SecOps Engineering Lead
27 days ago
Abingdon
Would you like to help enrich the lives of learners around the world? At RM, we’ve been pioneers of education technology since 1973. We provide technology and resources to the education sector, supporting over 20 million students and improving educational outcomes worldwide. What we do helps learners at all stages of their lives, from preschool to higher education and professional qualification; we partner with schools, examination boards, governments, and professional organisations globally to make learning more accessible, more engaging, and more impactful. RM operates through three divisions: Assessment (digital assessment and marking solutions), Technology (managed services, hardware, and software for schools), and TTS (educational resources). Within the assessment market we are experts in providing solutions for online exam testing and marking and the management and analysis of educational data. We work with government ministries, exam boards and professional awarding bodies for high stakes assessment such as GCSEs, ALevels, and professional qualifications. Each year, our software is used globally to conduct hundreds of thousands of on-screen tests and to mark millions of paper-based scripts. For over a decade we have been partnering with the world’s leading awarding bodies to deliver intuitive, secure, and reliable e-marking solutions. Visit our website to find out more: www.rm.com/assessment We are hiring a hands‑on Security Engineering & SOC Lead to build and run the controls our Cyber Security Architect designs, and to lead security operations for our Azure-hosted, multi‑tenant SaaS platform: SOC engineering, detection and monitoring, incident response, and managing a team of three analysts. 60% of the role is engineering: putting Azure guardrails, SOC tooling, pipeline security tooling and platform hardening into production. The rest is running the SOC: keeping security observability controls healthy, improving detections, leading response, and developing the three analysts. You are expected to be a senior hands‑on practitioner in the team and the analysts' escalation point, so you are expected to troubleshoot and fix issues yourself rather than only direct. A BPSS (Baseline Personnel Security Standard) is applicable to this role, therefore appropriate security checks will be carried out as part of the recruitment process prior to any offer being made. Security engineering: implementing the architecture • Build the Azure controls the security architecture defines: Azure Policy initiatives and Defender for Cloud plans, Entra ID Conditional Access and PIM, Key Vault and managed identity patterns, and network segmentation with Private Link, Azure Firewall and WAF rules., • Deliver the DevSecOps tooling in GitHub Actions or Azure Pipelines: SAST, SCA, secrets, container and IaC scanning, with tuned rules, reusable pipeline templates and feedback developers can act on., • Implement supply chain controls: SBOM generation, artifact signing and verification, dependency and base image policy, and the move from long‑lived pipeline secrets to OIDC federation., • Harden AKS and the platform services: admission policies, network policy, image provenance and workload identity, written as Terraform or Bicep with tests., • Own remediation of penetration test, Defender for Cloud and scanner findings with engineering teams, tracked to closure and reported monthly., • Support the S‑SDLC day to day: run the tooling, help teams threat model, sit on design reviews for security‑relevant changes, and coach the security champions. SOC operations and Microsoft Sentinel • Run the SOC day to day: queue health, shift and on‑call cover, escalation, and the runbooks the analysts work from., • Administer SOC tooling: workspace and data connector health, ingestion and cost management, retention, and integration with Defender XDR, Defender for Cloud and Entra ID Protection., • Own detection engineering: write and tune KQL analytics rules and hunting queries, map coverage to MITRE ATT&CK, track false‑positive rates, and retire rules that no longer earn their place., • Automate response with automation rules and Logic Apps playbooks so enrichment, ticketing and common containment steps run without an analyst., • Lead incident response: triage and contain incidents on the platform, coordinate engineering and the architect, run post‑incident reviews, and turn lessons into detections and controls., • Run regular threat hunts against the platform's telemetry and bring threat intelligence into detections. Analytics and monitoring • Own the logging and telemetry standard with the architect: which sources go to Sentinel, at what level, and how a new service is onboarded before go‑live., • Build SIEM workbooks and dashboards for coverage, alert quality and response times, and report SOC metrics (time to detect, triage and contain) monthly., • Provide tenant‑aware alerting and reporting where the platform needs it, including evidence for customer security audits., • Run vulnerability