Security Operations Lead

Security Operations Lead – SOC, Azure DevSecOps – UK Remote – BPSS (Baseline Personnel Security Standard)

Lead Security Operations. Build Security Engineering. Protect a Global SaaS Platform.

We are partnering with a technology organisation that operates a large-scale, cloud-native SaaS platform serving millions of users globally.

Due to continued growth, they are seeking an experienced Security Engineering & SOC Lead to drive both security engineering and security operations across a modern Microsoft Azure estate.

This is a rare opportunity for a hands-on cyber security professional who enjoys building security controls, improving SOC effectiveness, mentoring analysts, and leading incident response activities in a complex cloud environment.

Approximately 60% of the role is focused on security engineering, with the remainder centred on SOC leadership, detection engineering, and incident response.

You’ll lead a team of three analysts whilst remaining technically hands-on as the senior escalation point for complex investigations and security challenges.

The Role

As Security Engineering & SOC Lead, you will be responsible for designing, implementing, and continuously improving the security controls, monitoring capabilities, and operational processes that protect a large Azure-based platform.

Working closely with architecture, engineering, and development teams, you’ll ensure security is embedded across infrastructure, applications, and delivery pipelines.

Key Responsibilities
Security Engineering
Implement Azure security controls and platform guardrails.
Deploy and manage Azure Policy, Defender for Cloud, Conditional Access, Privileged Identity Management (PIM), Key Vault, Managed Identities, Azure Firewall and WAF solutions.
Deliver DevSecOps tooling across GitHub Actions and Azure Pipelines.
Implement SAST, SCA, secrets scanning, container security and Infrastructure-as-Code scanning.
Drive supply chain security initiatives including SBOM generation, artefact signing and policy enforcement.
Harden AKS and cloud-native services through Infrastructure-as-Code and automated security controls.
Work with engineering teams to remediate vulnerabilities, penetration test findings, and security risks.
Support threat modelling, security reviews, and secure software development practices.
Security Operations & Detection Engineering
Lead day-to-day SOC operations.
Own Microsoft Sentinel administration and optimisation.
Develop and tune detection logic using KQL and MITRE ATT&CK methodologies.
Lead incident response, investigation, containment and post-incident reviews.
Build automated response workflows using Logic Apps and security playbooks.
Conduct proactive threat hunting across platform telemetry.
Manage security monitoring, logging standards and onboarding of new services into the SIEM.
Produce dashboards, metrics and reporting on SOC performance and security posture.
Team Leadership
Lead, mentor and develop a team of three SOC Analysts.
Conduct one-to-ones, objectives and development planning.
Act as the team’s technical escalation point.
Develop analyst capabilities in threat hunting, detection engineering and advanced investigations.
Maintain SOC documentation, runbooks and operational procedures.

About You

You will be a hands-on cyber security professional with a strong background in both security engineering and security operations.

Essential Experience
Experience leading or managing a SOC, Security Operations, Detection Engineering or Incident Response function.
Strong hands-on Microsoft Sentinel experience.
Advanced KQL skills and detection engineering expertise.
Experience investigating and responding to security incidents within cloud environments.
Strong knowledge of Azure security technologies, including:
Entra ID
Conditional Access
PIM
Defender for Cloud
Azure Policy
Key Vault
Azure networking and segmentation
Experience implementing DevSecOps tooling and security automation.
Infrastructure-as-Code experience using Terraform and/or Bicep.
Automation experience using PowerShell and/or Python.
Knowledge of Kubernetes, AKS, container security and OWASP principles.
Ability to communicate effectively with both technical and business stakeholders.
Desirable Experience
Multi-tenant SaaS platform environments.
Microsoft Defender XDR suite.
Building or transforming SOC functions.
Threat hunting and purple team exercises.
Supply chain security, SBOM, Sigstore, Cosign or SLSA frameworks.
Policy as Code solutions such as OPA or Kyverno.
Previous software engineering, platform engineering or infrastructure background.
Certifications (Desirable)

Certifications are advantageous but practical experience is valued above qualifications.

Examples include:

Microsoft SC-200
Microsoft AZ-500
Microsoft SC-300
CompTIA CySA+
GIAC GCDA, GCIA, GCIH or GCFA
HashiCorp Terraform Associate
CKA / CKS
Why Apply?
Opportunity to shape and mature a growing security capability.
Hands-on technical leadership role.
Modern Azure cloud and cloud-native environment.
Significant influence across engineering, security and operations.
High-profile platform supporting large-scale global users.
Clear opportunity to mentor and develop an expanding security team.
Security Clearance

This role is subject to BPSS (Baseline Personnel Security Standard) screening and successful completion of the relevant checks will be required prior to employment.

All our roles are UK based. When submitting your application to Colossus, please ensure the following

• Your CV has your address and postcode.
• You also have your correct phone number and email address so we can contact you asap regarding your application.