About this role
Lead Detection & Response Engineer
*SALARY:*£92,701 - £109,060
*LOCATION(S):*Edinburgh
*HOURS:*Full time
WORKING PATTERN: Our work style is hybrid, which involves spending at least two days per week, or 40% of your time, at one of our office sites.
About this opportunity
Help defend one of the UK's largest organisations against evolving cyber threats. As a Lead Detection & Response Engineer within the Cyber Defence Centre, you'll play a key role in protecting the organisation by leading a team of engineers responsible for identifying, investigating and responding to security events and incidents.
This role combines deep technical expertise with people leadership and strategic delivery. You'll establish technical standards, shape the evolution of detection and response capabilities, and lead initiatives that strengthen cyber resilience across the organisation.
What you'll do
- Lead and coordinate cyber security investigations, driving effective analysis, containment, remediation and lessons learned activities.
- Provide technical guidance and support to engineers during incidents, investigations and threat-led activities.
- Develop and continuously improve detection and response capabilities to strengthen cyber defence outcomes.
- Support threat hunting, investigations and proactive cyber defence activities to identify and reduce cyber risk.
- Act as a technical authority for security engineering, influencing policies, standards, roadmaps and investment decisions.
- Lead, coach and develop Detection & Response Engineers, building capability and supporting an inclusive, high-performing team culture.
About us / Why Lloyds Banking Group
Our continued dedication to helping Britain prosper means that as a colleague you can make a difference to customers, businesses and communities.
Together we have a key role to play in shaping the bank of the future, whilst the scale and reach of our Group means you'll continue to have opportunities to learn, grow and develop.
We're focused on creating a values-led culture, and our approach to inclusion and diversity means that we all have the chance to make a real difference, together.
What you'll need
- Strong capability in Security Engineering, with proven experience in a Security Operations, Cyber Defence, Detection & Response or Incident Response environment.
- Experience leading, coaching and developing technical colleagues within a high-performing team environment.
- Strong understanding of incident response methodologies, attacker behaviours and cyber attack lifecycles.
- Experience of threat hunting, investigation and cyber defence activities to identify and respond to security threats.
- Strong analytical and problem-solving skills, with the ability to assess risk and make effective decisions during investigations and incidents.
- Excellent stakeholder management skills, with the ability to influence and collaborate effectively across technical and non-technical audiences.
And any experience of this would be really useful
- Experience in Digital Forensics activities and investigations.
- Experience contributing to or shaping cyber security policies, standards or secure design patterns.
- Experience automating operational processes to improve detection and response effectiveness and efficiency.
This is a place for you...
Our ambition is to be the leading UK business for diversity, equity and inclusion, supporting our customers, colleagues and communities. We are committed to creating an environment in which everyone can thrive, learn and develop.
We were one of the first major organisations to set goals on diversity in senior roles, create a menopause health package, and launch a dedicated Working with Cancer initiative.
We offer reasonable workplace adjustments for colleagues with disabilities, including flexibility in office attendance, location and working patterns. As a Disability Confident Leader, we guarantee interviews for a fair and proportionate number of applicants who meet the minimum criteria for the role and have a disability, long-term health or neurodivergent condition, through the Disability Confident Scheme.
We provide reasonable adjustments throughout the recruitment process to reduce or remove barriers - just let us know what you need.
Benefits
- 30 days' holiday, with bank holidays on top.
- A generous pension contribution.
- Discretionary annual performance-related bonus.
- Private medical benefit.
- Access to wellbeing initiatives and colleague support programmes.
- Opportunities for ongoing learning, career development and internal mobility.
This role will include a requirement to be part of an on-call rota.
Ready to make an impact? Apply today.
About cyber security & digital forensics roles for ex-police
Cyber security, digital forensics and incident-response roles. DMIs, cybercrime investigators and digital forensics officers bring evidential discipline and investigative judgement that DFIR and security teams struggle to hire.
See all cyber security & digital forensics jobs in Edinburgh →Why this fits a police background — match score 90/100
- Incident command & response
- Investigative casework
- Digital forensics & cybercrime
- Security operations
- Training & coaching delivery
What cyber security & digital forensics roles pay ex-police
Advertised UK ranges, editorial estimates reviewed July 2026
| Digital forensics analyst | £32,000–£45,000 |
| DFIR consultant | £45,000–£65,000 |
| Senior forensics / IR specialist | £60,000–£80,000 |
| Threat-intelligence specialist | £55,000–£80,000 |