEM and detection stack; manage 24/7 MDR service.
• Own the vulnerability programme end to end; ensure remediation to SLA with Engineering and IT Ops.
• Scope and coordinate penetration testing with our external partner.
• Assure Engineering‑owned platform controls; verify operation and provide evidence for audits and regulators.
• Lead incident response planning, runbooks, drills, and forensics readiness.
• Lead AI threat modelling and adversarial testing with red‑team partner; assess new product surfaces.

Skills

Detection and response

Vulnerability management

Penetration testing

Security controls auditing

Incident response

Threat modelling

Third‑party security assessment

Tools

GCP

Kubernetes

SIEM

MDR service

Job description

At Beam, we’re building AI that serves society.

We're a global team of ambitious, hardworking problem solvers, applying fast-moving startup energy to work that makes the world a better place. If you want to apply your talent to the biggest problems society faces, Beam is the place for you.

You’ll be part of a high-performance culture where you'll make a huge impact, rapidly progress your career, and truly enjoy your work.

Over 100,000 frontline workers already use Beam to take notes, provide live interpretation and handle phone calls, so they can focus on the people who need them most. This is just the beginning.

The opportunity at Beam

Beam builds AI tools for frontline public services in the UK, US, Australia and the EU: local authorities, health services, police forces, and state, federal and central government agencies. Our products handle some of the most sensitive data governments hold, and our customers' security teams hold us to the standards they hold themselves.

The Security Operations Lead is Beam's first dedicated operational security role. You run security operations across six deployments in four regions: detection and response, vulnerability management, penetration testing, cloud security posture, external attack surface, third-party security assessment and adversarial testing of our AI products. You are also the assurance owner for the platform security controls Engineering operates: you check they work, hold the evidence, and answer for them to auditors and customers in every region. You report to the Chief Information Risk Officer and support them on security incidents.

Day to day: tuning the SIEM and working with the MDR; triaging vulnerability findings and holding remediation to SLA with Engineering; scoping and running pen tests with our external partner; reviewing Engineering's platform controls and gathering evidence; running incident response exercises; answering the security half of customer and auditor questions.

What you’ll be doing

• Running detection and response. Owning the SIEM and detection stack (a SIEM is in place but not deeply embedded; you decide whether it stays), owning detection rules, managing alert triage and noise, and selecting and managing the 24/7 MDR service so that out-of-hours compromise in any of our four regions is seen and acted on.

• Owning the vulnerability programme end to end. Detection, triage, remediation to SLA with Engineering and IT Ops, and reporting that matches what we tell customers. Includes cloud security posture (GCP, AWS), configuration drift across deployments, and the external attack surface (domains, DNS, TLS, security ratings).

• Scoping and coordinating penetration testing across all products and regions with our external partner, and owning the vulnerability disclosure programme.

• Assuring Engineering‑owned platform controls: encryption and key management, network segmentation, workload hardening, privileged and non‑human identity, secrets lifecycle, supply‑chain integrity, audit‑trail integrity, and data residency across regions. You check they operate, hold the evidence, and answer for them in ISO 27001, SOC 2, FedRAMP and IRAP assessments.

• Making Beam incident‑ready. Incident response plans and runbooks, exercises with Engineering, forensics readiness, and hands‑on support to the CIRO during security incidents.

• Leading AI threat modelling and adversarial testing (prompt injection, jailbreak, data extraction, caller‑side attacks on telephony products) with our red‑team partner, and providing security assurance for new product surfaces (desktop clients, browser extensions, integrations, public API).

• Running third‑party security assessment of sub‑processors and suppliers, delivering role‑based security training to engineers and administrators, and reporting security metrics to the CIRO and leadership.

Who we’re looking for

• A security operations lead who has built or run detection and response in a cloud‑native environment. You have written and tuned detection rules, lived with the noise, and led incidents from first alert to post‑incident review.

• Experienced running a vulnerability management programme to SLA where remediation sat with engineering teams that did not report to you.

• Comfortable in GCP and Kubernetes at the level needed to assess a control, read a configuration, and know when to dig deeper with Engineering.

• Familiar with what auditors need. You have evidenced controls under ISO 27001, SOC 2 or NIST 800‑53 and can tell a control that operates from one that is just documented.

• Able to influence without authority. Engineers act on your findings because you have made the case in their terms, not because you escalated.

• Precise about claims. You say what is true about the security posture, including when it is uncomfortable, and you do not let a customer answer overstate the control behind it.

• Ideally, literate enough in application security to review an SDLC gate or a code‑level finding; if not, clear about that boundary and ready to buy the depth in.

Compensation:
£90,000 - £100,000 base salary depending on experience and performance during interviews + equity and amazing benefits (see our careers page)

We're committed to advancing equity, diversity, and inclusion through our work as an organisation, and that starts with the team we build. 53% of the people we support are from ethnic minority backgrounds and 17% have disabilities. We believe we serve these people best when we’re a diverse and inclusive team. To that end, we particularly welcome applications from ethnic minority candidates and/or those who’ve experienced social disadvantage.

Application process

We take hiring seriously. We have a 4-stage and an optional 5th interview process, giving you plenty of time to learn about Beam while we get to know you.

About Beam

We’ve picked up an armful of awards for our work, including one from our former Queen. We've also been named by WIRED as one of London's 10 hottest startups and by LinkedIn as a Top 15 UK Startup. Meanwhile, we've been covered in the media literally thousands of times, including the likes of The FT, BBC, TechCrunch, Forbes and The Guardian.

We’re also proud to be backed by some of the world's leading tech investors and entrepreneurs, including the founders of Booking.com, Calm, Shazam and Dropbox.

Reasonable adjustments:

Beam is committed to fostering an inclusive, diverse, and supportive work environment for all employees. This policy extends to our hiring practices.

We recognise that some candidates may need additional support during their hiring process to give them the best chance of being a success. To ensure that all candidates have an equitable opportunity during their process, we are committed to providing reasonable adjustments where required.

If you require a reasonable adjustment to be made during your process, please let your Talent Partner know. We encourage you to share this information, but there is no obligation to do so.

Please be reassured that any reasonable adjustment requests will not be taken into account when making a decision about your candidacy.