Senior Cyber Detection and Response Engineer

Pirum Systems Ltd.; Greater London; On-site; GBP 90,000 - 150,000; Full time

Benefits offered by this job

Hybrid work options

Private medical insurance

Eyecare

Life assurance

5% pension contribution

2 days volunteering leave

Cycle to Work scheme

EAP (24/7 GP, mental health support)

Job summary

Pirum Systems Ltd. is seeking a Senior Cyber Detection and Response Engineer in London, UK. You will lead Pirum's detection and response capability, enabling machine-speed detection, investigation and containment across AWS, on-premises, workforce IT and endpoints.

You will set direction for detection engineering and report to the CISO. The role is hands-on and requires operating independently in a lean team, with a focus on detection as an engineering discipline and clear communication to

Qualifications

• Hands-on detection engineering with SIEM detection rules and code.
• Incident response leadership on high-priority investigations.
• Structured threat hunting with documented findings.
• Cloud security knowledge across AWS/Azure.
• MITRE ATT&CK framework for coverage and gap analysis.
• Experience building and operating SOAR playbooks.
• Proficiency in Python for detection development and parsing.
• Experience leading a SOC or managing third-party SOC.
• Independent work style with stakeholder collaboration.
• Clear written reporting for technical and non-technical audiences.

Responsibilities

• Own and deliver detection content across estate, mapped to ATT&CK.
• Maintain telemetry visibility across AWS, on-prem, and endpoints.
• Lead threat hunting cycles and translate findings to detections.
• Direct incident response across lifecycle; author and update playbooks.
• Develop automation to accelerate response and reduce manual triage.
• Shape monitoring operating model and balance in-house vs managed.
• Define and report metrics: MTTD and MTTR to leadership.
• Collaborate with engineering to embed detection in services.

Skills

SIEM rules

Incident response

Threat hunting

Cloud telemetry

MITRE ATT&CK

SOAR playbooks

Python

SOC leadership

Communication

Adversary thinking

Education

Computer Science/Engineering degree (preferred)

Tools

SOAR platforms

Job description

Senior Cyber Detection and Response Engineer (London, UK)

Summary of Position

As a critical technology provider to around 100 of the world's leading financial institutions, Pirum’s security posture is a commercial asset as much as a risk management function. Our customers conduct rigorous third-party security assessments, ongoing supplier assurance reviews and the way we protect our systems and data directly affects our ability to win and retain business.

We are looking for a Senior Detection and Response Engineer to lead Pirum's detection and response capability, enabling us to detect, investigate and contain threats at machine speed across our AWS, on-premises, workforce IT and endpoint estate. This is a high-autonomy role reporting directly to the CISO: you will set the direction for detection engineering at Pirum, work closely with our engineering teams, and be trusted to run with it.

The successful candidate will be a hands-on detection engineer who can think like an adversary, writes production-quality code and treats detection as an engineering discipline rather than an alerting afterthought. You will be comfortable operating independently in a lean team, making consequential decisions at pace and translating technical findings into clear reporting for technical and non-technical audiences alike.

Duties & Responsibilities

You will use your expertise and experience to own, develop and deliver across a range of areas, including:

• Detection engineering – design, build and continuously improve detection content, managed as code and version-controlled, mapping coverage to adversary tactics and techniques using the MITRE ATT&CK framework and prioritising the techniques most relevant to a financial services SaaS provider.
• Telemetry and visibility – maintain a clear view of the estate and the telemetry available across AWS, on-premises, workforce IT and endpoints, working with engineering teams to ensure the right data reaches the detection platform.
• Threat hunting – run structured, hypothesis-driven threat hunting cycles, documenting findings and converting them into new detection content.
• Incident response – lead detection, triage and response across the incident lifecycle, authoring and maintaining playbooks for the most significant incident types and owning clear, calm communication up to and including the CISO.
• Response automation – build SOAR-style automation to accelerate and standardise response, targeting automated first-actions for high-priority incidents and reducing manual triage so the team scales without proportional headcount.
• Monitoring operating model – help shape the right operating model for security monitoring, balancing in-house and managed capability and keeping pace with an evolving threat landscape, including AI and LLM-enabled attacks.
• Measurement and reporting – define and track meaningful detection and response metrics, including MTTD and MTTR, and produce a regular programme metrics report for the CISO and CTO.
• Collaboration and capability building – partner with engineering teams to embed detection and monitoring requirements into new and existing services, agree risk-based treatment where issues cannot be immediately remediated, and grow internal security capability through documentation, knowledge sharing and structured mentoring as the team grows.

