CSOC Lead: Hybrid Cyber Defense & Incident Response

Northrop Grumman UK; Cheltenham; Hybrid; GBP 60,000 - 91,000; Full time

Benefits offered by this job

Hybrid working environment

Private healthcare

Pension

Career development programmes

Annual performance incentive

Job summary

Northrop Grumman UK is recruiting a CSOC Lead to steer the Cyber Security Operations Centre in Cheltenham. You will lead a team of analysts protecting UK and EMEA operations, while staying hands-on with threat hunting, incident response and forensics.

You will collaborate with global CSOC teams to refine detection, response, and resilience, reporting to senior stakeholders and representing NG UK in security forums. A UK national with clearance is preferred.

Qualifications

• > Experience leading or managing a Security Operations Centre (SOC) or Cyber Security Operations Centre (CSOC).
• > Proven success leading teams, projects or operational cyber security functions.
• > Strong incident response, cyber threat hunting and digital forensics expertise.
• > Experience using commercial SIEM, EDR and network analysis platforms.
• > Strong understanding of network protocols and traffic analysis across the OSI model.
• > Experience working with cyber threat intelligence methodologies and frameworks.
• > Ability to communicate complex technical issues clearly to executive and non-technical audiences.
• > Strong stakeholder management, decision-making and problem-solving skills.
• > Proficiency across Windows, Linux and Unix environments, including PowerShell and Bash scripting.

Responsibilities

• Lead, mentor and develop a team of cyber threat analysts, providing direction, coaching and day-to-day operational oversight.
• Manage security operations across the EMEA region, ensuring effective execution of cyber monitoring, triage, investigation and response activities.
• Serve as Incident Response Lead for major cyber security events, coordinating technical investigations, containment and remediation activities.
• Lead advanced threat hunting and digital forensic investigations using SIEM, EDR, network telemetry and threat intelligence sources.
• Work closely with global CSOC teams to improve cyber defence capabilities, operational processes and detection methodologies.
• Provide clear and actionable cyber risk updates, technical briefings and executive summaries to senior stakeholders and leadership teams.
• Represent Northrop Grumman UK within government, industry and security forums, supporting collaboration and information sharing.
• Drive cyber resilience through exercises, lessons learned activities and continuous improvement initiatives.

Skills

SOC/CSOC Leadership

Incident Response

Threat Hunting

Digital Forensics

Executive Communication

Stakeholder Management

Windows/Linux/Unix

PowerShell/Bash scripting

Education

Bachelor's degree in Cyber Security, Computer Science or related discipline

Tools

SIEM

EDR

Network Analysis Tools

Job description

Northrop Grumman UK is recruiting a CSOC Lead to steer the Cyber Security Operations Centre in Cheltenham. You will lead a team of analysts protecting UK and EMEA operations, while staying hands-on with threat hunting, incident response and forensics.

You will collaborate with global CSOC teams to refine detection, response, and resilience, reporting to senior stakeholders and representing NG UK in security forums. A UK national with clearance is preferred.