At Engine by Starling , we are on a mission to find and work with leading banks all around the world who have the ambition to build rapid growth businesses, on our technology. Engine is Starling's software-as-a-service (SaaS) business, the technology that was built to power Starling, and two years ago we split out as a separate business. Starling has seen exceptional growth and success, and a large part of that is down to the fact that we have built our own modern technology from the ground up. This SaaS technology platform is now available to banks and financial institutions all around the world, enabling them to benefit from the innovative digital features, and efficient back-office processes that has helped achieve Starling's success. We draw upon our experience as knowledgeable bankers, and best in class technologists to become the chosen option for these banks, and preferred partners for leading consultancies. As a company, everyone is expected to roll up their sleeves to help deliver great outcomes for our clients. We are an engineering led company and we’re looking for someone who will be excited by the potential for Engine’s technology to transform banking in different markets around the world. Hybrid Working We have a Hybrid approach to working here at Engine - our preference is that you're located within a commutable distance of one of our offices so that we're able to interact and collaborate in person. About the Role To support our rapid growth, we are looking for talented engineers to join our foundational in-house SecOps team. This is a "Full-Stack" security role: you will move beyond traditional monitoring to develop and operate our security capabilities. We are looking for engineers who are masters of automation but remain grounded in analyst fundamentals. You should have a keen interest in leveraging AI and Large Language Models (LLMs) to reduce SOC toil - using AI to summarise complex alerts, auto-generate YARA-L detections, or build intelligent playbooks to stay ahead of modern threats. Responsibilities Security Monitoring & Alert Triage: Active Monitoring: Monitor security alerts and events generated by the SecOps platform and integrated cloud security tools. Triage & Analysis: Perform deep-dive analysis of security incidents and anomalies, accurately distinguishing between true positives and false positives. Prioritisation: Manage the incident queue, prioritising alerts based on severity, potential impact, and business criticality. Detection Engineering & Automation (IaC): Detection as Code: Design and maintain sophisticated detection logic using YARA-L. Manage the lifecycle of these rules and configurations using IaC principles for version control. SOAR Extension: Lead the automation of response playbooks. You will write and extend SOAR capabilities using Python, creating custom integrations and "Managers" to connect SecOps with internal APIs. Tool Optimisation: Identify opportunities for automation to streamline operations and contribute to the continuous tuning and maintenance of SOC tools. Incident Response & Investigation: End-to-End Investigation: Investigate incidents thoroughly, leveraging logs from platforms, endpoints, and applications mapped to the Unified Data Model (UDM). Incident Lifecycle: Lead containment, eradication, and recovery efforts in collaboration with Security and Technology teams. Documentation: Maintain comprehensive records of incident details, findings, and remediation steps to ensure a high standard of auditability. Collaboration & Threat Intelligence: Group Collaboration: Work closely with the Group SOC team to align on global security standards and coordinate response efforts during cross-entity incidents. Threat Hunting: Stay informed about the latest cyber threats and cloud-specific vulnerabilities, conducting proactive threat-hunting activities using available telemetry. Requirements 3+ years of experience in a SOC or SecOps Engineering role, with a strong background in both alert triage and security engineering. Proficiency in Python: Ability to write clean code to automate workflows or interact with security APIs. Cloud Fluency: Experience with security monitoring and incident response in cloud environments (AWS/GCP/Azure). Infrastructure as Code: Familiarity with managing security configurations through Git-based workflows. Framework Knowledge: Strong understanding of attack vectors and the MITRE ATT&CK framework. Education: A degree in a cyber-related field or relevant certifications (e.g., CompTIA Security+, CySA+, GCIH) is beneficial. Interview process Interviewing is a two way process and we want you to have the time and opportunity to get to know us, as much as we are getting to know you! Our interviews are conversational and we want to get the best from you, so come with questions and be curious. In general you can expect the below, following a chat with one of our Talent Team: Stage 1 - 45 mins technical intereview Stage 2 - Take home task Stage 3 - 60 min with Team Members Stage 4 - Final with CTO Benefits 33 days holiday (including public holidays, which you can take when it works best for you) An extra day’s holiday for your birthday Annual leave is increased with length of service, and you can choose to buy or sell up to five extra days off 16 hours paid volunteering time a year Salary sacrifice, company enhanced pension scheme Life insurance at 4x your salary & group income protection Private Medical Insurance with VitalityHealth including mental health support and cancer care. Partner benefits include discounts with Waitrose, Mr&Mrs Smith and Peloton Generous family-friendly policies Incentives refer a friend scheme Perkbox membership giving access to retail discounts, a wellness platform for physical and mental health, and weekly free and boosted perks Access to initiatives like Cycle to Work, Salary Sacrificed Gym partnerships and Electric Vehicle (EV) leasing About Us You may be put off applying for a role becaus