Cyber Security Specialist (Operational)
NHS
Stand out for this role — generate a tailored resume and cover letter in about a minute.
Benefits offered by this job
Job summary
NICE – The National Institute for Health and Care Excellence is seeking a Cyber Security Specialist (Operational) to protect NICE's digital platforms and data. You will investigate security alerts, manage vulnerabilities, respond to incidents, and help ensure services remain secure and compliant.
The role requires hands-on security management across on-premise and cloud environments, with collaboration within the Infrastructure, Cyber & IT Operations team.
Qualifications
- Experience in cyber security operations and threat detection.
- Experience in incident response and vulnerability management.
- Familiarity with ISO27001 and Cyber Essentials standards.
Responsibilities
- Investigate security alerts, respond to incidents, and support cyber resilience.
- Configure and maintain security tooling across on-premise and cloud environments.
- Carry out routine vulnerability assessments and horizon scanning.
- Serve as escalation point for complex security issues.
- Support compliance with Cyber Essentials and ISO27001.
- Communicate risks and findings clearly to technical and non-technical stakeholders.
Skills
Education
Tools
Job description
The closing date is 02 October 2026
Do you want to do meaningful work that makes a genuine difference to society? Our main purpose here at The National Institute for Health and Care Excellence (NICE) is to improve health and wellbeing by putting science and evidence at the heart of health and care decision-making. As an organisation we all collaborate to achieve this goal by empowering our workforce to do great things!
Please note that this role may not be eligible for sponsorship under the Skilled Worker route. Please refer to the DirectGov website for more information on eligibility.
We reserve the right to close the advert early should we receive sufficient applications, so please don't delay your submission.
Please be aware interviews will be face to face in our Manchester Office.
As a Cyber Security Specialist (Operational), you will play a key hands on role in protecting NICE's digital platforms, systems, and data from cyber threats. Working as part of a collaborative cyber security function, you will investigate security alerts, manage vulnerabilities, respond to incidents and help ensure our services remain secure, resilient and compliant. The role combines technical expertise with clear communication, supporting both operational delivery and the continual improvement of NICE's cyber security posture.What the candidate will be expected to do / bring:o Act as a hands on cyber security specialist, investigating security alerts, responding to incidents and supporting day to day operational cyber resilienceo Configure, manage and maintain security tooling and infrastructure across on premise and cloud environments, embedding secure by design principles
o Carry out routine vulnerability assessments, threat analysis and horizon scanning to identify and mitigate emerging risks
o Serve as a technical escalation point for complex security issues, contributing expert analysis and practical solutions
o Support compliance with recognised security standards and frameworks (e.g. Cyber Essentials, ISO27001), maintaining clear and auditable records
o Communicate complex technical risks and findings clearly to both technical and non technical stakeholders
The Infrastructure, Cyber & IT Operations team plays a critical role in ensuring NICE's digital services are secure, resilient, and reliable. The team is responsible for safeguarding systems and information, supporting users across the organisation, and maintaining operational stability with minimal risk or disruption.
As part of this team, you will help protect nationally important digital services while enabling NICE to deliver trusted guidance and information to health and care users across England.
We are passionate and proud of the work we do and the impact we make. NICE offer:
- Generous NHS Pension - Secure your future with one of the most rewarding pension schemes in the UK
- Flexible working - Enjoy a healthy work-life balance with options like remote working, compressed hours and flexible start/finish times
- Exclusive discounts - Save on shopping, dining and more with a Blue Light CardTime to recharge - Start with 27 days' annual leave plus bank holidays
- Inclusive staff networks - Join supportive communities like Women in NICE, Race Equality Network, Disability Advocacy and NICE and Proud - we celebrate diversity
- Tailored development - Grow your career with personalised learning and development opportunities
To be considered for this role, you should be able to particularly demonstrate the person specification criteria in the job advert in your application. However, applicants should be able to demonstrate all essential criteria through the entirety of the recruitment process to be considered for the job. Please see job description attached for full list of responsibilities.
- Knowledge of Microsoft Defender, Sentinel, including Kusto Query Language (KQL), threat hunting, analytics rule development, security monitoring, incident investigation and automation capabilities.
- Holds highly developed specialist knowledge and expertise acquired through master's degree level or equivalent qualification/experience. Additionally holds specialist knowledge of the relevant area(s) of expertise as outlined in the person specification, acquired through relevant practical experience and training/development
- One or more of the following qualifications, or equivalent experience, is desirable for this role: FEDIP Senior Practitioner, Cyber Security Professional (ACSP) ,BCS Certificate in Information Security Management Principles (CISMP), SSCP Systems Security Certified Practitioner
- Extensive technical expertise across cyber security operations, threat detection, incident response, vulnerability management, security monitoring, and cyber risk reduction within complex enterprise environments. Experience gained through roles such as Security Analyst, SOC Analyst, Cyber Security Engineer, Incident Responder, or similar technical cyber security positions.
- Demonstrable experience as an individual contributor within a cyber security team, with clear evidence of personal ownership, technical decision-making, incident resolution, vulnerability remediation, and delivery of measurable security outcomes.
- Extensive hands-on experience across cyber security operations, threat detection, incident response, vulnerability management, security monitoring, and cyber risk reduction within complex enterprise environments. Proven experience in implementing, configuring, maintaining, and optimising security technologies including SIEM, EDR, XDR, SOAR, vulnerability management platforms, cloud security solutions, identity and access management controls, endpoint protection, and threat intelligence capabilities. Skilled in cyber incident investigation, threat hunting, security architecture, infrastructure hardening, digital forensics, and the application of industry best practices, standards, and frameworks to strengthen organisational resilience, improve security posture, and support operational cyber security objectives.
- Demonstrable hands-on experience securing, supporting, implementing, and improving cyber security controls across enterprises in Microsoft O365, Azure, AWS, and on-premises or cloud environments. Strong technical expertise in network security, cloud security, identity and access management, endpoint security, infrastructure hardening, vulnerability management, security monitoring, threat detection, and incident response. Candidates must be able to provide practical examples of how they have personally investigated security incidents, remediate vulnerabilities, implemented security controls, enhanced monitoring and detection capabilities, and applied risk-based decision making to identify, assess, and mitigate cyber security risks within live operational environments.
This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.
NICE – The National Institute for Health and Care Excellence
- Full-time
- Flexible working
- Home or remote working
- Compressed hours
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
