• Manage the security operations (SecOps) team responsible for end-to-end technical and operational security of Canonical's business, including agile threat modeling, table top exercises, intrusion detection and response, forensic analysis and policy determination. • Collaborate with our Organisational Learning and Development team to develop playbooks and facilitate SecOps training across Canonical. • Integrate the team's insights into Canonical's broader software development process. • Share knowledge through public presentations and industry events, and share threat intelligence with the wider community or represent Canonical in sector-specific governance bodies.

• Implement and evolve Canonical's SecOps security standards and playbooks • Analyse and improve Canonical's security architecture • Evaluate, select and implement new security tools and practices • Identify, contain and guide the remediation of security threats and cyber attacks • Grow the presence and thought leadership of Canonical SecOps practice • Contribute to open source threat intelligence initiatives • Drive threat modelling, table top exercises and other SecOps practices across Engineering, IS and Canonical • Develop Canonical SecOps learning and development materials • Publish blog posts, whitepapers and conference presentations • Identify, implement and track SecOps KPIs • Plan and deliver SecOps work in the framework of Canonical's agile engineering practice • Work with Security leadership to present information and influence change

• Provide operational and engineering leadership. • Implement and evolve Canonical’s Security Operations Center. • Design and develop security software and platforms. • Monitor for, identify, respond to, and remediate security incidents. • Assess and improve Canonical’s security controls. • Mentor early-career Security Operations engineers. • Plan and deliver work within Canonical's agile engineering framework. • Contribute to open source security. • Publish blog posts, whitepapers and conference presentations.

• Developing and implementing SIEM solution internally and as well for clients and/or candidates who have strong experience in assessing and implementing SIEM and other operational tools and processes for a Security Operations Centre (SOC) • Develop content for a complex and growing SIEM infrastructure. This includes use cases, dashboards, active channels, reports, rules, filters, trends and active lab sessions. • Use SIEM in the daily operational work which includes but not limited to Administer, operate, manage SIEM platform and regular activities of ensuring the health of log sources, parsers, alerts, reports etc. and enduring that the platform is operating as planned. • Monitor SIEM and other event sources, assess, prioritize, escalate and manage security alerts. • Perform analysis of security, network database and application logs, correlate events and activities to create threat scenarios in order to get ahead of threat actors and reduce the exposure. • Lead the imminent threat/zero-day response function across the environment. • Translate threat intelligence into actionable security across tools such as firewall, IPS and malware detection across multiple security vendor platforms. • Track and resolve security incidents on regular frequencies and collaborate with other teams for resolution and suggest areas for improvement. • Must have some experience building custom connectors/parsers etc. to point devices or IT assets that are not supported out of the box. • Own and operate most important security solutions designed to protect the company from cyber threats and attacks. • Lead in deploying new solutions and technologies to improve the security posture of the company. • Continuous fine-tuning of our security solutions to reduce the occurrence of false positive and false negative alerts. • Working knowledge and experience with the MITRE framework for cyber adversary tactics and techniques Must have working knowledge of any SIEM solution like QRadar, Sentinel, Splunk, Logrythm or Open Source SIEM (Wazuh, ELK)