Vulnerability Management

• Analyse and prioritise vulnerabilities based on risk and exploitability.
• Work with Engineering and IT to drive remediation.
• Track fixes, validate resolution, and escalate high-risk issues.
• Improve vulnerability workflows and automation.
• Identify recurring issues and recommend preventative controls.

Detection Engineering

• Build, test, and maintain detection rules, queries, and correlation logic.
• Manage full detection lifecycle (build → test → tune → measure → retire).
• Use version control and detection-as-code where possible.
• Reduce false positives and improve detection quality and coverage.
• Map detections to threat behaviours (e.g. MITRE ATT&CK).
• Validate detections through testing, incidents, and simulations.

Log & Telemetry Management

• Onboard and maintain log sources across cloud, identity, endpoint, network, and SaaS.
• Ensure logs are complete, reliable, and usable for detection and investigation.
• Troubleshoot ingestion, parsing, schema, and data quality issues.
• Build validation and monitoring for telemetry pipelines.
• Offboard unused sources safely with documented impact.
• Improve telemetry coverage by working with engineering teams.

Threat Intelligence

• Monitor threats, vulnerabilities, and attacker techniques.
• Translate intelligence into detections, investigations, and remediation actions.
• Assess relevance to Teya’s environment and risk profile.
• Share actionable insights with relevant teams.
• Improve security posture using trends and intelligence.
• Gather and utilize intelligence for Shadow AI use-cases.

Cross-Functional Delivery

• Partner with Engineering and Platform teams on security requirements.
• Manage security work in Jira with clear scope and ownership.
• Support security projects (tooling, integrations, telemetry, controls).
• Contribute to technical design discussions.
• Produce clear technical documentation and workflows.
• Communicate effectively with technical and non-technical stakeholders.

Automation & Engineering

• Automate SOC and security operations workflows.
• Build scripts, integrations, and event-driven automations using APIs and cloud services.
• Apply secure engineering practices (testing, logging, secrets management, error handling).
• Use version control and peer review for automation and detection content.
• Monitor and improve automation reliability.
• Explore AI/automation opportunities to reduce manual effort.
• Define and track operational and security metrics.

Requirements

• 7+ years in SOC, incident response, detection engineering, or security engineering.
• Experience leading complex security incidents end-to-end.
• Strong hands-on experience with SIEM, EDR, and security tooling.
• Experience building and tuning detections and queries.
• Experience with log onboarding, telemetry pipelines, and data quality issues.
• Strong vulnerability management and remediation experience.
• Solid understanding of attack techniques, cloud, endpoint, identity, and network security.
• Hands-on scripting/automation (Python, PowerShell, Bash, etc.).
• Experience with APIs, integrations, and automation workflows.
• Familiarity with Git and engineering practices (testing, review, deployment).
• Experience using Jira or similar tools for operational delivery.
• Strong communication and documentation skills.
• Ability to work independently and make decisions under pressure.

Nice-to-Haves

• Fintech or regulated industry experience.
• AWS or cloud-native security experience.
• Experience with tools like Exabeam, Splunk, CrowdStrike, Okta, etc.
• SOAR or security automation experience.
• Threat hunting, purple teaming, or detection-as-code experience.
• CI/CD, IaC, or DevSecOps exposure.
• REST APIs, OAuth, secrets management experience.
• Security certifications (GCIA, GCIH, CISSP, etc.).

Ways of Working

• Ownership: You own outcomes, not just tasks.
• Calm under pressure: You stay structured in incidents.
• Risk-based thinking: You prioritise what reduces real risk.
• Engineering mindset: You build scalable, maintainable solutions.
• Collaboration: You work effectively across teams.
• Curiosity: You dig into root causes and system behaviour.
• Autonomy: You operate independently but escalate appropriately.
• Impact-driven: You focus on measurable security improvement.
• High craft standard: You value quality in detections, tooling, and documentation.
• Reuse over reinvention: You build for scale and repeatability.
• Continuous learning: You stay current with threats and technology.
• AI-aware: You look for safe, practical AI first automation opportunities

The Perks

We trust you, so we offer flexible working hours, as long it suits both you and your team;

• Health Insurance;
• Physical and mental health support through our partnership with MyFitness;
• 25 days of Annual leave (+ Bank Holidays);
• Possibility to visit other Teya offices to meet colleagues in instances when travel is safe and appropriate;
• Friday lunch in the office;
• Friendly, comfortable and high-end work equipment and informal office environment;
• Hybrid work mode policy.

Teya is proud to be an equal opportunity employer.

We are committed to creating an inclusive environment where everyone regardless of race, ethnicity, gender identity or expression, sexual orientation, age, disability, religion, or background can thrive and do their best work. We believe that a diverse team leads to better ideas, stronger outcomes, and a more supportive workplace for all.

If you require any reasonable adjustments at any stage of the recruitment process whether for interviews, assessments, or other parts of the application—we encourage you to let us know. We are committed to ensuring that every candidate has a fair and accessible experience with us.