Associate Security Operations Engineer
Job Description
[Up to c. $150k Comp Package | Office-Led Working]
Role Overview
We’re representing a global trading business that is expanding its in-house security function. The senior security team is currently pulled into routine investigations and escalations, and this is one of two net-new hires intended to change that, freeing senior engineers to focus on architecture and proactive improvement.
The position sits between SOC oversight and hands-on engineering. You’ll review the work of a 24/7 offshore SOC of around seven to eight analysts, taking responsibility for the quality of investigations and closures, while running routine incidents yourself within agreed escalation limits. Alongside that, you’ll tune detections, run threat hunts and contribute to wider security engineering projects. It suits an engineer with a couple of years in security operations or incident response who wants real ownership early, in a high-availability trading environment, rather than a seat that is purely alert monitoring...
Role Snapshot
- 3-6 years’ hands-on experience in security operations, incident response, detection engineering or threat hunting, with investigations taken from triage through to closure
- Own routine investigations and coordinate incidents within defined authority, escalating early with clear evidence and a recommended next step
- Provide day-to-day quality oversight of an offshore 24/7 SOC, reviewing evidence, closure rationale and handoffs, and raising recurring gaps
- Practical SIEM and EDR/XDR experience, ideally Microsoft Sentinel, Defender XDR or CrowdStrike Falcon, with the ability to write investigation queries in KQL or an equivalent language
- Investigate across identity, endpoint, email, cloud and network telemetry, preserving evidence, building timelines and keeping accurate case records in ServiceNow
- Build, tune and document detections mapped to MITRE ATT&CK, reducing false positives without suppressing genuine activity, and run hypothesis-driven hunts
- Contribute to security engineering projects alongside senior engineers, including playbooks, tabletop exercises and post-incident corrective actions
- Use scripting, APIs or workflow tools to automate enrichment, case creation and evidence collection, with human approval retained for disruptive containment
- Communicate clearly with technical teams, Legal, Compliance and business owners, reporting metrics that separate confirmed fact from hypothesis
- (Preferred) SC-200, GCIH or CrowdStrike certifications, cloud incident experience across AWS or Azure, and a background in trading, commodities, energy or financial services
...
Apply for this role
All fields marked with * are required.