Detection and Response Lead

About us

Information Services Division (ISD) is the primary provider of IT services to UCL. We support and enhance learning, teaching, research and administrative processes by providing information- and technology-related services to over 50,000 staff and students of UCL and associated institutions.

Our ambition is to be the leading IT services group in the Higher Education (HE) sector and we are growing our team’s capability in experience/UX, agile development, security, cloud, service management and partnering. We are modernising our technology foundations, digitising the processes of the university to transform experience for students and staff, and partnering across the university to drive differentiation in UCL education and research.

About the role

Within ISD, this post is in the Information Security Group, which leads on all aspects of security at UCL. The role sits within Security Operations, which is responsible for security monitoring, incident response, vulnerability management and threat intelligence.

You will lead UCL’s Detection and Response function, with responsibility for security monitoring, alert triage, investigations and security incident response. You will provide calm and accountable leadership during security incidents, develop the team’s capabilities, and ensure that effective processes, tooling, metrics and escalation arrangements are in place.

Working closely with colleagues across Security Operations and the wider university, you will identify and address gaps in UCL’s detection and response capability, maintain and improve incident response plans and playbooks, and coordinate exercises to test UCL’s readiness.

About you

As the ideal candidate you will have a mix of the following skills and experience:

• Significant experience leading or managing security operations, SOC, detection and response
• Strong knowledge of security monitoring, alert triage, investigation workflows, incident declaration, incident response coordination and post-incident improvement.
• Experience working with relevant security tooling and platforms, such as SIEM, SOAR, EDR, NDR, identity protection, CSPM, CTEM and specialist incident response or forensic tools.
• Experience developing and improving incident response plans, playbooks, runbooks, exercises and operational process documentation.
• The ability to provide calm, decisive and evidence-based leadership during security incidents
• Experience leading, developing and supporting multidisciplinary technical teams
• Strong stakeholder management and communication skills

What we offer

As well as the exciting opportunities this role presents, we also offer some great benefits some of which are below:

• 41 Days holiday (27 days annual leave 8 bank holiday and 6 closure days) Additional 5 days’ annual leave purchase scheme
• Defined benefit career average revalued earnings pension scheme (CARE)
• Cycle to work scheme and season ticket loan
• Immigration loan
• Relocation scheme for certain posts
• On-Site nursery
• On-site gym
• Enhanced maternity, paternity and adoption pay
• Employee assistance programme: Staff Support Service
• Discounted medical insurance

Visit https://www.ucl.ac.uk/work-at-ucl/rewards-and-benefits to find out more.

Our commitment to Equality, Diversity and Inclusion

As London’s Global University, we know diversity fosters creativity and innovation, and we want our community to represent the diversity of the world’s talent.

We are committed to equality of opportunity, to being fair and inclusive, and to being a place where we all belong. We therefore particularly encourage applications from candidates who are likely to be underrepresented in UCL’s workforce.

These include people from Black, Asian and ethnic minority backgrounds; disabled people; LGBTQI+ people; and for our Grade 9 and 10 roles, women.

Customer advert reference: B01-05648

Advert information