Security engineer

Pantheon is the WebOps platform for websites that deliver extraordinary results. We believe in putting the magic of the internet in everyone's hands. That's why we're so passionate about helping developers, IT, and marketing develop, test, and release website changes faster and more reliably. Pantheon's core values are Trust, Teamwork, Passion, and Customers First. We value individuality, humour, and balance, and we actively contribute to open-source communities. If you're ready to be the incident authority for a platform that ships critical infrastructure for hundreds of thousands of sites, this is your role.

• Lead response for our most complex and critical incidents end-to-end — data breach scenarios, coordinated attacks, platform-level events. Run the war room, make the severity and containment calls, coordinate Engineering, Legal, and executive stakeholders, and own the blameless post-incident review.
• Define and continuously improve the IR programme the team operates against: severity frameworks, escalation paths, playbooks and runbooks, on-call standards, SLAs, and the continuous-improvement loop that follows every incident. You are accountable for how Pantheon responds, not just that it responds.
• Lead hypothesis-driven threat hunting mapped to MITRE ATT&CK across cloud, endpoint, and identity surfaces, and make sure every hunt and every incident feeds back into higher-fidelity, lower-noise detections in partnership with Security Engineering. Establish the methodology and coverage standards the team measures itself by.
• Set the automation roadmap for triage, enrichment, investigation, and response based on what incidents actually demand. Use AI tools (Claude, LLM workflows) daily to prototype, accelerate investigations, and help build ARES, bringing the operator's judgment that turns automation from a demo into a force multiplier.
• Own governance of Pantheon's Google SecOps (Chronicle) platform - detection coverage, log source strategy, data quality, and cost - while the team handles day-to-day ingestion and connector work. Keep the platform aligned to how we actually detect and respond.
• Mentor analysts and engineers through real incidents and hunts - pairing, review, and tabletop exercises. Set the technical bar for how SecOps investigates, documents, and improves.
• Translate operational reality into risk narratives and programme-level metrics for senior leadership, and represent SecOps in architectural and product discussions.
• Contribute operator judgment to threat intelligence priorities, vendor and tooling evaluations, resilience testing and red/purple team exercises, and partner with GRC on operational evidence for SOC 2, GDPR/NIS2, and related obligations.

• 8+ years in information security with substantial time in security operations, including demonstrated command of major incidents — you can walk us through your methodology (scoping, severity, containment, communication, post-incident review), not just war stories.
• Deep incident response methodology knowledge (NIST 800-61 / SANS PICERL or equivalent, applied in production, not just certified) and a track record of building or materially improving an IR programme: playbooks, severity frameworks, escalation paths, PIR discipline.
• Threat hunting and detection craft: expert working knowledge of attacker tradecraft (MITRE ATT&CK) and proven ability to convert hunts and incidents into detection logic and response procedures.
• AI fluency: you use AI assistants and LLM tooling in your daily workflow today, and you're excited to apply them to investigation and response. If you can use Claude well, you can help us build ARES.
• An engineering mindset: comfortable with Python/Bash scripting, APIs, and cloud-native environments (GCP and/or AWS) — enough to prototype, automate, and hold your own in engineering design discussions. You learn new systems on your feet.
• CISSP (or equivalent depth — CISM, GCIH/GCIA/GDAT-class GIAC) demonstrating breadth across the security domains this role touches.
• Hands-on experience operating an enterprise SIEM (Google SecOps/Chronicle strongly preferred; Splunk, Sentinel, or Elastic acceptable) at governance level — coverage, log strategy, quality — not just query writing.
• Excellent written and verbal communication: you can brief an executive during an incident and write the PIR the team actually learns from.

• Industry competitive compensation and equity plan
• Robust vacation package with 28 days of holiday
• Private medical and dental coverage
• Life and critical illness insurance
• Attractive workplace pension scheme
• Access to Employee Resource Platform
• Top-of-line equipment
• Monthly allowance for wellness, reading, and access to LinkedIn Learning for continued development
• Events and activities, both team-based and company-wide, that inspire, educate, and cultivate