Security Operations Lead & Detection Engineer

Pearson; Frankfort (KY); On-site; USD 150,000 - 190,000; Full time

Job summary

Pearson is seeking a Senior Director of Security Operations to lead the SOC, drive incident response and advance detection engineering across Pearson’s environments. You will refine SOC processes, automate responses, and align with Pearson’s security standards and regulatory requirements.

The role requires expertise in incident response, SOAR/EDR/NDR/SIEM, and cloud platforms (AWS, Azure, GCP), with a focus on rapid containment and collaboration with internal and external partners.

Qualifications

• Must have experience working with regulated environments or government clients.
• Proven experience in security operations, incident response and detection engineering (4+ years).
• Hands-on with SOAR, EDR, NDR, and SIEM technologies.
• Experience with one or more Cloud Service Providers (AWS, Azure, GCP).
• Strong multitasking, adapting, and thriving in fast-paced environments.
• Excellent communication, especially translating technical risk to non-technical audiences.

Responsibilities

• Lead day-to-day security operations and incident response across Pearson environments.
• Develop and optimize detection logic, playbooks and automated response workflows.
• Continuously improve SOC processes and alignment with threat landscapes and standards.
• Collaborate with threat intelligence to incorporate TTPs into SOC operations.
• Deliver executive-level reporting, risk assessments, and security metrics.
• Ensure compliance with standards and Pearson policies.

Skills

Incident response

Detection engineering

Security operations

Stakeholder communication

Tools

SOAR

EDR

NDR

SIEM

AWS

Azure

GCP

Job description

Pearson is seeking a Senior Director of Security Operations to lead the SOC, drive incident response and advance detection engineering across Pearson’s environments. You will refine SOC processes, automate responses, and align with Pearson’s security standards and regulatory requirements.

The role requires expertise in incident response, SOAR/EDR/NDR/SIEM, and cloud platforms (AWS, Azure, GCP), with a focus on rapid containment and collaboration with internal and external partners.