Cyber Threat Operations Specialist

Cyber UK; United Kingdom; Remote; GBP 70,000 - 100,000; Full time

Job summary

Cyber UK is seeking a Cyber Threat Operations specialist to support the Active Defence Incident Response Team within Digital Excellence. You will assist in countering cyber threats, provide threat hunting and detection engineering, and work within a high-performing UK team.

The role involves collaboration with the UK SOC, InfoSec teams, and infrastructure domains to monitor, analyse and respond to security events across the UK network perimeter.

Qualifications

• Background in cyber security with emphasis on threat hunting and incident response.
• Experience with SIEM, network monitoring and security analytics.
• Familiarity with threat intelligence and behavioural analytics.
• Understanding of OSI model and common protocols.
• Good communication with business and suppliers.

Responsibilities

• Support incident response manager in countering cyber threats.
• Conduct proactive threat hunting with CTI.
• Lead threat detection engineering efforts.
• Maintain security technologies and tools.
• Assist investigations and routine security meetings.
• Collaborate with UK SOC and InfoSec teams.

Skills

Threat Hunting

Incident Response

Security Monitoring

SIEM

Network Security

YARA

Sigma rules

OSI Model

Tools

SIEM tools

Packet capture

Threat detection

Anti-malware

Job description

• Location: Stevenage, Hertfordshire, England


• Salary: Umbrella


• Category

• