Threat Response Technology and Capabilities Product Owner

Salary: £60,000 - 100,000 per year

Requirements:

• We have extensive hands-on experience in security operations, incident response, digital forensics, automation engineering, or security engineering, with at least 3 years in a product, architecture, or capability ownership role.
• We have deep, hands-on expertise with SOAR tools, including playbook development, integration into agentic AI tools, integration into case management, custom app/connector creation, and platform administration.
• We have enterprise-scale experience designing and operationalizing AI augmentation in security operations, including agentic AI workflows for triage, enrichment, scoping, or response, prompt engineering and prompt book libraries, Jupyter notebook-driven investigation and DFIR workflows, and LLM integration into SOAR, case management, or analyst tooling.
• We have a proven track record of shipping AI-augmented incident response capabilities in a large enterprise.
• We have working knowledge of MCP server architectures and emerging agentic frameworks for SOC use cases.
• We have deep expertise across the full IR lifecycle: triage, scoping, containment, eradication, recovery, evidence handling, and post-incident review.
• We have a strong DFIR background covering endpoint, network, cloud (AWS, Azure, GCP), identity, and SaaS forensics.
• We have working proficiency in Python and PowerShell, and we are comfortable reviewing and directing code without being the primary developer.
• We have experience with EDR live response capabilities and custom tool/scripting execution capabilities.
• We have fluency in modern SOC architecture concepts: tiered case management, detection-as-code, response-as-code, autonomous response patterns, and the regulatory implications of each.
• We have deep understanding and experience executing on SOC evolution and modernization across SOC maturity models (2.0 and 3.0).
• We have deep expertise in digital forensics, threat hunting concepts, and security engineering.
• We have prior experience standing up or modernizing a SOAR or AI-augmented response program from the ground up.
• We have a bachelors degree in Computer Science, Cybersecurity, or an IT-focused discipline, or equivalent experience.
• We have security operations experience in regulated financial services enterprise environments.
• We have familiarity with mobile device evidence collection, ephemeral messaging archiving, and cloud forensic acquisition.
• We have experience defining auditability and evidentiary standards for AI-assisted decisions in a regulated SOC.
• We have industry certifications such as GCFA, GCIH, GNFA, GCFR, GREM, or equivalent.

Responsibilities:

• We own and execute the multi-year strategy and roadmap for evolving and scaling incident response capabilities, tooling, automation, and AI augmentation across our Security Operations function.
• We define and maintain the RESPOND capability taxonomy, mapped to NIST CSF (Respond/Recover), NIST SP 800-61r3, MITRE ATT&CK, and D3FEND.
• We set strategy and roadmap for SOAR platforms, case management, evidence collection, and response orchestration.
• We define and oversee SOAR playbook automation builds, documentation, and execution.
• We define the AI augmentation strategy for incident response in security operations, including agentic AI workflows, LLM-assisted triage, prompt libraries, notebook-based investigation, and human-in-the-loop autonomous response patterns.
• We establish governance, guardrails, and auditability for AI-assisted and AI-autonomous response actions in support of regulatory frameworks and audits.
• We define requirements and oversee build-out of automation pipelines, playbooks, response actions, enrichment services, promptbook-based investigation notebooks, and analyst-facing tooling.
• We establish and maintain centralized libraries of response tools, scripts, prompt books, notebooks, and live-response packages deployable via EDR, SOAR, and endpoint management platforms.
• We drive incident response tooling and integration strategy across EDR, XDR, SIEM, identity, cloud, network, ticketing, and AI platforms to enable closed-loop response.
• We partner closely with the detection product team to ensure detections produce response-ready, automatable, and AI-consumable outputs.
• We define KPIs and OKRs for response product effectiveness, including MTTR, automation coverage, AI-assist coverage, analyst toil reduction, containment time, and evidence completeness.
• We manage vendor relationships, evaluations, POCs, and procurement for response and AI tooling.
• We govern the RESPOND backlog, prioritize work for embedded product team members, and run agile delivery cadence.
• We represent RESPOND capabilities to executive leadership, audit, and regulators.

Technologies:

• Agentic AI
• AI
• AWS
• Azure
• Cloud
• Embedded
• GCP
• Support
• Jupyter
• LLM
• MCP
• Mobile
• Network
• PowerShell
• Python
• Security
• Architect
• Product Owner
• Splunk

More:

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. We help build a sustainable economy where everyone can prosper by supporting a wide range of digital payment choices that make transactions secure, simple, smart, and accessible. Our technology, innovation, partnerships, and networks combine to deliver products and services that help people, businesses, and governments realize their greatest potential. This full-time role sits within our Cyber and Corporate Security organization and focuses on security operations modernization and incident response capabilities.

last updated 36 week of 2026