Security Operations Engineer

About this role

Description

Job Title: Security Operations Engineer

Employment Type: Full-time

Work Location: UK / Hybrid

Department: CISO

About CloudBees

CloudBees helps organizations build, run, and govern software factories, giving enterprises the confidence to ship software better, faster, and safer.

Writing code is no longer the bottleneck. Governing what reaches production and validating its impact is. As enterprises adopt agentic coding, software is created faster than most teams can review, secure, and validate. Without consistent governance, organizations risk shipping code they cannot explain, audit, or trust.

CloudBees addresses this challenge without asking teams to replace the tools they already use. Across every toolchain a customer runs, CloudBees makes each change, human or AI, visible, auditable, and accountable before it reaches production. CloudBees Unify is the product behind this: a governance layer, with context and control-plane capabilities, that enforces consistent policy and evidence across every tool, team, and workflow.

Founded in 2010, CloudBees is backed by Goldman Sachs, Morgan Stanley, Bridgepoint Capital, HSBC, Golub Capital, Delta-v Capital, Matrix Partners, and Lightspeed Venture Partners.

Visit us at www.cloudbees.com.

We're growing our Global Security team and are looking for Security Operations Engineers (Mid/Senior) who enjoy building security capabilities - not simply operating them.

This is not a traditional SOC role.

Instead of spending your day triaging alerts, you'll engineer the systems that make Security Operations smarter, faster and more scalable.

You'll work across Detection Engineering, Security Automation, Threat Hunting and Incident Response, building detection logic, automating repetitive workflows and partnering closely with Product Engineering to improve security telemetry across the CloudBees platform.

Whether you're already operating at Senior level or you're a strong Security Operations Engineer ready for the next step, we're interested in engineers who think in automation, code and continuous improvement.

What You'll Do

Detection Engineering

• Design, build and continuously improve detection rules across cloud, endpoint, SaaS and application environments.
• Own the full detection lifecycle from hypothesis through deployment and continuous tuning.
• Create high-fidelity detections using operational threat intelligence, incident learnings and purple team findings.
• Measure and improve detection coverage using the MITRE ATT&CK framework.
• Continuously reduce false positives while improving visibility into emerging attacker techniques.

SOAR & Automation Engineering

• Design and maintain SOAR playbooks that automate alert triage, enrichment, containment and response.
• Identify repetitive analyst workflows and automate them using APIs, scripting and orchestration platforms.
• Build integrations across SIEM, EDR, CNAPP, vulnerability management and ticketing systems.
• Help introduce AI-assisted workflows that improve investigation quality and analyst productivity.

Security Operations & Incident Response

• Monitor and investigate security events across corporate and production environments.
• Participate in weekend on-call support for Security Operations.
• Lead or support incident response activities including investigation, containment, recovery and lessons learned.
• Perform proactive threat hunting using telemetry across multiple security platforms.
• Improve operational playbooks and incident response processes.

Product & Engineering Collaboration

• Partner with Product and Platform Engineering teams to improve security telemetry and logging.
• Help define security observability requirements for new services.
• Collaborate with developers to improve security visibility across the CloudBees platform.
• Translate operational findings into practical engineering improvements.

Vulnerability & Threat Intelligence

• Contribute to vulnerability assessment and management processes, prioritising findings based on threat context and exploitability
• Consume and operationalise threat intelligence feeds, translating indicators and TTPs into detection logic and hunting hypotheses
• Participate in red team/purple team exercises, using findings to validate and improve the detection stack

What You'll Bring

Required

• 3+ years of experience in Security Operations, Detection Engineering or Security Engineering.
• Hands-on experience with enterprise SIEM platforms such as Splunk, Microsoft Sentinel, Elastic, Chronicle or QRadar.
• Experience building and tuning detection rules.
• Experience developing SOAR playbooks or security automation.
• Strong scripting skills using Python, PowerShell or similar languages.
• Experience working within cloud environments (AWS preferred; Azure or GCP experience also valued).
• Solid understanding of the MITRE ATT&CK framework.
• Experience supporting security incident response.
• Comfortable working with Git, APIs and engineering workflows.
• Excellent communication skills with both Security and Engineering teams.

Preferred

• Experience with Detection Engineering methodologies.
• Experience with AI-assisted detection or security automation.
• Familiarity with Sigma, Atomic Red Team or detection testing frameworks.
• Experience with Infrastructure as Code (Terraform, CloudFormation, ARM).
• Kubernetes or container security experience.
• Experience working within SaaS, DevOps or software delivery organisations.
• Relevant certifications including GCIH, GCIA, GCDA, GCED or AWS Security Specialty.

What Success Looks Like

Within your first year you'll help CloudBees

• Increase detection coverage across enterprise and production environments.
• Improve automation throughout Security Operations.
• Reduce manual investigation effort.
• Improve incident response efficiency.
• Build scalable engineering solutions that enable Security Operations to grow without increasing operational overhead.

What You'll Get

• Highly competitive benefits and vacation package.
• Ability to work for one of the fastest growing companies with some of the most talented people in the industry.
• Team outings.
• Fun, Hardworking, and Casual Environment.
• Endless Growth Opportunities.

At CloudBees, we truly believe that the more diverse we are, the better we serve our customers. A global community like Jenkins demands a global focus from CloudBees. Organizations with greater diversity - gender, racial, ethnic, and global - are stronger partners to their customers. Whether by creating more innovative products, or better understanding our worldwide customers, or establishing a stronger cross-section of cultural leadership skills, diversity strengthens all aspects of the CloudBees organization.

In the technology industry, diversity creates a competitive advantage. CloudBees customers demand technologies from us that solve their software development, and therefore their business problems, so that they can better serve their own customers. CloudBees attributes much of its success to its worldwide workforce and commitment to global diversity, which opens our proprietary software to innovative ideas from anywhere. Along the way, we have witnessed firsthand how employees, partners, and customers with diverse perspectives and experiences contribute to creative problem solving and better solutions for our customers and their business.

About security roles for ex-police

Security management, operations and consultancy roles. Years of operational policing — command, incident response, public order — translate directly into corporate security, and employers in this sector actively rate police experience.