Lead Engineer, Security Operations Platform

Lead Engineer, Security Operations Platform About the team: The Pandora SecOps team is part of the Global Security department, responsible for detection and response across Pandora's entire value chain. Over the past few years, we have built a robust technology platform that allows us to respond to alerts and incidents with greater speed and accuracy. This evolution has shifted the team towards an engineering-led approach, where the platform itself is treated as a product: designed, built, and continuously improved through code. The team owns the entire platform and all the technology components within, which enables full control and autonomy of the design decisions. Pandora's broader shift towards PaaS and SaaS solutions is changing what our platform and team must deliver. Detection and response can no longer be anchored solely in traditional infrastructure telemetry; it must extend into application-level monitoring and the services our internal product teams build and operate. At the same time, operational technology (OT) across Pandora's manufacturing and production environments is becoming an increasing part of the detection and response scope, adding a new class of telemetry, constraints, and stakeholders to the platform. Practices like vulnerability management and exposure management are also capabilities that heavily rely on proper data platforms and pipelines. This represents a paradigm shift in the SecOps operating model. From operating a security stack in relative isolation to engineering a data and detection platform in close collaboration with application and product teams across Digital & Technology (D&T). About the role: As a SecOps Platform Engineer, you will own the engineering, evolution, and reliability of the core detection and response platform, including our XDR, SIEM and NDR and the pipelines that feed it. A central part of the role is driving and delivering the data foundation required for the shift towards application monitoring: onboarding new telemetry from PaaS and SaaS services, engineering scalable and cost-efficient ingestion, ensuring data quality, and building the platform capabilities that allow detection and response to cover applications and enterprise infrastructure. You will take ownership of selected components in our detection-as-code pipeline and the workflow integrations that connect the platform into the wider SecOps ecosystem. Also, practices like vulnerability management and exposure management, which rely heavily on proper data platforms and pipelines, are converging ever closer with detection and response, and platform engineering plays a key role in integrating these capabilities into one coherent operational system. As part of the role, you will also be expected to take part in the internal SecOps on-call roster, ensuring coverage for critical alerts and incidents outside normal business hours. On-call participation is compensated in accordance with our on-call compensation scheme. This is a senior role within the team. As with all senior members of Pandora SecOps, you will be expected to step in and drive incident response efforts when needed. Key responsibilities:

• Own the continuous improvement of the SecOps technology platform, including XDR, SIEM and NDR, with a platform-as-code and infrastructure-as-code approach (versioned, peer-reviewed, CI/CD-deployed).
• Drive the data platform agenda: design and deliver scalable telemetry ingestion and log onboarding for PaaS and SaaS services, cloud platforms, and internally developed applications.
• Engineer and maintain workflow integrations across the SecOps ecosystem (SIEM, NDR, EDR, SOAR, IAM, ITSM), ensuring stable, secure, and observable connector and integration performance.
• Partner with application and product teams across D&T to embed security monitoring into new services, define logging and telemetry requirements, and shape the collaboration model between SecOps and product engineering.
• Collaborate closely with Detection Engineers, SOC Analysts, and Security Principal Architects to ensure platform capabilities are grounded in real operational needs and enable the full detection and response lifecycle.
• Ensure platform reliability, health, and performance through monitoring, capacity management, and root-cause analysis.

Qualifications:

• At least 5 years of full-time experience in security engineering, security operations engineering, or SecOps platform engineering, with demonstrable seniority appropriate to a manager-level individual contributor role.
• Solid hands-on experience from working within a SOC or incident response setup.
• Proven experience engineering and operating SIEM platforms, including data connectors, analytics rules, workspace architecture, ingestion optimization, and cost management. Experience with NDR platforms is a strong plus.
• Applied experience with infrastructure-as-code (e.g., Terraform, Bicep/ARM, or equivalent), including managing security platform content and configuration through version control rather than manual administration.
• Demonstrated working experience with Git, DevOps practices, and CI/CD pipelines applied to security tooling - for example detection-as-code, automated content deployment, or pipeline-driven platform changes.
• Proficiency in Python for building integrations, API clients, data onboarding tooling, and automation supporting platform operations.
• Solid understanding of cloud and identity ecosystems relevant to Pandora's environment: Azure, Entra ID, and Active Directory
• Knowledge about monitoring patterns for PaaS/SaaS services and modern application architectures is a plus.
• Experience integrating security platforms with enterprise tooling (e.g., SOAR, ITSM) and maintaining stable, secure, and well-documented integrations.
• Strong collaboration and communication skills, with the ability to work directly with application and product teams, translate security requirements into engineering deliverables, and influence without formal authority.

Further Information: This role is a Career Band 4B (Individual Contributor) and reports directly to the Director, Information SecOps, Analytics & Incident Response and will join a team of 4 colleagues. Did we get your attention? If you see yourself in the position and would like to become a part of Pandora’s future, please do not hesitate to apply. We look forward to hearing from you! We process applications on a continuous basis, which is why we encourage you to send your application as soon as possible. You can also read more about Pandora on our corporate site About Pandora: Pandora is the world's largest jewellery brand, specialising in the design, crafting and marketing of accessible luxury jewellery made from high-quality materials. Each piece is created to inspire self-expression, allowing people to share their stories and passions through meaningful jewellery. Pandora jewellery is sold in more than 100 countries through 7,000 points of sale, including more than 2,800 concept stores. Headquartered in Copenhagen, Denmark, Pandora employs around 39,000 people worldwide and crafts its jewellery with 100% recycled silver and gold. Pandora is committed to leadership in sustainability and has set out to halve greenhouse gas emissions across its value chain by 2030. Pandora is listed on the Nasdaq Copenhagen stock exchange and generated revenue of DKK 32.5 billion (EUR 4.4 billion) in 2025. Recognised by the Financial Times as one of Europe’s Best Workplaces and ranked #1 among Danish companies, Pandora is committed to building an inclusive and diverse workplace. We believe that reflecting the diversity of society in how we engage with our customers is essential to fulfilling our purpose: to give a voice to people’s loves. We are dedicated to nurturing a culture where everyone feels respected, valued