Detection and Response Lead

Overview

In this role you lead UCL’s Detection and Response function within Security Operations, guiding security monitoring, alert triage, investigations and incident response. You will provide calm, decisive leadership during incidents and shape the team’s capabilities, processes and tooling. Working with cross‑university teams, you’ll improve readiness through playbooks, runbooks and exercises while translating complex security issues for senior stakeholders. This is a mission‑critical role to strengthen UCL’s security posture in a large and dynamic environment.

Pay / Benefits

• 41 Days holiday (27 days annual leave 8 bank holiday and 6 closure days)
• Defined benefit CARE pension scheme
• Cycle to work scheme
• Relocation scheme for certain posts
• On-Site nursery
• On-site gym

Responsibilities

• Lead security operations for detection and response across the university
• Oversee security monitoring, alert triage, investigations and incident response
• Develop and improve incident response plans, playbooks, runbooks and exercises
• Coordinate incident response activities and post‑incident improvements
• Build trusted relationships with senior stakeholders, service providers, government bodies and law enforcement
• Identify gaps in detection/response capabilities and drive improvements in processes and tooling
• Maintain escalation, metrics and governance to demonstrate risk and readiness
• Lead, develop and support multidisciplinary technical teams and foster continuous improvement

Key requirements

• Significant experience leading or managing security operations (SOC/detection and response or incident response) in a complex organisation
• Strong knowledge of security monitoring workflows, investigation processes and incident response coordination
• Experience with security tooling and platforms (e.g., SIEM, SOAR, EDR, NDR, identity protection, CSPM, CTEM)
• Proven ability to develop incident response plans, playbooks and runbooks and run operational exercises
• Calm, decisive leadership during incidents and evidence‑based decision making
• Experience leading multidisciplinary technical teams, fostering capability and resilience
• Strong stakeholder management and ability to explain technical issues to diverse audiences
• Experience using metrics and operational data to improve services and report outcomes

• Calm under pressure
• Effective communication with technical and non‑technical audiences
• Collaborative and cross‑functional mindset
• SIEM
• SOAR
• EDR

…