Tesco Insurance • Edinburgh • Apply by 18-Aug-2025
About the role
Serving our customers, communities, and planet a little better every day.
Job Title: Lead Security Ops Manager.
Work Level - 2
Location: Hybrid (Edinburgh/Glasgow/Newcastle-based)
Reporting To: Lead Senior Manager Security Operations
We deal in the personal – from pet insurance for your best friend, and home insurance for peace of mind, to motor insurance for your dream car or travel money for that trip you’ve worked hard for. And that means we always work with heart. Whether we’re helping our customers or looking after our people, you’ll find there’s a warmth and friendliness to everything we do.

KEY SKILLS & EXPERIENCE:

• Strong experience in a SOC environment, ideally in a lead or oversight role.
• Deep understanding of security monitoring, SIEM/SOAR platforms, and incident response.
• Experience working with or managing third-party SOC providers.
• Familiarity with log management, threat hunting methodologies, and detection engineering.
• Knowledge of regulatory and compliance requirements relevant to the UK insurance sector.
• Experience with Endpoint Detection and Response (EDR) tools and their integration into SOC workflows.

DESIRABLE QUALIFICATIONS:

• Certifications such as GCIA, GCIH, GCFA, CISSP, or similar.
• Experience with cloud-native security monitoring (e.g., Azure Sentinel, AWS GuardDuty).
• Familiarity with MITRE ATT&CK, NIST CSF, or similar frameworks.

ROLE PURPOSE:

The SOC Lead will be responsible for overseeing the performance and effectiveness of the outsourced Security Operations Centre (SOC). This role ensures that the third-party provider delivers robust security monitoring, incident response, threat hunting, and log management services. The SOC Lead will drive continuous improvement in detection capabilities, ensure alignment with business risk, and act as the key interface between internal stakeholders and the SOC provider.

KEY RESPONSIBILITIES:

SOC Oversight & Governance

• Act as the primary point of contact for the outsourced SOC provider.
• Monitor and report on SOC performance, ensuring adherence to SLAs and KPIs.
• Conduct regular service reviews and ensure continuous improvement initiatives are implemented.

Security Incident Response

• Oversee the incident response process, ensuring timely triage, escalation, and resolution of security incidents.
• Validate incident reports and ensure appropriate root cause analysis and remediation.
• Coordinate internal stakeholders during major incidents and post-incident reviews.

Use Case Development

• Collaborate with the SOC provider to define and refine detection use cases based on evolving threats and business needs.
• Ensure use cases are aligned with the threat landscape and regulatory requirements.
• Review and approve detection logic and tuning recommendations.

Threat Hunting

• Oversee proactive threat hunting activities conducted by the SOC.
• Ensure threat hunts are hypothesis-driven and informed by threat intelligence and business context.
• Review findings and ensure appropriate follow-up actions are taken.

SOC Processes & Playbooks

• Review and enhance SOC processes, workflows, and response playbooks.
• Ensure documentation is up-to-date and reflects current threat scenarios and business operations.
• Promote consistency and quality in SOC operations.

Log Onboarding & Visibility

• Manage the onboarding of new log sources into the SOC monitoring environment.
• Ensure log data is complete, timely, and relevant for detection and investigation.
• Work with internal teams and the SOC provider to resolve data quality or integration issues.