Active Cyber Defence Lead

Atomic Weapons Establishment; Aldermaston; On-site; GBP 59,000 - 72,000; Full time

Benefits offered by this job

9-day working fortnight

Generous pension scheme (9–13%)

Annual leave: 270 hours

Job summary

Atomic Weapons Establishment is seeking an Active Cyber Defence Lead to drive the strategic leadership, development and operational effectiveness of the organisation's cyber defence capabilities. You will report to the Head of Digital Operations and lead proactive threat detection, hunting and disruption across the enterprise.

You will define the Active Cyber Defence strategy, build a high-performing team, and ensure capabilities align with risk appetite, regulatory obligations and recognised

Qualifications

• Membership in a recognised professional organisation (e.g. BCS, ISACA, IAPP).
• Strong understanding of threat actor TTPs and frameworks like MITRE ATT&CK.
• Able to communicate at all levels with very good written and oral skills.
• Highly organised with ability to manage multiple tasks and priorities.

Responsibilities

• Active Cyber Defence Strategy and Governance: define, implement and govern the enterprise Active Cyber Defence strategy.
• Threat and Risk Identification: continuously identify and prioritise cyber threats, vulnerabilities and insider risks.
• Detection and Monitoring Effectiveness: ensure coverage and improvement of detection across SOC, SIEM, EDR, NDR.
• Incident Response and Disruption: timely response, containment and disruption of cyber threats.
• Integrated Cyber Defence Operations: unify SOC, IR, Insider Threat and Digital Forensics into an intelligence-led model.
• Protective Control Effectiveness: ensure controls reduce attack surfaces and insider risk.
• Recovery and Resilience Improvement: drive measurable improvements in cyber resilience and detection capability.
• Performance, Metrics and Assurance: define and report cyber defence KPIs to senior leadership.
• Leadership and People: build and lead a threat-led cyber defence team.

Skills

Leadership

Communication skills

Threat intelligence

MITRE ATT&CK

SIEM

EDR

Tools

SIEM

EDR

NDR

Job description

Role: Active Cyber Defence Lead. Location: RG7 4PR, located between Reading and Basingstoke, with free onsite parking. Package: starting from £65,100 p.a (depending on your suitability, qualifications, and level of experience). Working pattern: AWE operates a 9-day working fortnight. We will consider flexible working requests so that your work may fit in with your lifestyle.

The Active Cyber Defence Lead is responsible for the strategic leadership, development, and operational effectiveness of the organisations' active cyber defence capabilities. Reporting directly to the Head of Digital Operations, the role leads the proactive identification, disruption, and mitigation of cyber threats across the enterprise. The role also leads proactive threat detection, hunting, and disruption, ensuring cyber threats are identified, contained, and mitigated in line with organisational risk appetite and regulatory obligations. It provides assurance that cyber‑defence capabilities are continuously improved through intelligence‑led operations, performance metrics, and alignment to recognised frameworks.

Key Accountabilities:

• Active Cyber Defence Strategy and Governance: Accountable for defining, implementing, and governing the enterprise Active Cyber Defence strategy, ensuring alignment to direction from Chief Information Security Officer (CISO), organisational risk appetite, and regulatory requirements.


• Threat and Risk Identification: Accountable for the continuous identification, assessment, and prioritisation of cyber threats, vulnerabilities, attack paths, and insider risks.


• Detection and Monitoring Effectiveness: Accountable for the effectiveness, coverage, and continuous improvement of detection capabilities across SOC, SIEM, EDR, NDR, and insider threat monitoring.


• Incident Response and Disruption: Accountable for the timely and effective response, containment, and disruption of cyber threats, including advanced persistent threats, and insider activity.


• Integrated Cyber Defence Operations: Accountable for the seamless integration of the SOC, Incident Response, Insider Threat, and Digital Forensics into a unified, intelligence‑led operating model.


• Protective Control Effectiveness: Accountable for ensuring defensive controls reduce attack surfaces and insider risk, including identity, endpoint, network, and data protection controls.


• Recovery and Resilience Improvement: Accountable for ensuring lessons learned from incidents drive measurable improvements in cyber resilience, controls, and detection capability.


• Performance, Metrics, and Assurance: Accountable for defining, tracking, and reporting cyber defence KPIs to the Head of Digital Operations, and Senior Leadership.


• Capability Development and Maturity: Accountable for continuous improvement of cyber defence maturity aligned to NIST CSF and recognised frameworks (e.g. MITRE ATT&CK).


• Leadership and People: Accountable for building and leading a high-performing, threat‑led cyber defence team with clear accountability and skills development.

Essential Criteria:

• Membership in a recognised professional organisation (e.g. BCS, ISACA, IAPP).


• Strong understanding of threat actor tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK.


• Able to communicate effectively at all levels with very good written and oral skills.


• Highly organized and capable of managing multiple concurrent tasks, whilst maintaining effective judgement in prioritising and time allocation.


• Good interpersonal skills with the ability to explain technical problems to non-technical business stakeholders at all levels.


• Good presentation skills.


• Strong leadership, stakeholder management, and decision‑making skills.


• Ability to work under pressure.


• Tenacious and able to defend conclusions.


• Good understanding of core information security principles.


• Strong analytical and documentation skills.


• Ability to communicate clearly and collaborate with technical and non‑technical stakeholders.


• Able to work predominately onsite.

Work hard, be rewarded:

We ask a lot and set the bar high because our work truly matters. In return we offer balance, with award winning benefits including:

• 9-day working fortnight – meaning you get every other Friday off work, in addition to 270 hours of annual leave.


• Market leading contributory pension scheme (we will pay between 9% and 13% of your pensionable pay depending on your contributions).


• Family friendly policies: Maternity Leave - 39 Weeks Full Pay and Paternity Leave - 4 Weeks Full Pay.


• Opportunities for Professional Career Development including funding for annual membership of a relevant professional body.


• Employee Assistance Programme and Occupational Health Services.


• Life Assurance (4 x annual salary).


• Discounts – access to savings on a wide range of everyday spending.


• Special Leave Policy including paid time off for volunteering, public service (including reserve forces) and caring.

All candidates must be willing and able to obtain and maintain the appropriate security clearance for this role.

Our ambition is to create workplaces where we recognise and celebrate differences, encourage diverse contributions and our employees feel able to be themselves at work. We strive to create a genuine culture of openness and inclusion and encourage diverse applicants.

The nature of our work does mean you need to be a British Citizen who has been resident in the UK for the past 5 years in order to apply for SC clearance and 10 years for DV. This will be funded by AWE. You will need to obtain and maintain the necessary security clearance for the role. You will need to let us know on your application form if you need any adjustments/accommodations during the process. Our interviews typically take place over Teams and for most roles are a 1 stage process.

If you’re looking for a role with excitement, intrigue and something that really makes a difference then now is the time to join AWE. We are at the start of a once in a generation – possibly two generations – programme to design and produce a replacement warhead for the UK’s continuous at sea deterrent. We will do this while continuing to deliver the Trident programme as well as managing ambitious state‑of‑the‑art capital and construction projects – some of which have never been done before.