Detection and Response Lead

As well as the exciting opportunities this role presents, we also offer some great benefits some of which are below:

• 41 Days holiday (27 days annual leave 8 bank holiday and 6 closure days) Additional 5 days' annual leave purchase scheme
• Defined benefit career average revalued earnings pension scheme (CARE)
• Cycle to work scheme and season ticket loan
• Immigration loan
• Relocation scheme for certain posts
• On-Site nursery
• On-site gym
• Enhanced maternity, paternity and adoption pay
• Employee assistance programme: Staff Support Service
• Discounted medical insurance

Visit https://www.ucl.ac.uk/work-at-ucl/rewards-and-benefits to find out more.

Within ISD, this post is in the Information Security Group, which leads on all aspects of security at UCL. The role sits within Security Operations, which is responsible for security monitoring, incident response, vulnerability management and threat intelligence.

You will lead UCL's Detection and Response function, with responsibility for security monitoring, alert triage, investigations and security incident response. You will provide calm and accountable leadership during security incidents, develop the team's capabilities, and ensure that effective processes, tooling, metrics and escalation arrangements are in place.

Working closely with colleagues across Security Operations and the wider university, you will identify and address gaps in UCL's detection and response capability, maintain and improve incident response plans and playbooks, and coordinate exercises to test UCL's readiness. You will also build trusted relationships with senior stakeholders, service providers, government bodies and law enforcement, translating complex technical issues into clear operational and risk-based advice.

As the ideal candidate you will have a mix of the following skills and experience:

• Significant experience leading or managing security operations, SOC, detection and response, or incident response services in a complex organisation.
• Strong knowledge of security monitoring, alert triage, investigation workflows, incident declaration, incident response coordination and post-incident improvement.
• Experience working with relevant security tooling and platforms, such as SIEM, SOAR, EDR, NDR, identity protection, CSPM, CTEM and specialist incident response or forensic tools.
• Experience developing and improving incident response plans, playbooks, runbooks, exercises and operational process documentation.
• The ability to provide calm, decisive and evidence-based leadership during security incidents, including making timely decisions when information is incomplete.
• Experience leading, developing and supporting multidisciplinary technical teams, setting clear objectives and building capability, resilience and a culture of continuous improvement.
• Strong stakeholder management and communication skills, with the ability to explain technical security issues, operational impacts and risks to technical and non-technical audiences.
• Experience using metrics, evidence and operational data to improve services, prioritise risk and report outcomes to senior stakeholders.
• The ability to work collaboratively across internal teams, external suppliers and specialist partners to resolve telemetry, tooling, process and capability gaps.