lendable - Security Operations Lead

London - Hybrid1w ago

In Office Staff EMEA Cloud Computing Head of Security AWS Kubernetes Python Team Leadership Linear Governance Close

Requirements

• Operational Seniority: Extensive experience in modern Security Operations, specifically acting as an Incident Commander or Lead Responder in high-stakes environments. • Strategic Vision: A clear, modern philosophy on how a SecOps function should run, prioritising automation and vendor optimisation over linear headcount growth. • Cloud-Native Literacy: Familiarity with modern tech stacks (AWS, Kubernetes, CI/CD pipelines) and the ability to leverage automation (Python, scripting, or automation platforms) to optimise analyst workflows. • The "Builder" Mentality: You are highly comfortable executing as a senior IC on day one, with the presence and leadership maturity to transition into a team manager.

Responsibilities

• 1. Incident Command & Advanced Analysis • Advanced Tier 2/3 Analysis: Act as the escalation point for technical investigations triggered by the MSSP first line team. • Crisis & Resilience Simulation: Maintain and evolve Lendable’s Security Crisis Management plan, running regular tabletop exercises to ensure business-wide readiness for systemic and supply-chain risks. • 2. Vendor Governance & Operational Architecture • MDR/MSSP Technical Governance: Serve as the ultimate authority over our external MSSP. Define KRIs/KPIs, run rigorous service reviews, and hold the provider to strict detection quality standards. • Detection & Logging Strategy: Own Lendable's detection engineering roadmap. Ensure comprehensive, high-fidelity log ingestion pipelines across all corporate and cloud assets, focusing on minimising false positives and alert fatigue. • Automation-Driven Remediation: Oversee the vulnerability management lifecycle, partnering with IT and Engineering to drive automated remediation workflows rather than relying on manual tracking spreadsheets. • 3. Capability Architecture & Strategic Maturity • Threat Intelligence: Develop a Threat Intel capability that translates external threats into actionable, proactive defences. • Core Domain Ownership: Take operational security ownership across our foundational tech stack, continuously optimising our posture across domains such as EDR, Email Security, DLP, and IAM to prevent data exfiltration and identity-based attacks. • Capability Scaling: Drive the technical roadmap for SecOps maturity. Systematically close visibility gaps, optimise operational metrics, and introduce AI-augmented capabilities (e.g., automated response playbooks). • Organic Function Growth: Design the future-state roadmap for the SecOps function. As you scale our technical capabilities, architect the requirement for team expansion, ensuring the team grows in lockstep with operational maturity.