Security Operations Lead

River Island is a UK high-street and omnichannel apparel retailer trading across 1800+ stores, a major distribution centre, head offices, and a growing ecommerce platform. As the business modernises its digital footprint, it is strengthening in-house security operations capability to complement its existing outsourced Security Operations Centre (SOC).

The Security Operations Lead owns day-to-day security operations delivery and acts as the primary internal control point across both first-line (operational security execution and tooling) and second-line (oversight, assurance, and governance of the security control environment) accountabilities. This is a hybrid, hands-on role suited to someone who can both operate security tooling directly and hold a third-party SOC provider to account against contracted service levels and outcomes.

The role sits within a lean Information Security function and is central to River Island's ability to detect, triage, and respond to threats across stores, ecommerce (including Storefront API/headless platforms), distribution, and corporate estate - while managing the operational relationship with the outsourced SOC.

Key Accountabilities

1. Security Operations Delivery

• Own the operational delivery of security monitoring, detection, and response capability across corporate, retail, distribution, and ecommerce environments.
• Act as the internal escalation and coordination point for security alerts, incidents, and investigations raised by the outsourced SOC, ensuring timely triage and remediation.
• Operate and tune in-house security tooling (e.g. vulnerability scanning, endpoint detection, exposure management, identity/access monitoring) to complement SOC-delivered detection.
• Lead incident response execution: contain, investigate, and coordinate recovery for security incidents, following documented playbooks, and drive post-incident lessons-learned activity.
• Coordinate vulnerability management end-to-end - from detection and prioritisation through to remediation tracking with Technology, Ecommerce, and Infrastructure teams.
• Support patching, hardening, and configuration management activities across store systems, cloud platforms, and the ecommerce stack.
• Maintain and test incident response runbooks, tabletop exercises, and escalation paths, including out-of-hours coverage arrangements with the SOC.

2. Outsourced SOC Management and Oversight

• Act as the primary relationship and performance owner for the outsourced SOC provider, holding them accountable to SLAs, use-case coverage, detection efficacy, and reporting quality.
• Chair or contribute to regular SOC service reviews, tracking key metrics such as mean time to detect (MTTD), mean time to respond (MTTR), false-positive rates, alert volumes, and coverage gaps.
• Define and continuously refine detection use cases and log source onboarding with the SOC to ensure coverage keeps pace with the retail estate, ecommerce releases, and cloud changes.
• Provide independent assurance that SOC-reported findings, incident closures, and control effectiveness claims are accurate and evidenced - challenging and validating rather than simply accepting vendor reporting.
• Own the governance of the SOC contract from a security-operations lens: reviewing scope, escalation matrices, data handling, and change requests as the business or threat landscape evolves.
• Ensure clear ownership of assets, logs, and detection logic remains with River Island, avoiding vendor lock-in or loss of institutional knowledge.
• Feed SOC performance, risk exposure, and control gaps into the Information Security Risk Register and executive/committee reporting.

3. Governance, Risk, and Reporting

• Define and report security operations KPIs/KRIs (detection coverage, incident volumes and trends, remediation SLAs, SOC performance) to the Head of Information Security and relevant governance forums (e.g. GDPR Steering Committee, security committees).
• Support compliance activities across PCI DSS, UK GDPR, and ISO 27001/NIST CSF-aligned control requirements as they relate to operational security and monitoring.
• Maintain evidence and documentation to support internal and external audits, penetration tests, and regulatory reviews.
• Partner with Legal, DPO, and Risk teams on incident notification obligations and data breach response.

4. Cross-Functional Partnership

• Work closely with Ecommerce/Storefront API, Infrastructure, Retail Technology, and Distribution Centre teams to ensure monitoring coverage extends across all channels - stores, web, app, and warehouse systems.
• Partner with the security and tech Engineers on penetration testing, red-teaming, and remediation coordination.
• Support BYOD/MDM security monitoring and access governance activities (RBAC, joiner/mover/leaver, MFA, privileged access, Identity posture) from an operational assurance standpoint.
• Represent security operations in change advisory and project forums to ensure new initiatives are onboarded into monitoring scope pre-go-live.

Essential Experience and Skills

• Proven experience in a security operations, SOC management, or similar hands-on operational security role, ideally within retail, ecommerce, or another complex multi-channel environment.
• Demonstrable experience managing or governing an outsourced/managed SOC or MSSP relationship, including SLA management and detection use-case development.
• Strong working knowledge of SIEM, EDR, vulnerability management, and exposure management tooling.
• Practical incident response experience, including leading or coordinating live incident investigations.
• Familiarity with the three lines of defence model and ability to operate credibly across both first-line delivery and second-line oversight.
• Understanding of PCI DSS, UK GDPR, and NIST CSF control frameworks as applied to operational security.
• Comfortable working in a lean team, prioritising pragmatically, and balancing protection with business/customer experience.
• Strong stakeholder management skills, able to challenge a third-party provider constructively while maintaining an effective working relationship.

Desirable

• Experience securing ecommerce/headless commerce platforms (e.g. Shopify, Storefront APIs) or retail store estates.
• Relevant certifications such as CISSP, CISM, GCIH, or equivalent.
• Experience with retail-specific threats (POS malware, card-skimming, credential stuffing, loyalty/gift card fraud).
• Exposure to cloud-native security monitoring (Azure/AWS/GCP) and CI/CD pipeline security.