Security Monitoring & Detection Engineering Lead

Role summary

Security Monitoring & Detection Engineering Lead is a role at AJ Bell in Manchester, England, United Kingdom (hybrid). Posted 2026-10-15. Experience level: 10+.

Job title

Security Monitoring & Detection Engineering Lead

Company

AJ Bell

Location

Manchester, England, United Kingdom

Work arrangement

hybrid

Category

Software Engineering

Experience level

10+

Date posted

2026-10-15

Job description

Job Description

Help protect the trust behind investing.

At AJ Bell, we believe investing should feel good. For our customers to feel confident about their investments, they need to know that the technology, data and services behind them are secure.

As our Security Monitoring & Detection Engineering Lead, you'll play a critical role in making that possible. You'll be the principal technical authority for our Security Monitoring & Detection Engineering capability, shaping how we monitor, detect and respond to threats across AJ Bell.

This is a senior, hands-on technical role. You'll own the architecture and engineering of Microsoft Sentinel and our wider security monitoring estate, lead complex investigations and technical incident response, and turn real-world adversary behaviour into effective detection and response.

You'll work across Cyber Defence Operations, Technology and our Managed Security Service Provider (MSSP), bringing people, technology and intelligence together to reduce the potential for customer, operational, financial and regulatory harm.

The role would particularly suit an experienced detection engineering, security operations, red-team, purple-team or offensive-security leader who wants to combine deep technical expertise with meaningful leadership and measurable security outcomes.

What you'll do

Set the direction for security monitoring

You'll provide the technical leadership and direction that keeps our monitoring and detection capability effective, relevant and aligned to the threats we face.

Own the technical direction, quality and delivery performance of Security Monitoring & Detection Engineering, translating CDO priorities into a clear roadmap for monitoring, detection, investigation and response.

Lead the architecture, engineering and continued development of our SIEM solution, ensuring the SIEM remains resilient, scalable, cost-effective and aligned with AJ Bell’s technology estate and threat profile.

Define and govern the onboarding of security telemetry across on-premises, Microsoft Azure, AWS and third-party services, ensuring log sources address genuine visibility gaps and provide reliable value for detection and investigation.

Own the detection engineering lifecycle across requirements, design, testing, deployment, tuning, performance assessment and retirement, supported by version control, peer review and controlled release practices.

Build better detection and response

You'll lead the engineering discipline behind our detection capability, continually improving how we identify, investigate and respond to threats.

Lead the development of analytics rules, hunting queries, workbooks and automated investigation and response workflows.

Own the operational effectiveness of security solutions managed by CDO ensuring configurations, integrations, detections and workflows deliver measurable security outcomes.

Drive threat-informed defence with Cyber Threat Intelligence and Cyber Threat Exposure Management, translating relevant threat actors, campaigns, TTPs, IOCs, critical vulnerabilities and attack paths into detections, targeted threat hunts and automated defensive actions.

Identify and deliver appropriate uses of automation and AI across detection engineering, enrichment, investigation and response, measuring the resulting improvement in quality, speed, consistency or coverage.

Lead complex investigations and incidents

When a significant threat emerges, you'll provide the senior technical judgement needed to understand what has happened, contain the threat and reduce its impact.

Act as the senior technical escalation point for complex, ambiguous and high-severity security events, leading investigations through scoping, attack reconstruction, business-impact assessment, containment and resolution.

Experience investigating malicious code, identity compromise, business email compromise, fraud-related intrusion, data exfiltration, cloud compromise or third-party intrusion.

Lead technical response within CIRT during declared cyber incidents, coordinating the internal team, MSSP and relevant technology functions in accordance with the firm’s incident-management processes to contain threats and reduce business impact.

Build and improve investigation and response playbooks for priority threat scenarios, and lead tabletop, purple-team and practical exercises that test detection coverage, technical readiness and coordination with relevant business functions.

Measure and continually improve performance

You'll make sure our security capability is not only technically strong, but demonstrably effective.

Maintain an evidence-based view of service performance through agreed KPIs, KRIs and operational MI, identifying material variations, recurring failure points and capacity constraints, and driving corrective actions through to a measurable outcome.

Maintain an evidence-based view of alert demand, detection quality, MTTA, MTTR, investigation outcomes, service capacity and recurring failure points, using these measures to prioritise and demonstrate improvement.

Lead service reviews with key security vendors and providers, assessing delivery against expected outcomes and driving actions that maximise the contribution of existing investment to CDO’s Detect, Defend and Respond objectives.

Report functional performance, incident readiness, monitoring coverage, material risks and capability constraints to the Head of Cyber Defence Operations, providing clear recommendations and action plans.

Bring people and partners together

You'll help create one joined-up monitoring and response capability across our internal team and MSSP, while developing the technical capability of those around you.

Operate the internal team and MSSP as one integrated monitoring and response capability, setting clear expectations for investigation quality, escalation consistency and response effectiveness, and addressing service issues before they affect security out