SecOps Engineer

In this role you strengthen OCS’s cyber defense by enhancing detection, investigation and response capabilities. You will proactively identify gaps in detection coverage, drift in security platforms, and inefficiencies in processes, delivering pragmatic fixes and measuring outcomes. You’ll collaborate with teams to automate tasks, improve platform health, and lead threat hunts and incident support. This position offers impact across security operations, a chance to shape defense at scale, and engagement with a security-first culture.

• digital learning resources
• award-winning employer reputation
• Hapi retail discounts
• Wagestream flexible pay option
• professional growth opportunities
• inclusive and diverse workplace

• Detection engineering and tuning across SIEM, XDR and email security mapped to MITRE ATT&CK
• Develop and maintain detection-as-code with version control and CI/CD where appropriate
• Automate repetitive analyst tasks using SOAR, scripts, or low-code approaches
• Build and maintain integrations between security tools and adjacent platforms
• Develop dashboards for operational health for analysts and leadership
• Own configuration and health of SecOps platforms (SIEM, EDR, email security, identity protection)
• Monitor for configuration drift, coverage gaps and ingestion failures; resolve at source
• Lead onboarding of new log sources, telemetry and integrations with usable, normalised data
• Conduct regular threat hunts and translate findings into durable detections or process changes
• Provide deep technical incident response support including forensic data collection and log analysis
• Capture lessons learned from incidents and translate into engineering improvements
• Maintain a back-log of weaknesses and improvements, prioritising with Senior SecOps Lead
• Document standards, runbooks and engineering decisions clearly
• Stay current with threat landscape, vendor roadmaps and security community ideas

• Extensive SecOps experience with multiple tools
• Hands-on security engineer or senior SOC analyst with engineering responsibilities
• Strong knowledge of at least one enterprise SIEM and one EDR/XDR platform; ability to write detections and tune content
• Solid scripting ability (Python, PowerShell or KQL) with API and integration understanding
• Practical understanding of common attack techniques mapped to MITRE ATT&CK and telemetry manifestations
• Proactive mindset with demonstrable end-to-end problem solving
• Strong written communication; ability to document detections, runbooks and decisions to high standard
• Organisational and time management skills; strong interpersonal and communication abilities
• Willingness to travel nationally
• Confidence to drive a Security First environment
• Ability to learn new tools quickly and effectively

• proactive mindset
• strong written communication
• teamwork and collaboration
• SIEM
• EDR/XDR
• detection engineering