Security Operations Specialist Contractor

• Operate and support technical security controls, including Rapid7 IDR, Microsoft Defender for Endpoint, email security tooling, vulnerability scanning and related Microsoft security capabilities. 
• Conduct security monitoring, triage and response for day-to-day security events and incidents, including phishing, endpoint alerts, suspicious activity, identity-related alerts and other security events of interest. 
• Use Rapid7 IDR to investigate alerts, review evidence, assess severity, document findings and support escalation where required. 
• Work with the externally managed Security Operations Centre to ensure alerts are appropriately investigated, assessed, documented and escalated. 
• Support the improvement of alert quality, investigation notes, closure rationale, and operational handover information. 
• Maintain and improve playbooks, runbooks and standard operating procedures associated with security alerting, incident triage and response activity. 
• Provide incident response support to assist with containment, eradication and recovery from security incidents. 
• May be required to support major incidents outside normal business hours by prior agreement. 
• Perform threat hunting activity to proactively identify suspicious behaviour, emerging risks and potential security issues. 
• Assess threat intelligence sources for relevance to Monument Re and support defensive activity to mitigate identified threats. 
• Support regular security assessments, vulnerability scans and penetration testing activity where required. 
• Identify security gaps emerging from incidents, alerts, trends or operational activity and support their capture within the appropriate risk or issue management process. 
• Collect and maintain KPIs and KRIs that contribute to periodic security reporting for governance forums. 
• Participate in the technical aspects of internal and external security audits. 
• Support the operation of security controls relevant to DORA and broader operational resilience requirements across Monument Re Group. 
• Stay current with relevant threats, vulnerabilities, attacker techniques and security technologies. 

• Demonstrable hands-on experience in Security Operations, SOC, detection and response, or technical security operations. 
• Essential: current or recent hands-on operational experience using Rapid7 IDR within the last 12 months. 
• Strong experience using Microsoft Defender for Endpoint and broader Microsoft security tooling. 
• Ability to investigate, triage, document and escalate security alerts without requiring significant training on core SOC processes or tooling. 
• Experience working with managed SOC or MDR providers, including alert review, escalation management and operational feedback. 
• Experience of incident response activity, particularly in high-pressure situations requiring sound judgement, clear documentation and appropriate escalation. 
• Strong understanding of security monitoring, endpoint detection and response, phishing triage, identity-related alerts, threat hunting and alert investigation. 
• Experience working in partnership with IT, GRC, Technical Security and other internal colleagues. 
• Experience of working in a regulated environment, ideally financial services. 
• Understanding of DORA and the regulatory expectations associated with operational resilience would be beneficial. 
• High attention to detail, particularly when documenting investigations, alert closure rationale and incident timelines. 
• Able to work independently, prioritise effectively and operate in a fast-moving environment. 
• Good interpersonal, written and verbal communication skills. 
• Excellent English language skills. French language skills would be desirable. 
• Proactive approach with a willingness to improve existing operational processes, documentation and alert handling quality. 

Desirable experience

• Experience using Recorded Future for threat intelligence review, enrichment and defensive activity. 
• Experience using Abnormal Security for email security monitoring and phishing investigation. 
• Experience using Rapid7 IVM or other vulnerability management tooling. 
• Experience with Microsoft Purview, Microsoft Sentinel, Microsoft Entra ID, Defender for Office 365 or wider Microsoft XDR capabilities. 
• Relevant technical security certifications, such as ISC2, SANS GIAC, Microsoft, Rapid7 or other vendor-specific certifications. 
• Experience supporting internal or external audit activity in a regulated financial services environment.