Head of Security Operations
You will own security operations at Sokin: build it, run it, and grow it. That covers detection strategy, incident response and management, vulnerability management, and identity governance, with day-to-day L1/L2 triage and a chunk of Sentinel content maintenance handled by an outsourced SOC/MSSP. The exact MSSP scope is still being finalized as part of a broader investment case, so you'll help shape the split between what the MSSP owns and what stays in-house as the function matures, rather than inheriting a fixed operating model.
This is not a queue-management role, and it's not a role where you sit above an MSSP and relay their output. You direct the detection strategy and hold the MSSP to a quality bar on the content they build and tune, you own L3 investigation and forensics, you run vulnerability management as a program rather than a scanner subscription, and you own identity governance and incident management end to end. Where the MSSP can't cover something - bespoke detections, payments/fraud-specific logic, judgment calls in an active incident - that's you.
About Us
Sokin is a next-generation B2B financial services provider, enabling businesses to make and receive global payments with greater speed, lower cost, and total transparency.
Our mission is simple: we’re simplifying global business - so businesses thrive wherever they choose to grow. We deliver services across:
• Global payments and receivables
• Foreign Exchange (FX)
• Treasury management
• Finance reconciliations
We are rapidly expanding, with established presence in EMEA, APAC, and North America, backed by a strong global infrastructure and industry-leading partners, we are redefining how businesses move money worldwide.
Our clients span industries from sports and entertainment to logistics and travel, and our community is growing rapidly. As we continue to expand, we’re building a team of exceptional people who share our ambition to transform the future of global payments.
What you'll do
Detection strategy & engineering
Define and maintain the detection strategy, mapped to MITRE ATT&CK and iterated against real incidents and threat intel, not left as a static framework exercise
Set the standards and review bar for Microsoft Sentinel content (detection rules, analytics, workbooks, Logic Apps playbooks) whether authored by the MSSP or in-house, and own detection-as-code practices - version control, peer review, testing - for that content
Own the detections the MSSP can't reasonably build: bespoke, payments/fraud-specific, or identity-driven logic
Onboard new log sources and systems into the detection pipeline as the platform evolves, and integrate Defender XDR, Wiz, Cloudflare, Zscaler, and other tooling as it's added, including email/data security telemetry (Defender for O365, DLP) once in scope
Consume threat intelligence (feeds, ISACs, sector-specific sources) and translate it into detection and hunting priorities rather than treating it as a subscription nobody reads
Build and maintain SOAR automation for alert enrichment, triage, and response actions, so the function scales with the estate rather than with headcount
MSSP & outsourced SOC
Own the MSSP/outsourced SOC relationship end to end: SLAs, triage quality, playbook tuning, and contract renewal or rescoping as the function's needs change
Actively shape the boundary between MSSP and in-house scope as the team and platform mature, rather than treating today's split as permanent
Incident response & management
Lead incident response: own L3 investigation and forensic analysis across cloud and endpoint, working from MSSP escalations and your own detections
Own incident management end to end alongside the CISO - major incident declaration, exec/board notification, and coordination with legal/comms on regulatory notification clocks (GDPR 72-hour, DORA incident classification and reporting) - not just the technical investigation
Develop and maintain incident response playbooks and runbooks, and test them regularly through tabletop exercises rather than leaving them filed and unverified
Drive post-incident reviews and RCAs, and feed lessons back into detection and playbook updates
Vulnerability management & identity governance
Own vulnerability management as a program: scanning coverage across cloud, endpoint, and applications, risk-based prioritization, remediation SLAs, and exception handling with named owners
Own identity governance within security operations: privileged access monitoring, access anomaly detection, joiner/mover/leaver assurance from a security lens, and identity-related detection coverage across Entra ID/Okta and cloud IAM
Metrics, team, and reporting
Own MTTD, MTTR, and other operational metrics: baseline them, track them, and drive them down
Manage the security operations team, including direct line management of the Security Analyst, and build the hiring/leveling plan as team and MSSP scope evolve
Manage SOC systems, tooling, and processes end to end, including budget and licensing conversations with the CISO
Support the CISO on incident communication, board/customer reporting, and post-incident reviews
What we're looking for
Essential:
Deep Microsoft Sentinel experience: KQL proficient, able to author and critically review detection rules, workbooks, and playbooks, even where day-to-day content maintenance sits with a third party
Experience onboarding new data sources into a SIEM and scaling detection coverage as an environment grows
Hands-on incident response and digital forensics experience across cloud and endpoint, including running an incident through containment, eradication, and RCA, not just triage
Experience sharing ownership of the incident management process: major incident declaration, exec communication, and regulatory notification timelines (GDPR, DORA, or equivalent), typically alongside a CISO or equivalent
Applied MITRE ATT&CK knowledge used in detection engineering, not just framework familiarity
Experience running or managing vulnerability management as a program: tooling, prioritization, remediation tracking, and reporting
Working knowledge of identity governance and access risk (privileged access, JML, IAM/entitlement review) as it applies to security operations
Experience managing an MSSP/outsourced SOC relationship, including SLAs, contract or scope negotiation, and holding a third party accountable for quality
Experience running tabletop exercises or equivalent IR plan testing
Cloud security telemetry: AWS CloudTrail, Azure Monitor, GCP audit logs
Strong written communication for incident reports and RCAs aimed at non-technical readers
Nice to have:
Prior people management or mentoring experience in a SOC or detection engineering team
Experience with Defender XDR (Defender for Endpoint, Identity, Cloud Apps)
Wiz or equivalent CSPM integration into detection pipelines
Fintech, payments, or regulated environment background
Formal threat intelligence platform experience (beyond consuming feeds)
Python or PowerShell for automation
Certifications (valued, not required): SC-200, AZ-500, GCIA, GCIH, GCFE, GCFA, or equivalent applied experience
Why this role
Real ownership of security operations from day one, with direct CISO access and a mandate to define - not just inherit - the split between an outsourced SOC and in-house engineering as the function scales. You'll build detection strategy, IR, vulnerability management, and identity governance as one coherent function, with real influence over how the operating model is shaped.
Please note, candidates will need to have the right to work in the jurisdiction that they are looking to work in.
The main responsibilities of this role are outlined above; however, this description is not exhaustive, and the job holder may be required to undertake additional duties from time to time to ensure the smooth running of the department. The role may require some working outside our normal working hours.
