Security Operations Lead

Skills, Qualifications & Experience

• SOC & Incident Response: Demonstrable hands-on experience in security operations and incident investigation,

including alert validation, evidence analysis, severity assessment, and timely escalation. Practical ability to

interrogate SIEM and EDR data, build and tune detections, and use scripting or automation safely. Deep

understanding of attacker behaviours and identity, endpoint, network, and cloud telemetry.

• Operational Leadership: Evidence of technical leadership: coordinating operational work, coaching colleagues,

improving investigation quality, and communicating clearly under pressure. Ability to maintain playbooks,

preserve evidence, work within change controls, and collaborate with engineering on remediation. Ability to

translate technical findings into business implications and use metrics for real service improvement.

• Certifications & Specialized Experience: Relevant incident response, threat hunting, or security operations

certifications (or equivalent practical experience). Experience in payment/transaction-sensitive environments,

cloud and identity investigations, purple-team exercises, detection-as-code, and safe orchestration of response

workflows. Familiarity with managed security service (MSSP) oversight is highly beneficial.