Security Engineering Manager - Detection Engineering

What’s in it for you

We’re all about the little helps. That’s why we make sure our Tesco colleague benefits package takes care of you – both in and out of work. Click Here to find out more!

• Annual bonus scheme of up to 20% of base salary
• Holiday starting at 25 days plus a personal day (plus Bank holidays)
• Private medical insurance
• 26 weeks maternity and adoption leave (after 1 years’ service) at full pay, followed by 13 weeks of Statutory Maternity Pay or Statutory Adoption Pay, we also offer 4 weeks fully paid paternity leave
• Free 24/7 virtual GP service, Employee Assistance Programme (EAP) for you and your family, free access to a range of experts to support your mental wellbeing

About the role

As a Security Engineering Manager, you will lead a squad within Detection Engineering, focusing on management, leadership, and delivering cyber defensive outcomes at Tesco. Your primary responsibility is to guide a team of security engineers in developing and implementing security controls that bolster our cyber defence to detect and support response to digital threats, while supporting and integrating with other teams across prevention, operations, and automation.

Your team specialises on Microsoft related security technologies, but also works closely with other technologies from Splunk, Databricks, and those related to deception operations.

Your objective is to safeguard our customers, suppliers, colleagues, networks, systems, applications, and information from cyber-attacks.

You will excel in enhancing security outcomes efficiently and cost-effectively, working with teams that possess a diverse range of skills, from hands-on technical expertise to architectural knowledge. Fostering a culture of innovation and curiosity within your team is essential to this role.

At Tesco, we believe in the power of spending more time together, face to face, than apart. So, during your working week, you can expect to spend 60% of your time in one of our office locations or local sites and the rest remotely. We also recognise that life looks a little different for each of us. Some people are at the start of their careers, some want the freedom to do the things they love. Others are going through life-changing moments like becoming a carer, nearing retirement, adapting to parenthood, or something else. That’s why at Tesco, we always welcome a conversation about flexible working. So, talk to us throughout your application about how we can support.

You will be responsible for

Threat-Led Prioritisation: Evaluates and prioritizes cyber threats to Tesco, analysing machine signals and intelligence and human factors to identify trends and actionable data for threat management.

Secure & Test-Driven Engineering: Proficient in applying industry frameworks (MITRE ATT&CK, NIST CSF, etc), integrating security into the software development lifecycle by applying secure coding practices, utilising test-driven development (TDD) for code reliability, and conducting thorough code reviews to mitigate potential security vulnerabilities.

Intrusion Detection & Analysis: Define and drive procedures to identify detection opportunities, assess risk reduction, and ensure mature detection outcomes, reporting detection quality, coverage and cost where required.

Incident Management, Incident Investigation & Response: Coordination with security operations teams to support incident management, investigation and response activities when required.

Research: Defines research goals, generates innovative ideas, summarizes and disseminates findings, and contributes to organizational security strategy.

Enterprise Technology: Understands Enterprise technology infrastructure, systems, solutions, tools and architecture, including the importance and principles of security, managing incidents, and programming languages.

Development Lifecycle: Understands the end-to-end software development lifecycle, and the processes and checkpoints involved, from planning, designing, building, testing, deploying and maintenance and how this applies to their role.

Delivery Methodologies: Understanding of Agile and other methodologies, including product management frameworks, and of the full product management lifecycle and how different Agile practices can be used.

Relevant Operational skills required:

• Management & Leadership: Effectively manages people, including performance and incentive management, and applies leadership practices to achieve targets and foster an inclusive environment where people feel like they belong.
• Communication & Influencing: Identifying and engaging stakeholders, using a range of techniques (e.g. storytelling, presentations, reports, influencing, negotiation and difficult conversations).
• Data Analytics & Insights: Defining suitable metrics, obtaining and analysing data using the right tools, spotting trends and gaining and explaining insights to influence and enable decisions and measure impact.
• Curiosity & Learning: Reflecting on practice, adapting and challenging assumptions, seeking new ideas and perspectives, and striving to gain new skills and knowledge.
• Embracing & Enabling Change: Need, appetite and potential impacts of change, including embracing the opportunities and challenges of change.
• Strategic Thinking & Problem Solving: Strategic and critical thinking to identify problems and how to apply chosen methodologies to solve problems and create value for the business.
• Finance & Procurement: Finance and procurement processes, and budget management, including estimation, forecasting, planning and tracking spending.

You will need

Essential

• Direct Line Management Responsibilities
• Agile Ways of Working (Scrum, DevOps, Kanban, etc)
• Security Engineering Experience (Detection, Prevention, Automation, etc)
• Common Productivity Tools (Confluence, Miro, Teams, etc)
• Common Development Tools (Jira, GitHub, etc)

Desirable

• Cybersecurity Engineering Management or Leadership
• Microsoft Defender for Endpoint/Identity/Cloud
• Microsoft Sentinel / Splunk Enterprise Security
• Professional Industry Membership (CIISec, BCS, etc)
• Security Certification (ISC2, ISACA, CompTIA, SANS, EC-Council, etc)
• Detection-as-Code / DevOps for SecOps

About us

Our vision at Tesco is to become every customer's favourite way to shop, whether they are at home or out on the move. Our core purpose is ‘Serving our customers, communities and planet a little better every day’. Serving means more than a transactional relationship with our customers. It means acting as a responsible and sustainable business for all stakeholders, for the communities we are part of and for the planet.

Diversity, equity and inclusion (DE&I) at Tesco means that whoever you are and whatever your background, we always want you to feel represented and that you can be yourself at work. In short, we’re a place where Everyone’s Welcome. We’re proud to have been accredited Disability Confident Leader and we’re committed to providing a fully inclusive and accessible recruitment process. For further information on the accessibility support we can offer, please click here.

We’re a big business and we can offer a range of diverse full-time & part-time working patterns across our many business areas, which means that we can find something that works for you.  We work in a more blended pattern -combining office and remote working.  Our offices will continue to be where we connect, collaborate and innovate.