IT Sec Operations Lead (Cybersecurity)

Location: London

Company

hirify.global operates in an environment that protects proprietary research, source code, models, data and trading technology.

What you will do

• Own the security operations strategy, operating model, roadmap, service standards and day-to-day effectiveness.
• Lead SOC and MDR oversight, aligning monitoring and detection coverage with priority threats and critical assets.
• Drive detection engineering and threat hunting across endpoints, identity, networks, cloud, SaaS, Linux, containers, repositories and data flows.
• Lead material cyber incidents, coordinating investigation, containment, eradication, communications and recovery.
• Maintain and exercise response playbooks for insider threat, IP theft, ransomware, identity or cloud compromise, supplier compromise and data-integrity events.
• Build the internal team, govern specialist providers, establish forensic readiness and cyber-recovery assurance, and report operational metrics and risk to executives.

Requirements

• Significant experience leading security operations, detection and response, incident response or cyber defence in a complex technology environment.
• Proven experience leading serious cyber incidents across technical, operational, legal, compliance and senior stakeholder groups.
• Strong practical knowledge of SIEM, EDR/XDR, MDR/SOC services, detection engineering, threat hunting, identity and cloud telemetry, and incident case management.
• Experience with incident playbooks, crisis exercises, containment, recovery, digital forensics and evidence handling.
• Experience managing security service providers and translating tooling and contracts into measurable operational outcomes.
• Ability to build capable teams, set priorities and deliver through influence across organisational boundaries.
• Clear written and verbal communication, including concise reporting of risk, decisions and operational performance.
• Working knowledge of NIST CSF and MITRE ATT&CK, or equivalent incident-handling and threat-informed defence practices.

Nice to have

• Experience in quantitative finance, trading technology, investment management or another environment protecting high-value intellectual property.
• Knowledge of Linux, Kubernetes, cloud platforms, identity infrastructure, repositories, data platforms or high-performance computing.
• Experience integrating cyber response and recovery with operational resilience, business continuity and disaster recovery.
• Relevant certifications such as CISSP, GCIH, GCFA, GNFA or CISM, or equivalent practical experience.

Culture & Benefits

• Calm, technically credible, pragmatic and collaborative working style.
• Focus on creating structure in an evolving environment, making ownership explicit and achieving measurable risk reduction rather than pursuing process or tooling for its own sake.