About this role
Salary: £? - ? per year
Requirements: Strong coding and scripting background, including PowerShell, Python and RegexProven ability to work with APIs, including HTTP/S headers and responses, JSON objectsProven experience with proxy administration and changesExperience with Windows (SMB) and *Nix (NFS) remote storageExperience with IIS (Windows Web Server) configuration and Active Directory/LDAP authenticationExperience applying certificates, software updates and supporting end-of-life refresh activityExperience with VMware/Hyper-V virtual machines and virtual switchesExperience setting up, implementing and maintaining cyber security toolingExperience creating, testing and maintaining AI or machine learning technologies to help optimise workflows or playbooksExperience with SIEM technologies Responsibilities: Support the Cyber Security Capability Manager in ensuring we meet the challenges and demands of countering the cyber threatWork with other UK Cyber Security members on back-end refresh, playbook scripting, fault finding, tool upgrades, capability implementation, tool integration, data source onboarding and investigation activityLead the technical aspects of ensuring cyber security appliance efficiency to support alert tuning, network visibility and log ingesting into relevant toolsetsAdvise on the implementation of new tools and lead the updating and expansion of existing capabilitiesEnsure the availability, readiness and resilience of cyber security toolsets within in-scope environmentsAccount for the effective mapping and topology of SOC toolsets, including integrations and feeds between solutionsEnrich the visibility and optimisation of SOC tools through data modelling and tuningMaintain the primary SOC toolsets, ensuring availability, functionality and optimisationManage the daily muster and availability of all cyber security technologies within in-scope environmentsTrack product lifecycle accurately and advise management on EOL/EOS roadmapsSupport the coordination, planning and execution of SOC appliance upgradesSupport new capability implementation and integration to existing solutions across all cyber security pillarsImplement cyber security tool changes and configuration, ensuring efficient reporting into CAB and control boardsLead playbook scripting activities, ensuring they are documented and tested, including fault finding and review of false positivesAct as the SME on SOC connectivity and visibility across all in-scope networks and infrastructureLead back-end refresh activity on cyber security appliances, including certificate updates, patch releases and software updatesAttend DEX CAB and collate all impacting activities on cyber security alertingAttend DEX incident and issue red teams in support of root cause analysis and advise on cyber security changes that may impact other servicesCollaborate closely with DEX back office to maintain availability and efficiency of cyber security tools and recover any service outages or disruptionSupport SOC investigation activity using a wide variety of security platforms, creating custom searches, advanced queries or scripts to find the root cause or IOC of an alert Technologies: AIActive DirectoryHTTPHyper-VSupportJSONLDAPMachine LearningNetworkNFSPowerShellPythonSecuritySMBVMwareWebWindows More:
We are a world-class defence organisation based in Stevenage, Hertfordshire. This is a 24-month subcontractor opportunity for a Cyber Security Engineer within our Cyber Security Operations Centre (SOC) in Digital Excellence (DEX) UK. The role is onsite five days per week, 37 hours per week, with overtime paid at time and a quarter for hours worked over 37 per week. The contract is inside IR35 and initially starts on SC Security Clearance, with DV Security Clearance required later on.
last updated 35 week of 2026