Security Operations Lead

Jobtailor; Greater London; On-site; GBP 120,000 - 190,000; Full time

Benefits offered by this job

Hybrid or remote work options

Social events and networking

Private health coverage

Retirement savings plans

Employee referral programme

Office meals & snacks

Sustainable commuting options

Job summary

Doist is seeking a Security Operations Lead to own the internal SecOps capability and act as the technical owner of our MSSP relationship. You will be the primary incident responder with a strategic view on maturing our operational defence as we scale.

You will lead incident command during high-severity events, own detection engineering and vulnerability management, and drive automation and threat intelligence to reduce risk across AWS, Kubernetes, CI/CD, and IAM environments.

Qualifications

• Extensive experience in modern Security Operations as Incident Commander or Lead Responder in high-stakes environments.
• Clear philosophy prioritising automation and vendor optimisation over headcount growth.
• Familiarity with AWS, Kubernetes, CI/CD pipelines and ability to leverage automation to optimise analyst workflows.

Responsibilities

• Act as primary Incident Commander for high-severity security incidents; coordinate cross-functional response; on-call with team.
• Escalation point for MSSP-triggered investigations by first-line team.
• Maintain and evolve Crisis Management plan; run tabletop exercises for systemic and supply-chain risks.
• Define KRIs/KPIs; run service reviews; enforce detection quality with MSSP.
• Own detection engineering roadmap; ensure high-fidelity log ingestion across assets; minimise false positives.
• Oversee vulnerability lifecycle; drive automated remediation with IT and Engineering.
• Develop Threat Intelligence capability; translate threats into proactive defences.
• Own security across EDR, Email Security, DLP, IAM; prevent data exfiltration.
• Drive SecOps maturity roadmap; close visibility gaps; integrate AI-augmented capabilities.
• Design future-state roadmap; plan team expansion aligned with maturity.

Skills

Incident Commander

Lead Responder

Automation mindset

Security Operations

Tools

AWS

Kubernetes

CI/CD pipelines

Python

Scripting

Job description

About the Role

As the Security Operations Lead, you will take strategic and operational ownership of Lendable’s internal SecOps capability and serve as the technical relationship owner of our external Managed Security Service Provider (MSSP). You will act as our primary incident responder, with a strategic view on how Lendable’s operational defence should mature as we grow.

Responsibilities

• Incident Command & Advanced Analysis
  • Serve as the primary Incident Commander for high‑severity security escalations, coordinating cross‑functional response efforts. You will have on‑call responsibilities, shared with the wider team.
  • Act as the escalation point for technical investigations triggered by the MSSP first‑line team.
  • Maintain and evolve Lendable’s Security Crisis Management plan, running regular tabletop exercises to ensure business‑wide readiness for systemic and supply‑chain risks.
• Vendor Governance & Operational Architecture
  • Serve as the ultimate authority over our external MSSP. Define KRIs/KPIs, run rigorous service reviews, and hold the provider to strict detection quality standards.
  • Own Lendable's detection engineering roadmap. Ensure comprehensive, high‑fidelity log ingestion pipelines across all corporate and cloud assets, focusing on minimising false positives and alert fatigue.
  • Oversee the vulnerability management lifecycle, partnering with IT and Engineering to drive automated remediation workflows over manual tracking spreadsheets.
• Capability Architecture & Strategic Maturity
  • Develop a Threat Intelligence capability that translates external threats into actionable, proactive defences.
  • Take operational security ownership across foundational tech stacks such as EDR, Email Security, DLP, and IAM to prevent data exfiltration and identity‑based attacks.
  • Drive the technical roadmap for SecOps maturity, systematically closing visibility gaps, optimising operational metrics, and integrating AI‑augmented capabilities.
  • Design the future‑state roadmap for the SecOps function, architecting team expansion requirements in line with operational maturity.

Qualifications

• Extensive experience in modern Security Operations, specifically acting as an Incident Commander or Lead Responder in high‑stakes environments.
• Clear, modern philosophy on how a SecOps function should run, prioritising automation and vendor optimisation over linear headcount growth.
• Familiarity with modern tech stacks (AWS, Kubernetes, CI/CD pipelines) and ability to leverage automation (Python, scripting, or automation platforms) to optimise analyst workflows.
• High comfort executing as a senior IC on day one, with leadership maturity to transition into a team manager.

Benefits

• Flexible working: tailored approach per role with hybrid or fully remote options and opportunities for in‑person connection.
• Socials & connection: events and opportunities to network beyond the office walls.
• Health coverage: support for physical and mental wellbeing, including private health cover.
• Retirement & savings: long‑term financial wellbeing through retirement savings plans.
• Employee referral programme: earn a competitive bonus for successful referrals.
• Office meals & snacks: stocked kitchen and complimentary lunches on in‑office days at select locations.
• Sustainable commuting: cycle‑to‑work and electric vehicle salary sacrifice schemes in select locations.