Senior Security Operations Engineer

Orbis Group; Greater London; On-site; GBP 70,000 - 100,000; Full time

Benefits offered by this job

Equity

Job summary

Orbis Group is seeking a Security Operations Engineer to join a growing technology business in Greater London. You’ll be hands-on across security operations and cloud security, driving automation to remove manual work and building an engineering-led security capability.

You’ll improve detections, vet CSPM findings, and implement new tooling while collaborating closely with Platform and Engineering teams. The role evolves toward Security Engineering and Architecture, offering ownership and impact.

Qualifications

• Hands-on cloud security experience across AWS and/or GCP.
• Experience with CSPM tooling and managing findings through prioritisation, remediation and resolution.
• Good understanding of cloud threats, vulnerabilities and security detections.
• A strong risk-based approach to vulnerability management.
• Experience scripting or automating security processes.
• The confidence to investigate issues and make decisions independently.
• A genuine interest in AI and automation, with examples of tools or workflows built or experimented with.
• A proactive, engineering-led mindset.

Responsibilities

• Hands-on across security operations and cloud security, improving the environment and removing repetitive manual work through automation.
• Build and improve security detections and automate manual security processes and alert workflows.
• Triaging and remediating CSPM findings using a risk-based approach.
• Evaluate and implement new security tooling and support improvements across SIEM/EDR/MDM/Zero Trust.
• Collaborate with Platform and Engineering teams and move toward Security Engineering and Architecture.

Skills

Cloud security

AWS and/or GCP

Automation / scripting

AI / automation

Vulnerability management

Ownership mindset

Incident response

Tools

CSPM tooling

Automation tooling

AI tooling for security

Job description

We’re working with a growing technology business to hire a Security Operations Engineer as they significantly evolve and invest in their security capability.

This is not a traditional SOC role.

You’ll join a small security function with real backing to improve the existing environment, introduce new tooling, automate manual processes and build a more engineering-led security capability.

The role

Initially, you'll be hands-on across security operations and cloud security, working to improve the current environment and remove repetitive manual work through automation.

You'll be involved in:

• AWS/GCP cloud security, monitoring and detections.
• Triaging and remediating CSPM findings using a risk-based approach.
• Building and improving security detections.
• Automating manual security processes and alert workflows.
• Vulnerability management and remediation.
• Improving alert quality and reducing false positives.
• Evaluating and implementing new security tooling.
• Supporting improvements across SIEM, EDR, MDM and Zero Trust.
• Working closely with Platform and Engineering teams.
• Using scripting, automation and AI tooling to solve security problems.

Over time, the role will move increasingly towards Security Engineering and Architecture, giving you the opportunity to help shape how the wider security environment is built.

What we're looking for

We're looking for someone who has genuinely owned and built things, rather than simply operated within established processes.

You'll ideally have:

• Hands-on cloud security experience across AWS and/or GCP.
• Experience with CSPM tooling and managing findings through prioritisation, remediation and resolution.
• Good understanding of cloud threats, vulnerabilities and security detections.
• A strong risk-based approach to vulnerability management.
• Experience scripting or automating security processes.
• The confidence to investigate issues and make decisions independently.
• A genuine interest in AI and automation, ideally with examples of tools, agents, workflows or automations you've built or experimented with.
• A proactive, engineering-led mindset.

We're also less concerned about experience with a particular SIEM or EDR product. If you have the underlying security engineering knowledge and can pick up new technology quickly, that's much more important.

The real attraction here is ownership.

You're joining an environment where there is appetite to change things rather than simply maintain what's already there.

You'll have the opportunity to:

• Help select and implement new security tooling.
• Automate away manual security work.
• Work closely with engineering rather than sitting in an isolated SOC.
• Experiment with AI and new approaches to security automation.
• Influence how the security environment develops.
• Progress further into Security Engineering and Architecture.
• Join a growing team early and have a genuine impact on its direction.

There's strong investment behind the security function, a supportive leadership team and plenty still to build.

Equity is included as part of the package.

If you're currently working across Security Operations, Cloud Security, Detection Engineering, Security Engineering or DevSecOps and want a role where you can build, automate and take ownership, we'd love to hear from you.