flagstone - Senior SecOps Engineer
Requirements
• 5+ years in a SOC, security operations or detection engineering role, with progression into a senior IC position • Hands-on experience with Microsoft Sentinel and Defender, building detections rather than just consuming alerts • Experience running investigations and incident response, including communicating with stakeholders under pressure • Experience building SOAR and automation content (for example Sentinel Logic Apps), including monitoring for silent failure • A strong grasp of attack patterns and MITRE ATT&CK, and how to turn them into a detection coverage model • Experience directing a managed or outsourced SOC or MDR provider, setting scope, SLAs and escalation criteria • Practical experience applying AI or LLM tooling to SecOps work • Strong communication and stakeholder skills, with the confidence to influence senior stakeholders • Critical thinking and a real curiosity for new technologies and frameworks • It would be great if you also have • Experience in regulated financial services • Exposure to identity centric detection (Entra ID) and cloud native threat detection • GCIH, GCFA or an equivalent hands-on IR or detection certification • Links to the SOC and detection engineering community, through conferences, speaking or open source detection content such as Sigma rules • How we reward you: • At Flagstone, the benefits extend beyond false gifts like “fruit and snacks”. Instead, we invest in your health, wealth, and professional development. Here’s a selection of our benefits: • Hybrid working - Spend at least 1 day a week with your team in our collaborative London office • Competitive bonus scheme - designed to reward and recognise high performance • Flexible benefits budget - a pot to fund meaningful benefits for you, whether it's hormone or fertility testing, cancer screening, neuro-diversity coaching or something that matters for you. • A range of salary sacrifice options to help you make tax efficient savings on electric cars, nursery schemes, home and tech goods. • Around the World scheme - 3 months work from anywhere scheme • Mental wellbeing support – Access therapy and mental health sessions through Spill • Learning and development – £1,000 personal development budget to help you grow in your role. • Private health care - Enjoy all the benefits AXA has to offer, including reduced gym memberships and medical history disregarded • Medical cash plan - To help you with the costs of dental and optical expenses • Life insurance and Income Protection- four times your annual salary for peace of mind • Matched pension contributions up to 5% • 25 days holiday - plus bank holidays, well-being days and volunteering days • Enhanced Parental Leave – enhanced maternity, paternity and adoption pay. • All are welcome.
Responsibilities
• You’ll take ownership of our SOC operations and report on their performance and health to stakeholders across the business. You’ll run investigations and incident response for complex or high severity alerts, managing parallel workstreams, keeping stakeholders informed and running post incident reviews through to real changes in detections or process. • You’ll own the detection engineering backlog, building, tuning and retiring detections across Microsoft Sentinel and Defender, mapped to a coverage model such as MITRE ATT&CK. You’ll turn threat intelligence into detection logic and hunting activity, and drive our automation and SOAR maturity by building Logic App playbooks that reduce manual effort without losing judgement on the nuanced cases. • You’ll manage our managed SOC relationship day to day: defining scope and escalation criteria, reviewing performance against SLAs and acting as the technical escalation point for anything they can’t close. You’ll keep playbooks, escalation paths and documentation in shape so the practice scales beyond any one person, and you’ll track metrics like triage time, false positive rate and coverage gaps to drive continuous improvement. • You’ll also explore and introduce AI assisted tooling into SOC workflows, such as triage and enrichment copilots, detection authoring and alert summarisation, where it clearly makes a difference, with sensible boundaries on where human judgement stays in the loop.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT