Senior SecOps Specialist

Job description

Hello. We’re Teya. Teya was founded on a simple belief: local businesses deserve better. They are the cafés, restaurants, salons, shops and entrepreneurs that bring character to our high streets, create jobs and keep communities moving. Yet for too long, financial services has made life harder for them - with clunky tools, poor support and complexity that gets in the way of running a business. Teya exists to change that. We’re building a financial platform for local businesses across Europe - one built around simple tools, thoughtful design and real human support. Our Members rely on us to help them run their business with confidence, and that responsibility shapes the way we work. We move fast. We care about quality. We stay close to the detail. And we believe great performance and genuine hospitality should go hand in hand. If you want to build meaningful products, solve real problems and make a genuine difference for local businesses, we’d love to hear from you YOUR MISSION As a SecOps Specialist, you protect Teya by detecting, investigating, and responding to security incidents while ensuring our security operations are reliable, scalable, and continuously improving. You will lead complex SOC investigations, provide L3 support, maintain and improve core security tooling, and build automations and integrations that increase speed, consistency, and quality across security operations. You will work closely with Security Engineering, IT, Infrastructure, Platform, Cloud, and Product teams to reduce risk and embed security effectively across the organisation. You operate across incident response, detection engineering, security tooling, vulnerability management, threat intelligence, telemetry, and automation - turning operational insight into stronger controls and better engineering outcomes. Responsibilities Security Operations & Incident Response • Lead end-to-end investigation and response of complex security incidents. • Act as L3 escalation point for SOC analysts and MSSP. • Coordinate across Security, Engineering, IT, Cloud, Legal, and Compliance during incidents. • Make clear, risk-based decisions under pressure with strong documentation. • Maintain playbooks, runbooks, and incident workflows. • Drive post-incident reviews and ensure improvements are implemented and follow-ups completed. • Support incident metrics (MTTD, MTTR, recurrence, etc.) SOC Tooling & Platform Operations • Operate and improve SIEM, EDR, email security, case management, and vulnerability tools. • Monitor health, coverage, data quality, and integrations. • Troubleshoot ingestion, parsing, API, and configuration issues. • Build and maintain integrations between security tools and internal systems. • Manage upgrades, changes, access reviews, and documentation. • Apply engineering practices (version control, testing, peer review, rollback). • Reduce operational toil through automation and simplification. Vulnerability Management • Analyse and prioritise vulnerabilities based on risk and exploitability. • Work with Engineering and IT to drive remediation. • Track fixes, validate resolution, and escalate high-risk issues. • Improve vulnerability workflows and automation. • Identify recurring issues and recommend preventative controls. Detection Engineering • Build, test, and maintain detection rules, queries, and correlation logic. • Manage full detection lifecycle (build → test → tune → measure → retire). • Use version control and detection-as-code where possible. • Reduce false positives and improve detection quality and coverage. • Map detections to threat behaviours (e.g. MITRE ATT&CK). • Validate detections through testing, incidents, and simulations. Log & Telemetry Management • Onboard and maintain log sources across cloud, identity, endpoint, network, and SaaS. • Ensure logs are complete, reliable, and usable for detection and investigation. • Troubleshoot ingestion, parsing, schema, and data quality issues. • Build validation and monitoring for telemetry pipelines. • Offboard unused sources safely with documented impact. • Improve telemetry coverage by working with engineering teams. Threat Intelligence • Monitor threats, vulnerabilities, and attacker techniques. • Translate intelligence into detections, investigations, and remediation actions. • Assess relevance to Teya’s environment and risk profile. • Share actionable insights with relevant teams. • Improve security posture using trends and intelligence. • Gather and utilize intelligence for Shadow AI use-cases. Cross-Functional Delivery • Partner with Engineering and Platform teams on security requirements. • Manage security work in Jira with clear scope and ownership. • Support security projects (tooling, integrations, telemetry, controls). • Contribute to technical design discussions. • Produce clear technical documentation and workflows. • Communicate effectively with technical and non-technical stakeholders. Automation & Engineering • Automate SOC and security operations workflows. • Build scripts, integrations, and event-driven automations using APIs and cloud services. • Apply secure engineering practices (testing, logging, secrets management, error handling). • Use version control and peer review for automation and detection content. • Monitor and improve automation reliability. • Explore AI/automation opportunities to reduce manual effort. • Define and track operational and security metrics. Requirements • 7+ years in SOC, incident response, detection engineering, or security engineering. • Experience leading complex security incidents end-to-end. • Strong hands-on experience with SIEM, EDR, and security tooling. • Experience building and tuning detections and queries. • Experience with log onboarding, telemetry pipelines, and data quality issues. • Strong vulnerability management and remediation experience. • Solid understanding of attack techniques, cloud, endpoint, identity, and network security. • Hands-on scripting/automation (Python, PowerShell, Bash, etc.). • Experience with APIs, integrations, and automation workflows. • Familiarity with Git and engineering practices (testing, review, deployment). • Experience using Jira or similar tools for operational delivery. • Strong communication and documentation skills. • Ability to work independently and make decisions under pressure. Nice-to-Haves • Fintech or regulated industry experience. • AWS or cloud-native security experience. • Experience with tools like Exabeam, Splunk, CrowdStrike, Okta, etc. • SOAR or security automation experience. • Threat hunting, purple teaming, or detection-as-code experience. • CI/CD, IaC, or DevSecOps exposure. • REST APIs, OAuth, secrets management experience. • Security certifications (GCIA, GCIH, CISSP, etc.). Ways of Working • Ownership: You own outcomes, not just tasks. • Calm under pressure: You stay structured in incidents. • Risk-based thinking: You prioritise what reduces real risk. • Engineering mindset: You build scalable, maintainable solutions. • Collaboration: You work effectively across teams. • Curiosity: You dig into root causes and system behaviour. • Autonomy: You operate independently but escalate appropriately. • Impact-driven: You focus on measurable security improvement. • High craft standard: You value quality in detections, tooling, and documentation. • Reuse over reinvention: You build for scale and repeatability. • Continuous learning: You stay current with threats and technology. • AI-aware: You look for safe, practical AI first automation opportunitie The Perks - We trust you, so we offer flexible working hours, as long it suits both you and your team; - Health Insurance; - Physical and mental health support through our partnership with MyFitness; - 25 days of Annual leave (+ Bank Holidays); - Possibility to visit other Teya offices to meet colleagues in instances when travel is safe and appropriate; - Friday lunch in the office; - Friendly, comfortable and high-end work equipment and informal office environment; - Hybrid work mode policy. Teya is proud to be an equal opportunity employer. We are committed to creating an inclusive environment where everyone regardless of race, ethnicity, gender identity or expression, sexual orientation, age, disability, religion, or background can thrive and do their best work. We believe that a diverse team leads to better ideas, stronger outcomes, and a more supportive workplace for all. If you require any reasonable adjustments at any stage of the recruitment process whether for interviews, assessments, or other parts of the application—we encourage you to let us know. We are committed to ensuring that every candidate has a fair and accessible experience with us.