Detection and Response Lead

About us Information Services Division (ISD) is the primary provider of IT services to UCL. We support and enhance learning, teaching, research and administrative processes by providing information- and technology-related services to over 50,000 staff and students of UCL and associated institutions. Our ambition is to be the leading IT services group in the Higher Education (HE) sector and we are growing our team's capability in experience/UX, agile development, security, cloud, service management and partnering. We are modernising our technology foundations, digitising the processes of the university to transform experience for students and staff, and partnering across the university to drive differentiation in UCL education and research. UCL boasts a track record of ground-breaking research that transforms the lives of people around the world. Our teams provide dedicated, specialist support throughout the research and innovation lifecycle to help sustain and advance UCL's position as a world-class, research-led university.

About the role Within ISD, this post is in the Information Security Group, which leads on all aspects of security at UCL. The role sits within Security Operations, which is responsible for security monitoring, incident response, vulnerability management and threat intelligence. You will lead UCL's Detection and Response function, with responsibility for security monitoring, alert triage, investigations and security incident response. You will provide calm and accountable leadership during security incidents, develop the team's capabilities, and ensure that effective processes, tooling, metrics and escalation arrangements are in place. Working closely with colleagues across Security Operations and the wider university, you will identify and address gaps in UCL's detection and response capability, maintain and improve incident response plans and playbooks, and coordinate exercises to test UCL's readiness. You will also build trusted relationships with senior stakeholders, service providers, government bodies and law enforcement, translating complex technical issues into clear operational and risk-based advice.

About you As the ideal candidate you will have a mix of the following skills and experience:

• Significant experience leading or managing security operations, SOC, detection and response, or incident response services in a complex organisation.
• Strong knowledge of security monitoring, alert triage, investigation workflows, incident declaration, incident response coordination and post-incident improvement.
• Experience working with relevant security tooling and platforms, such as SIEM, SOAR, EDR, NDR, identity protection, CSPM, CTEM and specialist incident response or forensic tools.
• Experience developing and improving incident response plans, playbooks, runbooks, exercises and operational process documentation.
• The ability to provide calm, decisive and evidence-based leadership during security incidents, including making timely decisions when information is incomplete.
• Experience leading, developing and supporting multidisciplinary technical teams, setting clear objectives and building capability, resilience and a culture of continuous improvement.
• Strong stakeholder management and communication skills, with the ability to explain technical security issues, operational impacts and risks to technical and non-technical audiences.
• Experience using metrics, evidence and operational data to improve services, prioritise risk and report outcomes to senior stakeholders.
• The ability to work collaboratively across internal teams, external suppliers and specialist partners to resolve telemetry, tooling, process and capability gaps.

What we offer As well as the exciting opportunities this role presents, we also offer some great benefits some of which are below:

• 41 Days holiday (27 days annual leave 8 bank holiday and 6 closure days) Additional 5 days' annual leave purchase scheme
• Defined benefit career average revalued earnings pension scheme (CARE)
• Cycle to work scheme and season ticket loan
• Immigration loan
• Relocation scheme for certain posts
• On-Site nursery
• On-site gym
• Enhanced maternity, paternity and adoption pay
• Employee assistance programme: Staff Support Service
• Discounted medical insurance Visit https://www.ucl.ac.uk/work-at-ucl/rewards-and-benefits to find out more. Our commitment to Equality, Diversity and Inclusion As London's Global University, we know diversity fosters creativity and innovation, and we want our community to represent the diversity of the world's talent.