management across Azure and the platform with Defender Vulnerability Management, prioritised by exposure and tracked to closure. Leading the team • Line‑manage three SOC analysts: rota and cover, objectives, one‑to‑ones and development plans, and quality review of their triage and investigations., • Train the analysts and grow them from triage into detection engineering and hunting., • Be the technical escalation point and the person they learn the tools from; cover shifts when needed., • Keep the SOC's runbooks, on‑call arrangements and handovers current, and take part in hiring when the team grows. Essential: • Solid experience in security engineering or security operations, including proven experience of leading a SOC function or detection engineering, and experience supervising or mentoring analysts., • Hands‑on Microsoft Sentinel administration: workspace design, data connectors and ingestion cost control, retention, workbooks, automation rules and Logic Apps playbooks., • Strong KQL and detection engineering: you can write, tune and defend an analytics rule mapped to MITRE ATT&CK, and explain why it fires and why it does not., • Incident response on a cloud platform: triage, containment, evidence collection in Azure, coordination with engineering, and post‑incident review., • Implementing Azure security controls: Entra ID (Conditional Access, PIM, managed identities), Azure Policy, Defender for Cloud, Key Vault, and networking with NSGs, Private Link, Azure Firewall and WAF., • DevSecOps tooling in GitHub Actions or Azure Pipelines: integrating and tuning SAST, SCA, secrets, container and IaC scanners, and building reusable pipeline templates., • Infrastructure as code with Terraform or Bicep, and PowerShell or Python to automate controls and response., • Working knowledge of AKS and container security, and of the OWASP Top 10., • Clear written communication: runbooks, incident reports and remediation plans that engineers and managers can act on. Desirable: • Monitoring a multi‑tenant SaaS platform: tenant‑aware alerting, isolation testing, and producing evidence for customer security audits., • The wider Microsoft stack: Defender XDR, Defender for Endpoint and Identity, Entra ID Protection and UEBA in Sentinel., • Standing up a SOC, or taking one back in‑house from an MDR provider, and defining the coverage model with a small team., • Detection validation with purple teaming or Atomic Red Team, and hunting programmes that produced new detections., • Supply chain security in depth: SBOM (CycloneDX or SPDX), Sigstore or cosign, and SLSA provenance., • Policy as code with OPA or Kyverno., • A background as a software or platform engineer before moving into security. Qualifications and certifications: Certifications are not a requirement: what you have run and built counts. These are the ones we recognise for this role. • Security operations and Sentinel Microsoft SC‑200 (Security Operations Analyst), GIAC GCDA or GCIA, CompTIA CySA+, • Incident response GIAC GCIH or GCFA, • Azure security and identity Microsoft AZ‑500, SC‑300, • Engineering and platform HashiCorp Terraform Associate, CKA or CKS At RM we have My Work Blend @RM which provides office‑based colleagues with multi‑location and hybrid working options. As well as your office base, you can spend a proportion of your time working at other locations that suit your role and your life, including home, other offices, customer sites, distribution centres or on the move. We encourage you to discuss arrangements for this role with your potential line manager during the recruitment process. As well as a competitive salary and our core benefits package which includes private medical healthcare, life assurance and a Group Personal Pension Plan with higher contribution levels available. There are lots of voluntary benefits too. You could buy additional annual leave, join our dental plan, sign up for a health assessment, or take part in our cycle to work scheme. You could even earn yourself an extra bonus for successfully recommending a friend or family member for a position within RM. To better reflect the society that we serve, we’re committed to building a diverse workforce and creating an inclusive and welcoming environment for all. To achieve this, we create teams of talented people from different backgrounds and experiences and strive to be a business where our people can bring their whole selves to work, we also want to make the recruitment process as inclusive as possible for everyone. Should you require additional support with your application or through the interview process, please contact us at . Unfortunately, we are unable to offer visa sponsorship for this role. #J-18808-Ljbffr
Chef & Cook
Waiters
Retail
Kitchen Porter
Quick Service
Accounting & Finance
Art, Media, Design
Cleaning
Construction & Trades
Customer Service
Driver & Delivery
Education
Engineering
Entertainment
Events & Promotion
Health & Social Care
Information Technology
Legal
Management
Manufacturing
Office & Admin
Sales & Marketing
Security
Sports & Wellness
Warehouse