Cyber Security Engineer

Inspire People; London; Hybrid; GBP 59,000 - 80,000; Full time

Job summary

A government department is seeking a Lead Cyber Security Engineer to safeguard digital assets and lead security initiatives. This role involves overseeing operations, mentoring staff, and collaborating with various stakeholders. Applicants should have significant experience in cloud security and leading technical teams. The position offers a flexible, hybrid working environment and a competitive salary between GBP59,634 to GBP79,133 with excellent benefits.

Benefits

Flexible hybrid working

27% pension contribution

25–30 days annual leave

Paid volunteering days

Employee benefits program

Qualifications

• Proven experience in cloud cyber security engineering in a SecOps/Security environment.
• Ability to lead technical teams and influence senior stakeholders.
• Expertise in Log management.
• Experience working in a DevOps environment and following DevOps practices.

Responsibilities

• Lead security engineering across DBT's digital platforms.
• Oversee incident response and investigation efforts.
• Create bespoke analytic rules for detection capabilities.
• Mentor and develop talent within the cyber team.

Skills

Cloud cyber security engineering

Technical team leadership

Log management

Incident management

Multi-cloud environments

Microsoft Sentinel

Security principles and frameworks

Tools

AWS

Azure

Django

SQL

KQL (Kusto)

Job description

Join a team at the heart of the global economy! The Department for Business and Trade ("DBT") and Inspire People are partnering together to bring you an exciting opportunity for a Lead Cyber Security Engineer you will play a vital role in safeguarding the department's digital estate, supporting the UK's economic resilience and global competitiveness. You'll lead the design and implementation of secure–by–design solutions across cloud, hybrid, and on–premises environments, embedding security throughout the digital life cycle. Salary between GBP59,634 to GBP79,133 (including allowances) plus excellent Civil Service benefits including 27% pension contribution. Salary is dependent on location and technical skills as assessed at interview. Flexible, hybrid working from London, Cardiff, Darlington, Belfast, Birmingham, Salford and Edinburgh.

About the role

Your responsibilities will span both strategic and operational domains. You'll lead security engineering across DBT's digital platforms, ensuring robust protection of trade, business, and investment systems. You'll also be at the forefront of the Security Operations Centre (SOC), overseeing the identification, collection, and analysis of security event data to generate high–fidelity, actionable alerts for cyber analysts. Working closely with the SOC Manager, you'll ensure that security tooling and data pipelines are current, effective, and tailored to reduce alert fatigue. You'll create bespoke analytic rules and collaborate with analysts to refine detection capabilities. You'll also take an active role in managing security alerts and leading incident response and investigation efforts.

As a senior colleague, you'll advise on cyber risks, emerging threats, and mitigation strategies aligned with the Government Security Framework and standards. You'll collaborate across government, industry, and international partners to uphold the UK's cyber reputation. Additionally, you'll mentor and develop talent within the cyber team, fostering a culture of innovation, continuous improvement, and shared learning.

About you

• Be a good, open communicator through written, verbal and virtual mediums.
• Be a good decision–maker
• Possess strong collaboration skills recognising the role must work with other Cyber team members and with various Service teams and third parties
• Be able to prioritise own workload based on the overall requirements of the SOC and SOC manager.

Main responsibilities

You will be:

• Leading large, cross–functional technical team in the design, development, and enablement of automated monitoring processes, advising on the latest SIEM (Security Information and Event Management) and network analysis tools, techniques, and procedures to detect malicious activity, while communicating directly with leadership on the progress and status of monitoring.
• Leading wider implementation of a monitoring strategy, ensuring roadmaps are achieved as expected, ensuring requirements, policies, and standards to govern all activities and outputs are met.
• Reviewing high–priority or high–complexity analysis of security event data to manage security incident response, making key decisions on reporting or escalations for monitoring Containing and remediating those incidents, identifying potential process improvements.
• Communicating with a broad range of senior stakeholders and be responsible for defining the vision, principles, and strategy for incident response Deputising for the SOC manager as a when required.
• Reviewing incident documentation ensuring that appropriate lessons learned are captured and implemented.
• Maintaining and integrating Cyber Threat Intelligence services to enhance the Departments capabilities to detect threats.
• Mentor junior engineers and contribute to the development of the security profession.

Skills and experience

It is essential that you have:

• Proven experience in cloud cyber security engineering in a SecOps/Security environment
• Ability to lead technical teams and influence senior stakeholders.
• Expertise in Log management.
• Experience working in a DevOps environment and following DevOps practices.
• A good working knowledge of multi–cloud environments, or expert knowledge in at least one recognised major cloud services provider,(eg AWS, Azure etc) network security, and secure software development.
• Incident management and alerts triage experience
• Experience in Microsoft Sentinel
• Strong understanding of security principles, technologies, and frameworks (eg, NCSC guidance, ISO 27001, NIST).

It is desirable that you have:

• Experience working with Django framework
• Good working knowledge of Query Languages (SQL, KQL (Kusto), etc.)

How to apply

If you join DBT, you will get:

learning and development tailored to your role

a flexible, hybrid working environment with options like condensed hours

a culture encouraging inclusion and diversity

a Civil Service pension with an average employer contribution of 27%

annual leave starting at 25 days rising to 30 days with service

three paid volunteering days a year

an employee benefits programme including cycle to work

More about DBT

This role can only be worked from within the UK, not overseas. If you are based in London, you will receive London weighting. DBT employees work in a hybrid pattern, spending 2–3 days a week (pro rata) in the office on average.