Senior SecOps Engineer: Detection, IR & Automation

Flagstone Group; Greater London; Hybrid; GBP 90,000 - 140,000; Full time

Benefits offered by this job

Hybrid London office

Bonus scheme

Benefits budget

Salary sacrifice

Around the World scheme

Mental wellbeing support

Development budget

Private health care

Medical cash plan

Life & income protection

Pension matched 5%

25 days holiday

Parental leave

Job summary

Flagstone is seeking a Senior SecOps Engineer to own security operations across the SOC, incident response, and detection engineering. You’ll work hands-on in alert triage and drive improvements with the managed SOC partner.

You’ll build detections in Defender and Sentinel, shape the security program, and report performance to stakeholders. You’ll also explore AI-assisted tooling to enhance triage while maintaining rigorous controls.

Qualifications

• 5+ years in a SOC, security operations or detection engineering role, with progression into a senior IC position.
• Hands‑on experience with Microsoft Sentinel and Defender, building detections rather than just consuming alerts
• Experience running investigations and incident response, including communicating with stakeholders under pressure
• Experience building SOAR and automation content (e.g. Sentinel Logic Apps)
• A strong grasp of MITRE ATT&CK, and how to turn them into a detection coverage model
• Experience directing a managed or outsourced SOC or MDR provider, setting scope, SLAs and escalation criteria
• Practical experience applying AI or LLM tooling to SecOps work
• Strong communication and stakeholder skills, with the confidence to influence senior stakeholders
• Critical thinking and a real curiosity for new technologies and frameworks

Responsibilities

• Take ownership of our SOC operations and report on their performance and health to stakeholders across the business.
• Run investigations and incident response for complex or high severity alerts, managing parallel workstreams and post-incident reviews.
• Own the detection engineering backlog, building, tuning and retiring detections across Microsoft Sentinel and Defender, mapped to a coverage model such as MITRE ATT&CK.
• Manage our managed SOC relationship day to day: defining scope and escalation criteria, reviewing performance against SLAs, and acting as the technical escalation point.
• Explore and introduce AI assisted tooling into SOC workflows, such as triage and enrichment copilots, detection authoring and alert summarisation where it makes a difference.

Skills

Senior SOC operations

Investigation & IR

Threat detection engineering

AI tooling in SecOps

Security leadership

Stakeholder communication

Tools

Microsoft Sentinel

Microsoft Defender for Endpoint

Sentinel Logic Apps

Job description

Flagstone is seeking a Senior SecOps Engineer to own security operations across the SOC, incident response, and detection engineering. You’ll work hands-on in alert triage and drive improvements with the managed SOC partner.

You’ll build detections in Defender and Sentinel, shape the security program, and report performance to stakeholders. You’ll also explore AI-assisted tooling to enhance triage while maintaining rigorous controls.