Senior SecOps Lead - Incident Commander (Remote/Hybrid)

Doist; Greater London; Hybrid; GBP 120,000 - 190,000; Full time

Benefits offered by this job

Hybrid or remote work options

Social events and networking

Private health coverage

Retirement savings plans

Employee referral programme

Office meals & snacks

Sustainable commuting options

Job summary

Doist is seeking a Security Operations Lead to own the internal SecOps capability and act as the technical owner of our MSSP relationship. You will be the primary incident responder with a strategic view on maturing our operational defence as we scale.

You will lead incident command during high-severity events, own detection engineering and vulnerability management, and drive automation and threat intelligence to reduce risk across AWS, Kubernetes, CI/CD, and IAM environments.

Qualifications

• Extensive experience in modern Security Operations as Incident Commander or Lead Responder in high-stakes environments.
• Clear philosophy prioritising automation and vendor optimisation over headcount growth.
• Familiarity with AWS, Kubernetes, CI/CD pipelines and ability to leverage automation to optimise analyst workflows.

Responsibilities

• Act as primary Incident Commander for high-severity security incidents; coordinate cross-functional response; on-call with team.
• Escalation point for MSSP-triggered investigations by first-line team.
• Maintain and evolve Crisis Management plan; run tabletop exercises for systemic and supply-chain risks.
• Define KRIs/KPIs; run service reviews; enforce detection quality with MSSP.
• Own detection engineering roadmap; ensure high-fidelity log ingestion across assets; minimise false positives.
• Oversee vulnerability lifecycle; drive automated remediation with IT and Engineering.
• Develop Threat Intelligence capability; translate threats into proactive defences.
• Own security across EDR, Email Security, DLP, IAM; prevent data exfiltration.
• Drive SecOps maturity roadmap; close visibility gaps; integrate AI-augmented capabilities.
• Design future-state roadmap; plan team expansion aligned with maturity.

Skills

Incident Commander

Lead Responder

Automation mindset

Security Operations

Tools

AWS

Kubernetes

CI/CD pipelines

Python

Scripting

Job description

Doist is seeking a Security Operations Lead to own the internal SecOps capability and act as the technical owner of our MSSP relationship. You will be the primary incident responder with a strategic view on maturing our operational defence as we scale.

You will lead incident command during high-severity events, own detection engineering and vulnerability management, and drive automation and threat intelligence to reduce risk across AWS, Kubernetes, CI/CD, and IAM environments.