About this role
Salary: £30,000 - 55,000 per year
Requirements: Strong coding and scripting background, including PowerShell, Python, and RegexProven ability to work with APIs, including HTTP/S headers and responses and JSON objectsProven experience with proxy administration and changesExperience with Windows (SMB) and *Nix (NFS) remote storageExperience with IIS (Windows Web Server) configuration and Active Directory/LDAP authenticationExperience with applying certificates, software updates, and end-of-life refresh activityExperience with VMware/Hyper-V virtual machines and virtual switchesExperience in setting up, implementing, and maintaining cyber security toolingExperience with the creation, testing, and maintenance of AI or machine learning technologies to optimise workflows or playbooksExperience with SIEM (Security Information Event Management) technologiesThis position can start on SC Security Clearance and will later require DV Security Clearance Responsibilities: Lead on the technical aspects of ensuring cyber security appliance efficiency to support alert tuning, network visibility, and log ingesting to relevant toolsetsAdvise on implementation of new tools and lead the updating and expansion of existing capabilitiesProvide support by ensuring availability, readiness, and resilience of cyber security tool sets within in-scope environmentsSupport the Cyber Security Capability Manager in ensuring Digital Excellence UK meets the challenges and demands of countering the cyber threatWork with other UK Cyber Security members on back-end refresh, playbook scripting, fault finding, cyber security tool upgrades, capability implementation, tool integration, data source on-boarding, and investigation activityAccountable for the effective mapping and topology of SOC toolsets, including integrations and feeds between solutionsEnrich the visibility and optimisation of SOC tools through data modelling and tuningMaintain the primary SOC toolsets, ensuring availability, functionality, and optimisationManage the daily muster and availability of all cyber security technologies within in-scope environmentsTrack product lifecycle accurately and advise management of EOL/EOS roadmapsSupport the coordination, planning, and execution of SOC appliance upgradesSupport new capability implementation and integration to existing solutions across all cyber security pillarsImplement cyber security tool changes and configuration, ensuring efficient reporting into CAB and control boardsLead playbook scripting activities, including documentation, testing, fault finding, and review of false positivesAct as SME on SOC connectivity and visibility across all in-scope networks and infrastructureLead back-end refresh activity on cyber security appliances, including certificate updates, patch releases, and software updatesAttend DEX CAB and collate all impacting activities on cyber security alertingAttend DEX Incident and Issue red teams in support of root cause analysis and advise on cyber security changes that may impact other servicesCollaborate closely with DEX back office to maintain availability and efficiency of cyber security tools and recover any service outages or disruptionSupport the SOC in investigation activity using security platforms, custom searches, advanced queries, and scripts to find root cause or IOC of an alert Technologies: AIActive DirectoryHTTPHyper-VSupportJSONLDAPMachine LearningNetworkNFSPowerShellPythonSecuritySMBVMwareWebWindows More:
World Class Defence Organisation based in Stevenage, Hertfordshire is recruiting a Cyber Security Engineer subcontractor on an initial 24-month contract. The role is onsite five days per week, with hybrid/remote working noted as onsite 5 days per week, for 37 hours per week. Overtime over 37 hours is paid at time and a quarter. The contract is inside IR35 (umbrella), with an hourly rate of £92.11. The role sits within the Cyber Security Operations Centre (SOC) in Digital Excellence (DEX) UK and focuses on supporting cyber security tooling, alert tuning, integrations, visibility, resilience, and investigation activity across in-scope UK networks.
last updated 39 week of 2026