At Beam, we’re building AI that serves society.

We're a global team of ambitious, hardworking problem solvers, applying fast-moving startup energy to work that makes the world a better place. If you want to apply your talent to the biggest problems society faces, Beam is the place for you.

You’ll be part of a high-performance culture where you'll make a huge impact, rapidly progress your career, and truly enjoy your work.

Over 100,000 frontline workers already use Beam to take notes, provide live interpretation and handle phone calls, so they can focus on the people who need them most. This is just the beginning.

The opportunity at Beam

Beam builds AI tools for frontline public services in the UK, US, Australia and the EU: local authorities, health services, police forces, and state, federal and central government agencies. Our products handle some of the most sensitive data governments hold, and our customers' security teams hold us to the standards they hold themselves.

The Security Operations Lead is Beam's first dedicated operational security role. You run security operations across six deployments in four regions: detection and response, vulnerability management, penetration testing, cloud security posture, external attack surface, third-party security assessment and adversarial testing of our AI products. You are also the assurance owner for the platform security controls Engineering operates: you check they work, hold the evidence, and answer for them to auditors and customers in every region. You report to the Chief Information Risk Officer and support them on security incidents.

Day to day: tuning the SIEM and working with the MDR; triaging vulnerability findings and holding remediation to SLA with Engineering; scoping and running pen tests with our external partner; reviewing Engineering's platform controls and gathering evidence; running incident response exercises; answering the security half of customer and auditor questions.

What you’ll be doing

• Running detection and response. Owning the SIEM and detection stack (a SIEM is in place but not deeply embedded; you decide whether it stays), owning detection rules, managing alert triage and noise, and selecting and managing the 24/7 MDR service so that out-of-hours compromise in any of our four regions is seen and acted on.

• Owning the vulnerability programme end to end. Detection, triage, remediation to SLA with Engineering and IT Ops, and reporting that matches what we tell customers. Includes cloud security posture (GCP, AWS), configuration drift across deployments, and the external attack surface (domains, DNS, TLS, security ratings).

• Scoping and coordinating penetration testing across all products and regions with our external partner, and owning the vulnerability disclosure programme.