Senior SecOps Engineer

What is Flagstone? Flagstone is many things. An online savings platform, reinventing how individuals, businesses, and charities manage, protect, and grow their cash. A diverse group of people, bound by a collaborative spirit, and shared purpose. And lastly, a thriving, profitable business – where smart people do their best work. Each definition shares a common thread: our unique culture. It’s our pride and joy. And our competitive advantage. A feel for our culture: To revolutionise the savings market, we need to be at our best. But high performance takes more than talent – it takes a culture of kindness, respect, and growth. That’s why we’re building a diverse, inclusive community, where your voice is heard and valued. Where, with close support and room to develop, you can surpass even your own expectations. And be rewarded for it. We may not change the world, but we  can change the world of financial technology. And all it takes is a winning mix of drive, talent, and empathy. Our culture celebrates all three. But enough about us. Let’s talk about you. About the role We’re looking for a Senior SecOps Engineer to take ownership of security operations at Flagstone. That covers everything from alert triage and incident response through to detection engineering and continuous improvement of how our SOC works. This is a hands-on role that sits right at the operational end of security. You’ll spend real time in the alert queue, as well as building the detections and automation that make it better. You’ll be right in the middle of complex investigations and P1s, while also shaping how the function operates. You’ll also own our relationship with our managed SOC provider, setting the standards they work to rather than simply receiving their output. About the team You’ll sit within Security Engineering, reporting to our Security Team Leader. In this role you’ll own detection, triage and incident response, and act as the technical counterpart to our managed SOC provider. That means directing their scope, holding them to clear detection and response standards, and keeping ownership of anything escalated or high severity in house. Does this sound like you? You’re an engineer at heart. You’d rather write the detection than describe it, and you treat detections and automation like any other engineering work: version controlled, tested and documented. You’re the go to expert when something serious happens, and you can explain security risk just as clearly to engineers as to senior stakeholders. You’re curious about new technology, AI included, and you have a clear view on where it genuinely helps and where it introduces risk. What you’ll do You’ll take ownership of our SOC operations and report on their performance and health to stakeholders across the business. You’ll run investigations and incident response for complex or high severity alerts, managing parallel workstreams, keeping stakeholders informed and running post incident reviews through to real changes in detections or process. You’ll own the detection engineering backlog, building, tuning and retiring detections across Microsoft Sentinel and Defender, mapped to a coverage model such as MITRE ATT&CK. You’ll turn threat intelligence into detection logic and hunting activity, and drive our automation and SOAR maturity by building Logic App playbooks that reduce manual effort without losing judgement on the nuanced cases. You’ll manage our managed SOC relationship day to day: defining scope and escalation criteria, reviewing performance against SLAs and acting as the technical escalation point for anything they can’t close. You’ll keep playbooks, escalation paths and documentation in shape so the practice scales beyond any one person, and you’ll track metrics like triage time, false positive rate and coverage gaps to drive continuous improvement. You’ll also explore and introduce AI assisted tooling into SOC workflows, such as triage and enrichment copilots, detection authoring and al