CDCC Automation Lead

We are looking for a high-impact security engineering leader to own and scale ABG's SOC (CDCC) engineering and automation ecosystem. You will drive end-to-end ownership of SOAR, Detection Engineering, Log Onboarding, and UEBA, ensuring higher detection accuracy, faster response times, and strong automation across the security stack. This is a platform + engineering + governance role, not operations focused on building scalable, automated, and audit-ready security systems.

The candidate will have responsibilities across the following functions:

SOAR and Automation (Core):

• Define and drive the SOAR roadmap, playbooks, and automation strategy.
• Build end-to-end automated response workflows across SIEM, EDR, ITSM, email, and threat intel.
• Ensures safe automation with guardrails, approvals, and audit controls.
• Track impact: MTTR reduction, automation coverage, analyst productivity.

Detection Engineering:

• Owndetection lifecycle: use-case build, deploy, tune, and retire.
• Map detections to MITRE ATT& CK + risk-based prioritisation.
• Drive false-positive reduction + detection efficacy.
• Enable tight integration between detections and SOAR playbooks.

Log Engineering and Data Quality:

• Own enterprise log-onboarding strategy.
• Standardise parsing, normalisation, and data quality frameworks.
• Ensure complete, accurate, and real-time telemetry ingestion.
• Buildlog inventory and monitoring for ingestion health.

UEBA (User and Entity Behaviour Analytics):

• LeadUEBA programme: onboarding, baselining, tuning.
• Build use cases for insider threats, compromised identities, and privilege misuse.
• Integrate UEBA signals into SOC workflows and automation.

Security Dashboards and Reporting:

• Build executive + operational dashboards across SIEM/SOAR/UEBA.
• Ensure accurate metrics, audit-ready reporting, and drill-down workflows.
• Enable real-time insights for leadership and incident response.

Requirements:

• Strong experience in SOC engineering/security engineering (not pure SOC ops).
• Hands-on with SOAR, SIEM, and detection engineering.
• Experience in automation frameworks and playbook development.
• Deep understanding of log pipelines, parsing, and normalisation.
• Exposure to UEBA / behaviour analytics systems.
• Strong grasp of MITRE ATT& CK and threat detection frameworks.

Good to Have:

• Experience with EDR and threat intelligence platforms.
• Knowledge of cloud security (AWS/Azure/GCP).
• Scripting: Python/automation tooling.
• Exposure to data engineering/pipelines.

Qualifications:

• Bachelor's in Computer Science/Engineering (or related field).
• 7+ years' experience.