Senior SecOps Engineer

As Senior SecOps Engineer you will own Flagstone's security operations, driving incident response, detection engineering, and continuous improvement of SOC processes. You will work hands-on in alert triage and investigations, shaping detections and automation, and managing the relationship with our managed SOC. This role sits at the operational security edge, influencing playbooks, SLAs, and our evolving security posture. You will collaborate with cross-functional teams to map threats to actionable detections and safeguard financial technology systems.

• Hybrid working (London office)
• Competitive bonus scheme
• Flexible benefits budget
• Around the World work-from-anywhere for 3 months
• Mental wellbeing support (therapy)
• Learning and development budget

• Own SOC operations and report on performance to stakeholders
• Lead investigations and incident response for high-severity alerts with parallel workstreams
• Manage detection engineering backlog across Microsoft Sentinel and Defender, aligned to a MITRE ATT&CK coverage model
• Translate threat intelligence into detections and hunting activity; advance automation and SOAR maturity (Logic Apps)
• Direct and govern the managed SOC relationship: scope, SLAs, escalation criteria, and escalation handling
• Maintain and evolve playbooks, escalation paths, and documentation for scalable practice
• Explore and introduce AI-assisted tooling into SOC workflows with clear human-in-the-loop boundaries

• 5+ years in a SOC, security operations or detection engineering role, with senior IC progression
• Hands-on experience with Microsoft Sentinel and Defender (detections, not just alerts)
• Experience leading investigations and IR with stakeholder communication under pressure
• Experience building SOAR and automation content (e.g., Sentinel Logic Apps) and monitoring for silent failures
• Strong understanding of attack patterns and MITRE ATT&CK and how to translate into coverage
• Experience directing a managed/outsourced SOC or MDR with scope, SLAs and escalation criteria
• Practical use of AI/LLM tooling in SecOps
• Strong communication and stakeholder management skills, and bias for practical security risk judgement
• Curiosity about new technologies and frameworks

• strong communication
• stakeholder influence
• critical thinking
• Microsoft Sentinel
• Defender
• Logic Apps