Security Operations Lead, Flo

• Hands-on experience with common security operations tools and technologies
• Cloud security experience (AWS & GCP)
• Experience of using Terraform
• Experience of gathering relevant threat intelligence and producing actionable insights
• Extensive experience of security log ingestion and alert curation
• Incident response / incident management expertise
• Understanding and respect for the need for strong security and data protection measures and robust governance required to protect sensitive data
• Excellent collaboration and communication skills

Desirable

• The SecOps Lead is an exciting new role that will drive forward the development of Flo Health’s Security Operations, to ensure the company maintains robust cyber security detection and response capabilities that scale as Flo continues to grow
• You will build on Flo’s logging and monitoring / SIEM maturation strategy, working with the VP of Security to further develop Flo’s SecOps target operating model, including tooling, processes and resources
• Collaborating closely with fantastic security colleagues in cloud and product security, you will lead and form part of the virtual (decentralized) Security On Call Team, providing 24/7 on-call coverage on a rotational basis (typically 1 week per month) responding to security alerts to keep our users’ data secure
• Leading the design and development of Flo’s security monitoring programme
• Working with critical system owners and cloud security engineers to ensure required log data is collected and ingested into the SIEM (Elastic)
• Tuning and curating alerts to reduce false positives, addressing specific use cases
• Developing appropriate Secops telemetry and KPIs
• Monitoring for attacks, intrusions, and unusual and unauthorized activity
• Investigating security alerts and responding to any threats
• Manage security incidents, including post-incident reviews
• Using advanced analytic tools to determine emerging threat patterns and vulnerabilities
• Gathering, curating and communicating relevant threat intelligence information
• Working in close collaboration with the IT Team to design and implement appropriate business user/ endpoint controls
• Supporting and advising business stakeholders in relation to cyber security issues
• Generating reports for both technical and non-technical staff and stakeholders
• Close SIEM coverage gaps
• Improve incident detection and response KPIs
• Reduce security alert false positives
• Develop Flo’s SecOps operating model and roadmap