beam-up - Security Operations Lead
Requirements
• A security operations lead who has built or run detection and response in a cloud-native environment. You have written and tuned detection rules, lived with the noise, and led incidents from first alert to post-incident review. • Experienced running a vulnerability management programme to SLA where remediation sat with engineering teams that did not report to you. • Comfortable in GCP and Kubernetes at the level needed to assess a control, read a configuration, and know when to dig deeper with Engineering. • Familiar with what auditors need. You have evidenced controls under ISO 27001, SOC 2 or NIST 800-53 and can tell a control that operates from one that is just documented. • Able to influence without authority. Engineers act on your findings because you have made the case in their terms, not because you escalated. • Precise about claims. You say what is true about the security posture, including when it is uncomfortable, and you do not let a customer answer overstate the control behind it. • Ideally, literate enough in application security to review an SDLC gate or a code-level finding; if not, clear about that boundary and ready to buy the depth in.
Responsibilities
• Running detection and response. Owning the SIEM and detection stack (a SIEM is in place but not deeply embedded; you decide whether it stays), owning detection rules, managing alert triage and noise, and selecting and managing the 24/7 MDR service so that out-of-hours compromise in any of our four regions is seen and acted on. • Owning the vulnerability programme end to end. Detection, triage, remediation to SLA with Engineering and IT Ops, and reporting that matches what we tell customers. Includes cloud security posture (GCP, AWS), configuration drift across deployments, and the external attack surface (domains, DNS, TLS, security ratings). • Scoping and coordinating penetration testing across all products and regions with our external partner, and owning the vulnerability disclosure programme. • Assuring Engineering-owned platform controls: encryption and key management, network segmentation, workload hardening, privileged and non-human identity, secrets lifecycle, supply-chain integrity, audit-trail integrity, and data residency across regions. You check they operate, hold the evidence, and answer for them in ISO 27001, SOC 2, FedRAMP and IRAP assessments. • Making Beam incident-ready. Incident response plans and runbooks, exercises with Engineering, forensics readiness, and hands-on support to the CIRO during security incidents. • Leading AI threat modelling and adversarial testing (prompt injection, jailbreak, data extraction, caller-side attacks on telephony products) with our red-team partner, and providing security assurance for new product surfaces (desktop clients, browser extensions, integrations, public API). • Running third-party security assessment of sub-processors and suppliers, delivering role-based security training to engineers and administrators, and reporting security metrics to the CIRO and leadership.
Benefits
• £90,000 - £100,000 base salary depending on experience and performance during interviews + equity and amazing benefits (see our careers page) • We're committed to advancing equity, diversity, and inclusion through our work as an organisation, and that starts with the team we build. 53% of the people we support are from ethnic minority backgrounds and 17% have disabilities. We believe we serve these people best when we’re a diverse and inclusive team. To that end, we particularly welcome applications from ethnic minority candidates and/or those who’ve experienced social disadvantage. • APPLICATION PROCESS • We take hiring seriously. We have a 4-stage and an optional 5th interview process, giving you plenty of time to learn about Beam while we get to know you.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT