Cyber Operations Manager

Holman Fenwick Willan LLP; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Job summary

Holman Fenwick Willan LLP invites an experienced Cyber Operations Manager to lead the firm’s cyber security operations, monitoring, detection, and response. You will drive improvements in security controls and playbooks, coordinating with Infrastructure, Risk & Compliance, and third-party providers.

The role requires hands-on leadership of security operations and engineering, ensuring security by design across change programmes and complex information systems.

Qualifications

• Minimum 5 years of cyber security experience in regulated sectors (e.g., professional services, legal or financial).
• Proven ability to lead or manage cyber security operations teams and incident response.
• Experience managing outsourced security services and suppliers.

Responsibilities

• Lead day-to-day cyber security operations and incident handling.
• Develop and maintain security controls, runbooks, and incident playbooks.
• Coordinate with IT and third-party providers to manage threats and responses.
• Drive continuous improvements in detection coverage and security maturity.

Skills

Cyber security leadership

Threat detection & response

SIEM & security tooling

Incident management

Security governance

Education

Bachelor's degree in Information Security, CS, or related field

Tools

SIEM platforms

EDR tools

Cloud security tooling

Job description

The IT department has approximately 60 staff globally, located in London, Paris, Piraeus, Dubai, Hong Kong, Houston, Sao Paulo, Melbourne, Perth, Singapore, and Sydney.

HFW’s Information Technology team’s vision is to deliver a responsive and continuously evolving technology platform, underpinned by a secure, global infrastructure with data and process at its core.

The role

The Cyber Operations Manager is responsible for the operational delivery of HFW’s cyber security function, ensuring that security monitoring, detection, response, engineering and operational security controls effectively protect the Firm from cyber threats.

The role leads day-to-day cyber security operations, develops and maintains security technologies, manages cyber incidents and drives continuous improvement of the Firm’s security monitoring and response capabilities, and ensure that change programmes incorporate security requirements and deliver security by design.

The Cyber Operations Manager provides technical leadership across security operations and works closely with Infrastructure, Business Systems, Service Delivery, Risk & Compliance and third-party security providers to ensure threats are identified, investigated and managed effectively.

The role holder will deliver:

• Effective monitoring, detection and response to cyber threats and incidents.
• Managed and continuously improved technical security controls to maintain security in an evolving threat landscape.
• Reduced exposure to cyber risk through timely remediation of vulnerabilities and security weaknesses.
• Rapid and coordinated response to security incidents.
• Continuous improvements in detection coverage and operational security maturity, using emerging technology such as AI.
• Effective management of outsourced security services and technical partners.
• Appropriate operational security reporting and metrics for management.

The role will be expected to operate at the Skills Framework for the Information Age (SFIA) Information Security discipline, level 5, which includes:

• Provides advice and guidance on security strategies to manage identified risks and ensure adoption and adherence to standards.
• Contributes to development of information security policy, standards and guidelines.
• Obtains and acts on vulnerability information and conducts security risk assessments, business impact analysis and accreditation on complex information systems.
• Investigates major breaches of security and recommends appropriate control improvements.

Key responsibilities

Security Operations

• Manage the day-to-day operation of the Firm’s cyber security capability.
• Lead the Cyber Security team, including coaching, mentoring and performance management.
• Oversee threat monitoring, detection, investigation and response activities.
• Ensure security alerts are appropriately triaged, investigated and resolved.
• Continuously improve security monitoring, detection coverage and investigation processes.
• Develop operational security runbooks and standard operating procedures.
• Maintain security operations metrics, reporting and service performance measures.

Security Engineering

• Own and maintain cyber security technologies, ensuring they remain effective, supported and appropriately configured.
• Develop, tune and optimise security controls across the Firm’s technology estate.
• Lead implementation of new security technologies and enhancements.
• Review security architecture and technical designs to ensure alignment with security standards.
• Provide technical leadership on security improvements and transformation initiatives.
• Act as the escalation point for complex technical cyber security issues.
• Security Monitoring & Detection Engineering
• Develop and maintain SIEM use cases and detection rules.
• Improve detection content based on emerging threats, incident learnings and threat intelligence.
• Establish a structured detection engineering lifecycle.
• Validate and tune security detections to minimise false positives and improve effectiveness.
• Conduct threat modelling to ensure security technology coverage and identify any gaps.
• Develop and maintain operational playbooks and automated response workflows where appropriate.

Vulnerability Management

• Manage the Firm’s vulnerability management programme.
• Review vulnerability assessment results and prioritise remediation activities, working with infrastructure, systems and other teams to ensure vulnerabilities are resolved within agreed timeframes.
• Report on vulnerability trends, remediation effectiveness and risk exposure.
• Lead cyber security incident management and response activities.
• Coordinate technical investigations and containment activities.
• Act as operational lead during significant security incidents.
• Work closely with the Head of Cyber Security, IT teams and managed security service providers during major incidents.
• Coordinate forensic investigations where required.
• Conduct post-incident reviews and ensure lessons learned are implemented.
• Maintain and test incident response playbooks and procedures.
• Consume and assess threat intelligence relevant to the legal sector.
• Develop proactive threat hunting activities.
• Identify emerging threats and evaluate their potential impact on the Firm.
• Translate threat intelligence into detection and defensive improvements.
• Support executive reporting on significant cyber threats and adversary activity.

Security Controls

• Maintain the effectiveness of key security controls including:
• SIEM
• DLP
• SASE / SWG / CASB
• Identity security
• Vulnerability management platforms
• Monitor security control health and performance and identify opportunities for improvement.

Security Projects

• Act as technical cyber security lead on operational security projects.
• Support firm change programmes, providing projects with security expertise.
• Review technical designs and advise on security requirements.
• Ensure security is appropriately embedded within technology change initiatives to ensure the security by design.

Third-Party Security Services

• Manage relationships with managed security service providers and security partners.
• Hold suppliers accountable for agreed service levels.
• Review supplier performance and service reports.
• Escalate service concerns and coordinate remediation activities.

Security Awareness Training

• Support cyber security awareness initiatives.
• Provide technical input into phishing simulations and user awareness campaigns.
• Contribute to cyber security communications and training programmes.

Key skills and experience required

• At least 5 years’ relevant cyber security experience within a regulated sector, such as professional services, legal or financial sectors
• Experience leading or managing cyber security operations teams, operating and improving technical security controls, developing response playbooks and managing cyber incidents
• Experience managing outsourced security services and security suppliers.
• Experience supporting cloud security operations.

Strong Technical Knowledge

• Microsoft Azure, Entra ID, and security technologies
• SIEM technologies and monitoring platforms
• Email security platforms
• Identity and access management,
• Vulnerability management tools
• Endpoint security technologies, for example EDR
• SASE technologies
• Network security technologies, firewalls, IDS/IPS
• Managing Security Operations Centre (SOC) operations handling
• Detection Engineering, Incident Response
• Threat Modelling, Hunting and Threat Intelligence
• Vulnerability Management
• MITRE ATT&CK Framework
• Security Monitoring

Leadership Skills

• Strong people management and leadership capabilities.
• Ability to coach and develop cyber security professionals.
• Ability to communicate technical cyber risks to non-technical stakeholders.
• Strong analytical and problem-solving skills.
• Ability to remain effective during major incidents and high-pressure situations.
• Strong stakeholder management and influencing skills.
• Experience within a global law firm.
• Experience building or transforming security operations functions.
• Experience with managed SOC services.
• Experience with security orchestration and automation technologies.
• Experience with adversary simulation exercises and purple teaming.
• Experience using threat intelligence to improve detection and response.

Qualifications

• Relevant professional qualification or equivalent demonstrable experience, such as CISSP, CISM and GIAC certifications

Additional information

Kindly note, this job description is not contractual. It will be reviewed periodically and may be amended or altered to meet the needs of the firm.

HFW aims to ensure equality of opportunity, and we are actively working towards improving the diversity of our staff. All applications will be considered only on merit and the applicant’s suitability to meet the requirements of the role.

HFW collects and processes personal data relating to job applicants to manage its recruitment process.The firm is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations. For information on how the firm will process your data, please see our Privacy Notice , in the section “What we collect and how we use it”.

Job Type: Business Services

Location: London

Department: Information Technology

Role: Permanent

About HFW

HFW is a sector focused global law firm. We have over 700 lawyers working across the Americas, Europe, the Middle East, Asia and Australia. We take a progressive approach to our roles in commercial business – thinking creatively and pragmatically to support our clients.

Whether we are solving complex issues within the construction, aviation or shipping industries, or providing advice across insurance, commodities and energy we are specialist lawyers here to add value to our clients. We think about the commercial solution first and then underpin our advice with a solid foundation of legal expertise.