> Markdown version of [/jobs/ext/2488453-lead-security-operations-engineer](https://www.wearedevelopers.com/jobs/ext/2488453-lead-security-operations-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Security Operations Engineer - **Company:** Pleo - **Location:** UK (Remote available) - **Experience:** Expert - **Salary:** £98,970.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Cyber Security, Digital Forensics, Intrusion Detection and Prevention, Security Information and Event Management, Data Logging, Cloud Platform System, Mitre Att&ck, CIS Benchmarks, Devsecops, Blue Team (Cyber Security) - **Published:** August 14, 2026 - **Apply:** https://www.adzuna.co.uk/jobs/details/5841943474 ## About the Role * 10+ years of experience in security operations, incident response, or a closely related discipline, with a proven track record of materialised risk reduction through monetary impact, incidents contained, forensics that changed outcomes. * A strong development and engineering background. You are comfortable writing the automation, not just specifying it. * Hands-on SOC and SIEM management experience, including detection engineering and log pipeline design. * Experience in scale-up environments, where you've built capability rather than inherited a mature one. * A strong understanding of cloud architectures as we use AWS. With part of our estate on GCP and how infrastructure decisions shape detection and response. * Demonstrated experience using AI and/or coding automation to get security controls built, implemented, and operating in practice. * Fintech, payments, fraud, or trust & safety experience is a real advantage, as is exposure to highly regulated environments. * Backgrounds that tend to do well here: incident response, IR management, SOC engineering, security engineering, DevSecOps, red or blue team. ## Description You'll report to our VP of Fraud & Security and work closely with Fraud, DevSecOps, Engineering, and Risk & Compliance. Our team is highly collaborative and dedicated to protecting Pleo's customers and their money. You'll also have the chance to partner with teams across the organisation and to bring less experienced security engineers up with you as the function matures. As a Lead Security Operations Engineer, you will: * Build and own a structured SecOps roadmap grounded in well-known frameworks such as MITRE ATT&CK, NIST, and CIS benchmarks. * Lead security investigations and digital forensics, from suspicious traffic through to full incident response, and bring the findings back into how we detect and prevent. * Design, tune, and scale our SIEM and logging pipeline through standardized log ingestion across services so signal isn't lost in the noise. * Strengthen our perimeter and authentication posture, including WAF configuration, authorisation tuning, and monitoring for suspicious traffic. * Protect sensitive data through DLP controls, and make sure the coverage matches where the data actually lives. * Improve our on-call rotation for the team, defining the alerting, escalation paths, and response SLAs that make it work. * Automate detection and response workflows, using code and AI to reduce manual toil and shorten time to resolution. * Reduce SecOps-attributed risk identified through compliance gaps, and collect the evidence that demonstrates it. * Build dashboards and reporting that give the team and leadership real visibility into response times, coverage, and risk reduction. * Work cross-functionally with engineers who don't have a security background, translating threat models into changes they can actually ship., * You want a large blast radius. We have high-impact projects where the outcome shows up in real business metrics, at a pre-IPO company. * You're energised by building a function rather than maintaining one, and you'd rather set the roadmap than be handed it. * You enjoy raising the bar around you, growing a team of specialists and lifting the people already here. * You're equally at home in a threat model discussion and in an editor writing the automation that acts on it. This role is not a good fit for you if: * You need a well-groomed backlog and assigned tasks in order to do your best work. * You'd rather stay purely strategic than get hands-on with the tooling. * You're not up for participating in an on-call rotation. In your first 6 months at Pleo, you'll: * Get deep into Pleo's security landscape and our detection coverage, our logging estate, our cloud footprint to form your own view of where the biggest risks sit. * Publish a SecOps roadmap mapped to MITRE, NIST, and CIS, agree with Engineering, Risk & Compliance, and leadership, and start delivering against it. * Stand up the on-call rotation and the alert response SLAs that go with it. * Ship your first wave of detection and automation improvements, and establish the KPIs that show what changed. We're committed to helping you develop your career, whether that means taking on bigger projects, stepping into leadership, or acquiring new skills. There's genuine room here for the scope of this role to grow, including into people leadership. Please note: We can hire on a remote, hybrid or in-person set-up in any of the locations listed on the advert but you will need to be physically based in the country of your choice with a valid right to work. We are unable to offer visa sponsorship for this role in any of the listed locations. * Your own Pleo card (no more out-of-pocket spending!) * Lunch is on us for your work days - enjoy catered meals or receive a lunch allowance based on your local office * Comprehensive private healthcare - depending on your location, coverage options include Vitality, Alan or Médis * We offer 25-28 days of holiday (depending on your location) + public holidays * For our Team, we offer both hybrid and fully remote working options * Option to purchase 5 additional days of holiday through a salary sacrifice * We use MyndUp to give our employees access to free mental health and well-being support with great success so far * Paid parental leave - we want to make sure that we're supportive of families and help you feel that you don't have to compromise your family due to work We want to ensure you are set-up for success and understand what will be expected of you. If your application is successful, our interview process is as follows: 1. Intro call: A 30-minute chat with our Talent Partner to discuss the role and your background. 2. Hiring Manager interview: a 60-minute conversation covering your experience, how you approach security operations, and how you communicate. 3. Technical deep dive: a 60-minute session with two of our SecOps engineers, going deep on SIEM, detection engineering, your coding and automation experience. 4. Cross-functional interview: a 45-minute conversation with DevSecOps and Engineering leadership on how you work across team boundaries with other senior engineers. ## Related Videos - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [Crypto-secure Data Management with In-Database Blockchain](https://www.wearedevelopers.com/videos/632-crypto-secure-data-management-with-in-database-blockchain) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)