Security Operations Responder

ABOUT THE ROLE

The Tide Security Engineering team is made up of three core areas: Product Security, Identity, Threat Detection & Response

Product Security consists of application and cloud security experts. Their mission is to protect the products we build, covering everything from secure design reviews to threat modelling and penetration testing, ensuring security is embedded from the ground up.

Threat Detection & Response (this role!) focuses on protecting the company by building a robust detection and automation platform. We’re proactive in our defence, constantly hacking ourselves to improve our security posture and staying ahead of emerging threats. Our goal is to make Tide resilient against the ever-evolving threat landscape.

Identity is responsible for managing Tide's staff identity platform, ensuring that access to systems and infrastructure is secure, seamless, and aligned with modern security practices. The team uses strategies like zero trust, multi-factor authentication, and granular role-based access controls to safeguard our internal operations.

While each area has its own focus, collaboration is key - it's why we share the same Slack channel and hold our standups together as one cohesive team, ensuring alignment and seamless communication across all security functions.

As a Security Operations Responder, you’ll be on the front line of defending Tide. Your primary focus is actively investigating threats through our security data lake and SOAR platform – but we don’t want anyone working the same alert by hand twice. Your goal is to make investigation effective at scale: cutting manual effort through automation, and working hand-in-hand with our Detection Engineering team to improve the true positive / false positive efficacy of what lands in the queue.

When the security queue is empty, you’ll be building – automations, enrichment and your own detections. An open mind and a curious approach are key: every investigation is a chance to make the next one faster and sharper.

As a Security Operations Responder, you’ll be:

Investigating and responding to threats (your primary focus)

• Actively triaging and investigating security alerts and threats through our security data lake and SOAR platform, across AWS, GCP, SaaS (such as Google Workspace and Okta), internal applications and employee endpoints (Windows, macOS).
• Driving every investigation to a clear, well-evidenced outcome – establishing scope, impact and root cause, and taking containment and remediation actions quickly and confidently.
• Leading the response to complex or high-severity incidents where needed, coordinating across security, IT and engineering teams through containment, remediation and recovery.
• Documenting investigations clearly and consistently, and contributing to the runbooks and investigation standards the whole team works to.

Scaling investigation through automation & Improving detection efficacy 

• Reducing manual investigation by building SOAR playbooks, security automations and services – from data enrichment and context gathering through to automated response, such as removing phishing emails from employee mailboxes. We want you to run with the “anything is possible” mantra.
• Spotting repetitive work in the queue and turning it into automated workflows, so the team’s time goes on the investigations that genuinely need human judgement.
• Identifying gaps in log sources, parsing and enrichment in the data lake, and working to close them so investigations have the visibility they need.
• Feeding investigation outcomes back to the Detection Engineering team – flagging noisy rules, tuning false positives and highlighting coverage gaps – to continuously improve TP/FP efficacy.
• Tracking investigation metrics (such as MTTD, MTTR, TP/FP rate and automation coverage) and using them to prioritise where to improve next.

Building when the queue is clear

• Writing, testing and shipping your own detections alongside Detection Engineering, following our test-driven, detections-as-code practices.
• Proactively hunting for sophisticated threats across our infrastructure, using threat intelligence and lessons from past investigations to stay ahead of attackers.
• Building or enhancing internal tools that streamline investigation, improve data visibility and increase response efficiency.
• Sharing knowledge and mentoring other members of the team, raising the bar for how we investigate and respond.

WHAT WE ARE LOOKING FOR

• Significant hands-on experience in security operations, incident response or threat investigation, ideally in a cloud-native environment.
• Strong investigative instincts and log analysis skills at scale, with the ability to query a security data lake or SIEM fluently – strong knowledge of one of the following: Splunk, Scanner, Sentinel, SecOps.
• Strong understanding of modern attack and defence techniques which apply to Cloud (AWS, GCP), SaaS (such as Google Workspace and Okta) and desktop (Windows and macOS) environments, and the ability to map activity to frameworks such as MITRE ATT&CK.
• Strong experience in security automation, from writing scripts (e.g. Python) to creating end-to-end automated workflows. Familiarity with SOAR platforms and automating investigation and response tasks.
• Experience writing or tuning detections, and a clear view of what separates a high-fidelity alert from a noisy one.
• Calm, methodical judgement during live incidents, including knowing when and how to escalate.
• An open mind and a curious approach – you enjoy pulling on threads, and you don’t stop at “false positives” without understanding why.
• Hands-on attitude and the ability to drive solutions to completion.
• Passion for passing on knowledge to fellow colleagues.
• Excellent spoken and written communication skills, including clear investigation write-ups for both technical and non-technical audiences.
• Bonus points if you have a repository showcasing automations, detections or tooling you’ve built.

WHAT YOU’LL GET IN RETURN

Our location-specific employee benefits are designed to cater to the unique needs of Tideans: 

• Competitive Compensation – competitive salary.
• Time Off – Generous annual leave on top of bank holidays.
• Parental Leave – Paid maternity, paternity, and adoption leave to support your family journey.
• Sabbatical – Extended unpaid and paid leave options after completing milestone years with Tide.
• Health Insurance – Private health insurance with Bulgaria Zdrave, including extra dental care.
• Mental Wellbeing – Access to therapy sessions, courses, meditations, and workshops.
• Volunteering & Development Days – Paid days annually for volunteering or personal growth.
• Learning & Development – Annual budget for books, courses, coaching, and more.
• WOO (Work Outside the Office) – Work from abroad for up to 90 days annually.
• Home Office Setup – Contribution towards setting up your home office.
• Laptop Ownership – Keep your old laptop and get a new one when it’s time for a replacement.
• Fully Covered Multi Sports Card – Granting access to hundreds of gyms and pools across Bulgaria.
• Monthly Food Vouchers – Monthly food vouchers to enjoy your favorite meals with Edenred +.
• Snacks & Meals – Daily breakfast spread with all-day coffee, tea, and juices.