{"id":951971,"url":"https://alion.io/job/river-island-security-operations-lead","title":"Security Operations Lead","company":{"id":684908,"name":"River Island","domain":"riverisland.com","url":"https://alion.io/company/riverisland-2","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Pinpoint","truth_index":{"grade":"A","score":100,"open_postings":4,"ghost_share":0,"stale_share":0,"repost_share":0.25,"time_to_fill_p50_days":6,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":95000,"max_usd":169000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":28},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"CI/CD","optional":true},{"name":"GCP","optional":true}],"status":"live","first_seen_at":"2026-09-15T01:28:37Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-11-03T04:17:18Z","board_verified":true,"closed_at":null,"days_open":49,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":49},"description":"River Island is a UK high-street and omnichannel apparel retailer trading across 1800+ stores, a major distribution centre, head offices, and a growing ecommerce platform. As the business modernises its digital footprint, it is strengthening in-house security operations capability to complement its existing outsourced Security Operations Centre (SOC).\n\nThe Security Operations Lead owns day-to-day security operations delivery and acts as the primary internal control point across both first-line (operational security execution and tooling) and second-line (oversight, assurance, and governance of the security control environment) accountabilities. This is a hybrid, hands-on role suited to someone who can both operate security tooling directly and hold a third-party SOC provider to account against contracted service levels and outcomes.\nThe role sits within a lean Information Security function and is central to River Island's ability to detect, triage, and respond to threats across stores, ecommerce (including Storefront API/headless platforms), distribution, and corporate estate - while managing the operational relationship with the outsourced SOC.\nKey Accountabilities\n\n 1. Security Operations Delivery\nOwn the operational delivery of security monitoring, detection, and response capability across corporate, retail, distribution, and ecommerce environments.\nAct as the internal escalation and coordination point for security alerts, incidents, and investigations raised by the outsourced SOC, ensuring timely triage and remediation.\nOperate and tune in-house security tooling (e.g. vulnerability scanning, endpoint detection, exposure management, identity/access monitoring) to complement SOC-delivered detection.\nLead incident response execution: contain, investigate, and coordinate recovery for security incidents, following documented playbooks, and drive post-incident lessons-learned activity.\nCoordinate vulnerability management end-to-end - from detection and prioritisation through to remediation tracking with Technology, Ecommerce, and Infrastructure teams.\nSupport patching, hardening, and configuration management activities across store systems, cloud platforms, and the ecommerce stack.\nMaintain and test incident response runbooks, tabletop exercises, and escalation paths, including out-of-hours coverage arrangements with the SOC.\n 2. Outsourced SOC Management and Oversight\nAct as the primary relationship and performance owner for the outsourced SOC provider, holding them accountable to SLAs, use-case coverage, detection efficacy, and reporting quality.\nChair or contribute to regular SOC service reviews, tracking key metrics such as mean time to detect (MTTD), mean time to respond (MTTR), false-positive rates, alert volumes, and coverage gaps.\nDefine and continuously refine detection use cases and log source onboarding with the SOC to ensure coverage keeps pace with the retail estate, ecommerce releases, and cloud changes.\nProvide independent assurance that SOC-reported findings, incident closures, and control effectiveness claims are accurate and evidenced - challenging and validating rather than simply accepting vendor reporting.\nOwn the governance of the SOC contract from a security-operations lens: reviewing scope, escalation matrices, data handling, and change requests as the business or threat landscape evolves.\nEnsure clear ownership of assets, logs, and detection logic remains with River Island, avoiding vendor lock-in or loss of institutional knowledge.\nFeed SOC performance, risk exposure, and control gaps into the Information Security Risk Register and executive/committee reporting.\n 3. Governance, Risk, and Reporting\nDefine and report security operations KPIs/KRIs (detection coverage, incident volumes and trends, remediation SLAs, SOC performance) to the Head of Information Security and relevant governance forums (e.g. GDPR Steering Committee, security committees).\nSupport compliance activities across PCI DSS, UK GDPR, and ISO 27001/NIST CSF-aligned control requirements as they relate to operational security and monitoring.\nMaintain evidence and documentation to support internal and external audits, penetration tests, and regulatory reviews.\nPartner with Legal, DPO, and Risk teams on incident notification obligations and data breach response.\n 4. Cross-Functional Partnership\nWork closely with Ecommerce/Storefront API, Infrastructure, Retail Technology, and Distribution Centre teams to ensure monitoring coverage extends across all channels - stores, web, app, and warehouse systems.\nPartner with the security and tech Engineers on penetration testing, red-teaming, and remediation coordination.