The posting
What is Flagstone?
Flagstone is many things. An online savings platform, reinventing how individuals, businesses, and charities manage, protect, and grow their cash. A diverse group of people, bound by a collaborative spirit, and shared purpose. And lastly, a thriving, profitable business – where smart people do their best work.
Each definition shares a common thread: our unique culture. It’s our pride and joy. And our competitive advantage.
A feel for our culture:
To revolutionise the savings market, we need to be at our best. But high performance takes more than talent – it takes a culture of kindness, respect, and growth.
That’s why we’re building a diverse, inclusive community, where your voice is heard and valued. Where, with close support and room to develop, you can surpass even your own expectations. And be rewarded for it.
We may not change the world, but we can change the world of financial technology. And all it takes is a winning mix of drive, talent, and empathy. Our culture celebrates all three.
But enough about us. Let’s talk about you.
About the role
We’re looking for a Senior SecOps Engineer to take ownership of security operations at Flagstone. That covers everything from alert triage and incident response through to detection engineering and continuous improvement of how our SOC works.
This is a hands-on role that sits right at the operational end of security. You’ll spend real time in the alert queue, as well as building the detections and automation that make it better. You’ll be right in the middle of complex investigations and P1s, while also shaping how the function operates. You’ll also own our relationship with our managed SOC provider, setting the standards they work to rather than simply receiving their output.
About the team
You’ll sit within Security Engineering, reporting to our Security Team Leader. In this role you’ll own detection, triage and incident response, and act as the technical counterpart to our managed SOC provider. That means directing their scope, holding them to clear detection and response standards, and keeping ownership of anything escalated or high severity in house.
Does this sound like you?
You’re an engineer at heart. You’d rather write the detection than describe it, and you treat detections and automation like any other engineering work: version controlled, tested and documented. You’re the go to expert when something serious happens, and you can explain security risk just as clearly to engineers as to senior stakeholders.
You’re curious about new technology, AI included, and you have a clear view on where it genuinely helps and where it introduces risk.
What you’ll do
You’ll take ownership of our SOC operations and report on their performance and health to stakeholders across the business. You’ll run investigations and incident response for complex or high severity alerts, managing parallel workstreams, keeping stakeholders informed and running post incident reviews through to real changes in detections or process.
You’ll own the detection engineering backlog, building, tuning and retiring detections across Microsoft Sentinel and Defender, mapped to a coverage model such as MITRE ATT&CK. You’ll turn threat intelligence into detection logic and hunting activity, and drive our automation and SOAR maturity by building Logic App playbooks that reduce manual effort without losing judgement on the nuanced cases.
You’ll manage our managed SOC relationship day to day: defining scope and escalation criteria, reviewing performance against SLAs and acting as the technical escalation point for anything they can’t close. You’ll keep playbooks, escalation paths and documentation in shape so the practice scales beyond any one person, and you’ll track metrics like triage time, false positive rate and coverage gaps to drive continuous improvement.
You’ll also explore and introduce AI assisted tooling into SOC workflows, such as triage and enrichment copilots, detection authoring and alert summarisation, where it clearly makes a difference, with sensible boundaries on where human judgement stays in the loop.
What you’ll bring
- 5+ years in a SOC, security operations or detection engineering role, with progression into a senior IC position
- Hands-on experience with Microsoft Sentinel and Defender, building detections rather than just consuming alerts
- Experience owning a Sentinel platform, including data connectors, ingestion and SIEM integrations
- Experience running investigations and incident response, including communicating with stakeholders under pressure
- Experience building SOAR and automation content (for example Sentinel Logic Apps), including monitoring for silent failure
- Experience owning or building a detection-as-code pipeline, with detections managed in Git and deployed through CI/CD
- Scripting skills e.g. Python or PowerShell
- A strong grasp of attack patterns and MITRE ATT&CK, and how to turn them into a detection coverage model
- Experience directing a managed or outsourced SOC or MDR provider, setting scope, SLAs and escalation criteria
- Practical experience applying AI or LLM tooling to SecOps work
- Strong communication and stakeholder skills, with the confidence to influence senior stakeholders
- Critical thinking and a real curiosity for new technologies and frameworks
It would be great if you also have
- Experience in regulated financial services
- Exposure to identity centric detection (Entra ID) and cloud native threat detection
- GCIH, GCFA or an equivalent hands-on IR or detection certification
- Links to the SOC and detection engineering community, through conferences, speaking or open source detection content such as Sigma rules
How we reward you:
At Flagstone, the benefits extend beyond false gifts like “fruit and snacks”. Instead, we invest in your health, wealth, and professional development. Here’s a selection of our benefits:
- Hybrid working - Spend at least 1 day a week with your team in our collaborative London office
- Competitive bonus scheme - designed to reward and recognise high performance
- Flexible benefits budget - a pot to fund meaningful benefits for you, whether it's hormone or fertility testing, cancer screening, neuro-diversity coaching or something that matters for you.
- A range of salary sacrifice options to help you make tax efficient savings on electric cars, nursery schemes, home and tech goods.
- Around the World scheme - 3 months work from anywhere scheme
- Mental wellbeing support – Access therapy and mental health sessions through Spill
- Learning and development – £1,000 personal development budget to help you grow in your role.
- Private health care - Enjoy all the benefits AXA has to offer, including reduced gym memberships and medical history disregarded
- Medical cash plan - To help you with the costs of dental and optical expenses
- Life insurance and Income Protection- four times your annual salary for peace of mind
- Matched pension contributions up to 5%
- 25 days holiday - plus bank holidays, well-being days and volunteering days
- Enhanced Parental Leave – enhanced maternity, paternity and adoption pay.
All are welcome.
At Flagstone, we’re assembling a diverse team that defies our industry’s norms. Think this role could suit you? We encourage you to apply, no matter your background.
