Security Operations Engineer

At London Stock Exchange Group, we deliver critical financial markets infrastructure and data services in a highly regulated, technology-led environment. Our Security Operations teams protect that environment through monitoring, incident response, intelligence, engineering, automation and operational insight.

Security Operations & Fusion Management is expanding its engineering capability to improve how operational information is collected, analysed, automated and reported. We are looking for someone who enjoys solving problems with data and technology and can transform complex information into meaningful insight and measurable improvements.

This role sits at the intersection of engineering, automation, analytics and reporting. The position is responsible for retrieving, manipulating and analysing large and complex datasets from across the security estate, transforming raw information into trends, trends into insight and insight into actions that improve operational effectiveness, decision-making and risk management.

The role also supports the continued evolution of the Security Fusion Centre, helping multiple security disciplines work more effectively through shared platforms, automation, data and reporting. Working alongside stakeholders from Cyber Security, Physical Security, Social Media Intelligence, Financial Crime and other functions, the successful candidate will help identify opportunities, shape requirements and support the delivery of capabilities that improve collaboration, visibility and operational outcomes.

Working with technologies such as SIEM, SOAR, APIs, automation platforms and enterprise reporting tools, this role is responsible for developing dashboards, reporting products, integrations and SOAR workflows that reduce manual effort, improve visibility and provide stakeholders with trusted, actionable information.

What you will help us do
Engineer and improve operational capability

Help design, build and enhance solutions that improve how Security Operations and the Security Fusion Centre collect, process and use information. Responsibilities include integrating platforms, onboarding new data sources, automating manual activities and developing scalable solutions that improve operational effectiveness across the Group.

Working across SIEM, SOAR, APIs, automation platforms and enterprise reporting tools, the role supports the integration of people, processes and technology through reliable and well-engineered solutions.

Transform data into insight

Work with large and complex datasets from across the security estate, using tools such as Splunk, Excel and other analytics platforms to identify trends, understand performance and uncover opportunities for improvement.

Reporting, automation and operational capabilities will be developed to improve visibility of performance, highlight opportunities for optimisation and support informed decision-making. Success in the role requires the ability to move confidently from data, to trends, to insight and ultimately to action.

Enable Security Fusion operations

Support the continued evolution of the Security Fusion Centre by enabling multiple security disciplines to work more effectively through shared platforms, automation, reporting and data-driven decision-making.

Close partnership with stakeholders across Cyber Security, Physical Security, Social Media Intelligence, Financial Crime and other operational teams is central to the role, helping to shape requirements and deliver capabilities, in partnership with the Automation & Analytics team, that improve collaboration, visibility and operational outcomes across SOAR and SIEM platforms.

Deliver solutions that people use

Work directly with stakeholders to understand challenges, shape requirements and develop practical solutions that address genuine business needs.

The role contributes to the creation of trusted, scalable and intuitive dashboards, workflows, reporting products, integrations and automations aligned with Group technology, security and engineering standards.

Take ownership and drive continuous improvement

Take responsibility for assigned deliverables and workstreams, managing activity through discovery, design, build, testing and implementation whilst working collaboratively with colleagues across Security Operations and Technology.

We value individuals who are proactive, curious and improvement-focused. A culture of continuous improvement encourages challenge of inefficient processes, identification of automation and analytics opportunities, and innovation through data, engineering, automation and AI.

What we are looking for
Core experience

• Experience in cyber security, engineering, technology, analytics, computer science or a related discipline, gained through education, professional experience or equivalent practical application.
 • Experience working with Splunk or another enterprise SIEM platform, including searching, reporting, dashboards and operational analysis.
 • Experience retrieving, manipulating and analysing large or complex datasets using technologies such as Excel, Splunk, SQL, Power BI or similar tools.
 • Ability to interpret technical and operational data, identify meaningful trends and translate findings into actionable insight and recommendations.
 • Familiarity with SOAR platforms, workflow automation, APIs, case management solutions or system integrations.
 • Ability to develop scripts or code using Python, PowerShell, JavaScript or similar languages to support automation, integration and data processing.
 • Experience gathering requirements, understanding operational challenges and contributing to practical technical solutions.
 • Strong verbal and written communication skills, with the ability to explain complex technical concepts clearly to both technical and non-technical audiences.
 • Demonstrated initiative, curiosity and a willingness to take ownership of outcomes and continuous improvement opportunities.
 • A collaborative mindset and ability to work effectively across multiple teams and disciplines.

Useful but not essential

• Experience with Splunk Enterprise Security, Tines, Cortex XSOAR, Swimlane or similar technologies.
 • Experience within Security Operations, Threat Intelligence, Fusion Centres, Fraud, Physical Security, Resilience or Risk functions.
 • Experience supporting data-driven operational, regulatory or management reporting.
 • Knowledge of cloud platforms, enterprise integration patterns or data engineering concepts.
 • Experience developing automation, AI-enabled workflows or analytics solutions.
 • Understanding of software engineering practices including version control, testing and deployment processes.
 • Relevant certifications from providers such as Splunk, Microsoft, ISC2, CompTIA, SANS or Palo Alto Networks.

What success looks like

Success in this role means delivering measurable improvements to how Security Operations uses technology, data, automation and insight.

Success will be measured through the delivery of trusted reporting, scalable solutions and meaningful operational insight that improve decision-making, reduce manual effort and increase visibility across the organisation.

Strong ownership, accountability and a proactive approach to improving processes, platforms and ways of working are key indicators of success. Through innovation, collaboration and engineering excellence, the role contributes to strengthening the capability and effectiveness of both Security Operations and the wider Security Fusion Centre.

We're proud to have been recognised as a Great Place to Work® in India ‘25

Career Stage:

London Stock Exchange Group (LSEG) Information:

Join us and be part of a team that values innovation, quality, and continuous improvement. If you're ready to take your career to the next level and make a significant impact, we'd love to hear from you.

LSEG is a leading global financial markets infrastructure and data provider. Our purpose is driving financial stability, empowering economies and enabling customers to create sustainable growth.

Our purpose is the foundation on which our culture is built. Our values of Integrity, Partnership, Excellence and Change underpin our purpose and set the standard for everything we do, every day. They go to the heart of who we are and guide our decision making and everyday actions.

Working with us means that you will be part of a dynamic organisation of 25,000 people across 65 countries. However, we will value your individuality and enable you to bring your true self to work so you can help enrich our diverse workforce.

We are proud to be an equal opportunities employer. This means that we do not discriminate on the basis of anyone’s race, religion, colour, national origin, gender, sexual orientation, gender identity, gender expression, age, marital status, veteran status, pregnancy or disability, or any other basis protected under applicable law. Conforming with applicable law, we can reasonably accommodate applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs.

You will be part of a collaborative and creative culture where we encourage new ideas. We are committed to sustainability across our global business and we are proud to partner with our customers to help them meet their sustainability objectives. Our charity, the LSEG Foundation provides charitable grants to community groups that help people access economic opportunities and build a secure future with financial independence. Colleagues can get involved through fundraising and volunteering.

LSEG offers a range of tailored benefits and support, including healthcare, retirement planning, paid volunteering days and wellbeing initiatives.

Please take a moment to read this privacy notice carefully, as it describes what personal information London Stock Exchange Group (LSEG) (we) may hold about you, what it’s used for, and how it’s obtained, your rights and how to contact us as a data subject.

If you are submitting as a Recruitment Agency Partner, it is essential and your responsibility to ensure that candidates applying to LSEG are aware of this privacy notice.