Skills, Knowledge & Attributes

Essential

• Hands-on detection engineering experience, writing and maintaining SIEM detection rules, correlation logic and detection-as-code pipelines.
• Demonstrated incident response experience, leading or contributing to high-priority (P1/P2) investigations, containment and post-incident reviews.
• Proven experience running structured, hypothesis-driven threat hunting cycles and translating findings into new detections.
• Working knowledge of cloud security and native cloud telemetry sources (AWS and/or Azure).
• Practical use of the MITRE ATT&CK framework to structure detection coverage and gap analysis.
• Hands-on experience building and operating SOAR playbooks and response automation, orchestrating across security tooling and ticketing.
• Proficiency in Python or an equivalent language for detection development, log parsing and automation, producing readable, maintainable code.
• Experience leading a SOC and/or managing a third-party SOC.
• Ability to work independently and collaborate with technical stakeholders across the business.
• Strong written communication, able to translate technical findings into clear reporting for non-technical stakeholders and to influence across the technology team.
• A strong technical background and genuine interest in technology.

Desirable

• Relevant certifications such as GCIA, GCIH, GCDA, BTL2 or equivalent practical experience.
• A history of competing in CTF competitions and/or running a home lab.
• A Computer Science or Engineering degree (preferred but not essential).
• Experience in financial services, fintech or a SaaS business serving regulated customers.
• Awareness of AI and LLM security risks, relevant as Pirum's own AI capabilities continue to expand.

Benefits

• Competitive salary and discretionary bonus scheme
• Hybrid working options
• 25 days annual leave
• 2 days paid volunteering leave
• 5% employer pension contribution
• Private medical insurance and eyecare
• Life assurance cover
• EAP packages (including 24/7 GP, mental health support, financial and legal advice)
• Cycle to Work scheme

About us

Established in 2000, Pirum is a dynamic Fintech that provides a comprehensive set of SaaS based automation solutions facilitating pre-/post-trade processing, regulatory reporting and collateral management for the global securities finance industry. Pirum’s client base includes most of the top-tier financial institutions worldwide and the business is as recognised for its innovative solutions as it is for providing best-in-class customer service.

Headquartered in London, and with offices also in New York, Pirum is currently co-owned by two PE firms – Bowmark Capital (since 2019) and Hg Capital (since 2021/22). Under Bowmark’s and Hg’s ownership, Pirum has pursued an ambitious agenda of organic growth, with the investors’ financial services technology credentials and international footprints enabling Pirum to continue its global expansion and investment in additional innovations.

Pirum offers the opportunity to work inside a growing, collaborative and entrepreneurial company. Our skilled professionals act with integrity and deliver to the highest standards. We operate as a meritocracy where good work is recognised and rewarded, and a healthy work-life balance is supported. We are committed to sustainability initiatives and the promotion and pursuit of a diversity and inclusion.

Equal Opportunities Statement

Pirum is an Equal Opportunities employer. We see diversity as integral to our success as a company and are committed to providing an inclusive, mutually respectful workplace that is free of discrimination and harassment.

We believe in recognising our people based on merit and ability alone and do not discriminate, or tolerate discrimination, whether on the basis of race (including colour, nationality, ethnic or national origins), sex, sexual orientation, age, disability, gender reassignment, marriage and civil partnership status, pregnancy/maternity, religion or belief.

We uphold this policy in all aspects of employment, including recruitment, promotion, transfer, training, benefits and compensation.

Candidate Privacy Notice

We are committed to protecting the privacy and security of your personal information. Please read our Candidate Privacy Notice (available on our website) before applying for any role with us. There, we explain how and why we collect your personal data, including how it is processed and shared as part of our recruitment process.

Agencies

To protect the interests of all parties, Pirum will not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to Pirum, including unsolicited resumes sent to a Pirum mailing address, fax machine or email address, or directly to Pirum employees, will be considered Pirum property. Pirum will not pay a fee for any placement resulting from the receipt of an unsolicited resume.

*Employee Referral Program terms and conditions apply