\nSupport BYOD/MDM security monitoring and access governance activities (RBAC, joiner/mover/leaver, MFA, privileged access, Identity posture) from an operational assurance standpoint.\nRepresent security operations in change advisory and project forums to ensure new initiatives are onboarded into monitoring scope pre-go-live.\nEssential Experience and Skills\nProven experience in a security operations, SOC management, or similar hands-on operational security role, ideally within retail, ecommerce, or another complex multi-channel environment.\nDemonstrable experience managing or governing an outsourced/managed SOC or MSSP relationship, including SLA management and detection use-case development.\nStrong working knowledge of SIEM, EDR, vulnerability management, and exposure management tooling.\nPractical incident response experience, including leading or coordinating live incident investigations.\nFamiliarity with the three lines of defence model and ability to operate credibly across both first-line delivery and second-line oversight.\nUnderstanding of PCI DSS, UK GDPR, and NIST CSF control frameworks as applied to operational security.\nComfortable working in a lean team, prioritising pragmatically, and balancing protection with business/customer experience.\nStrong stakeholder management skills, able to challenge a third-party provider constructively while maintaining an effective working relationship.\n Desirable\nExperience securing ecommerce/headless commerce platforms (e.g. Shopify, Storefront APIs) or retail store estates.\nRelevant certifications such as CISSP, CISM, GCIH, or equivalent.\nExperience with retail-specific threats (POS malware, card-skimming, credential stuffing, loyalty/gift card fraud).\nExposure to cloud-native security monitoring (Azure/AWS/GCP) and CI/CD pipeline security.\nAbout Us\nWe’re a much-loved brand with an exciting future. Our Islanders are a diverse bunch of bright, talented people who love working together - and are proud of the work they do. Progression here can take you in all kinds of directions. This is what a career at River Island is like. And this is where yours starts.\nThis role is based at our Head Office in West London. Check us out here on a map.\nWhat we can offer you:\n Generous 50% staff discount so you can treat yourself to the latest products, and a bargain staff shop on site!\nReducing Islanders everyday expenses through discounts, benefits, financial advice, wellbeing solutions and more through the Retail Trust.\nA free onsite gym, subsidised restaurant & café to fill you needs. Various social events to socialise throughout the year.\nEvery family is unique, we support Islanders with all different family setups enhanced maternity, paternity, adoption & fertility treatment. We also work closely with the Retail Trust to create dedicated support for all our Islanders!\nFlexible working, on top of payday and summer early finish Fridays.\nGive as you earn scheme, a ‘Giver Island’ day each year and receive matched funding.\nSupport with upskilling through on the job training and qualifications. A succession plan if you want to progress.\n A generous bonus scheme & private pension plan.\nThe choice to opt in for healthcare through our provider AXA.\n25 days paid holiday, exclusive of Bank Holidays. With the added option to purchase additional holiday twice a year for whatever the need!\nKeeping You Safe\nWe are committed to providing a safe and inclusive workplace where everyone is treated with dignity and respect. We expect all employees to uphold our values and contribute to a positive working environment.\nOur business is made up of a diverse community, where we all belong and feel part of something bigger. We are committed to equality of opportunity and welcome applications from individuals regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion or belief. We will consider flexible working requests for all roles unless operational requirements prevent otherwise.","description_format":"text","description_chars":8704,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["E-commerce Platforms","Apparel & Fashion Brands"],"lifecycle":[{"event":"open","at":"2026-09-16T01:28:37Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker","cap_exempt":false,"checked_at":"2026-11-03T08:26:00+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":12,"band":"cold","label":"Long shot","p_open":1,"p_active":0.356,"p_room":0.35,"age_days":49,"expected_fill_days":6,"reasons":["conf:1","win:tail"],"computed_at":"2026-11-03T05:54:40Z"},"pay":null,"html_url":"https://alion.io/job/river-island-security-operations-lead","json_url":"https://alion.io/job/river-island-security-operations-lead.json","meta":{"generated_at":"2026-11-03T08:37:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12128,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":684908},"rest":"https://alion.io/mcp/rest/get_company?id=684908"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Friver-island-security-operations-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Friver-island-security-operations-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Friver-island-security-operations-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/river-island-security-operations-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Friver-island-security-operations-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":951971}},{"tool":"search_jobs","arguments":{"company":"riverisland.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":951971},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}