Cyber Security Operations Engineer

TfW Business Daily Group; Graigwen; On-site; GBP 65,000 - 90,000; Full time

Job summary

Transport for Wales is seeking a Cyber Security Operations Engineer to lead the design, implementation and continuous improvement of security controls across TfW cloud and on‑premises platforms.

You will drive vulnerability remediation, enhance monitoring with SOC/MSSP, and oversee SIEM/SOAR use cases while coordinating with architecture, engineering and delivery teams to ensure secure and resilient business services.

Qualifications

• Professional cyber security certification or equivalent practical experience.
• Experience leading security engineering, operational security, or technical security improvement workstreams.
• Experience implementing and managing security controls across cloud and on-premise environments.

Responsibilities

• Own design authority and lifecycle management of security controls across TfW platforms.
• Drive vulnerability management with tooling, governance, reporting and risk-based remediation.
• Develop and enhance monitoring and detection with SOC and MSSP providers.
• Lead integration strategy for security technologies including EDR, IAM and cloud security solutions.
• Provide senior technical leadership during cyber security incidents and investigations.

Skills

Security engineering

Vulnerability remediation

Cloud security (Azure)

SIEM/SOAR

SOC collaboration

ISO27001/NCSC CAF

Stakeholder communication

Education

CompTIA Security+

Microsoft Security Certifications

ISC2 CISSP / CC

Tools

EDR

IAM

MSSP tooling

Job description

The Cyber Security Operations Engineer for Transport for Wales (TfW) will be responsible for the implementation, configuration, and continuous improvement of technical security controls across TfW's cloud and on-premises platforms.

Role responsibilities

• Own the design authority and lifecycle management of technical security controls across TfW platforms by defining control standards, governing technical designs, and working with architecture, engineering, and delivery teams to embed security throughout the technology lifecycle, to provide scalable, risk-aligned protection that supports secure and resilient business services.
• Drive the vulnerability management capability across TfW technology services by overseeing tooling, governance, reporting, and risk-based remediation activities with technology teams and suppliers, to reduce exposure to vulnerabilities and strengthen organisational cyber resilience.
• Develop and enhance TfW's monitoring and detection capability by working with SOC and MSSP providers to improve visibility, coverage, and threat detection effectiveness, to enable the timely identification and response to cyber threats.
• Lead the integration strategy for security technologies by defining roadmaps, governing implementation, and optimising the use of platforms including EDR, IAM, and cloud security solutions, to deliver cohesive and effective security controls across the enterprise.
• Provide technical leadership for SIEM and SOAR capabilities by overseeing use cases, automation opportunities, and operational improvements with internal and external partners, to maximise security operations effectiveness and support intelligence-led threat detection and response.
• Drive the adoption of secure configuration standards across TfW platforms by establishing technical baselines, monitoring compliance, and supporting remediation activities, to maintain secure-by-default technology services aligned to recognised standards and organisational policy. Set and assure adherence to secure configuration standards, ensuring platforms are secure by default and aligned to recognised benchmarks and organisational policy.
• Embed secure-by-design principles across IT and Digital Services by collaborating with architects, engineers, and delivery teams throughout project and service lifecycles, to reduce security risk and improve the resilience of technology solutions.
• Lead the identification and management of technical security risks by working with system owners to assess, prioritise, remediate, and govern risk treatment activities, to support informed risk management and protect organisational assets.
• Define and maintain technical security standards, procedures, and design patterns by providing governance, assurance, and technical guidance across technology teams, to achieve consistent, compliant, and auditable implementation of security controls.
• Provide senior technical leadership during cyber security incidents by coordinating investigation, containment, recovery, and post-incident activities with relevant stakeholders, to minimise business impact and strengthen future security capabilities.

Whowe're looking for

• Professional cyber security certification such as CompTIA Security+, Microsoft Security certifications (e.g. SC-200, SC-300), ISC2 CC, CISMP, or equivalent practical experience.
• Demonstrable experience leading security engineering, operational security, or technical security improvement workstreams.
• Practical experience implementing and managing security controls across cloud and enterprise environments, including Microsoft 365, Azure, EDR, IAM, logging, SIEM, and cloud security technologies.
• Experience managing vulnerability remediation programmes, including vulnerability scanning, patch management processes, tooling, reporting, and risk-based prioritisation.
• Knowledge of cyber security principles, secure configuration standards, security monitoring, and detection practices, including working with SOC and MSSP providers.
• Ability to analyse technical security data, assess risk, and prioritise remediation activities, with an understanding of risk management and control assurance frameworks such as NCSC CAF and ISO27001.
• Experience influencing and providing technical guidance to both technical and non-technical stakeholders, including senior leaders, to support effective security and risk-based decision-making.

Welsh Language Skills

While not essential for this role, Welsh language skills would make a great addition to your application.

TfWsupport anyone who wants to learn Welsh or improve their skills. We offer online learning, classroom courses and funding attendance at local community courses.

We're changing the way the transport industry looks. By celebrating and embracing differences, we're building a workforce that represents Wales. We need talented people from all backgrounds and cultures to bring their perspectives and experiences. Diverse teams make better decisions and drive innovation. Join us in transforming the way Wales travels."

Who we are

Transport for Wales is changing the way Wales travels, making sustainable transport the first choice. We're building a multimodal integrated transport network called the T Network, making it easier for people to travel by train, bus, walking, wheeling and cycling.

Next steps

We're a Disability Confident Leader. Let us know about any reasonable adjustments you may need in the recruitment process and as part of the role if you are successful.

This advert will close at 23:59 on the day of the application closing date stated above. However, we reserve the right to close this vacancy early if we receive enough applications.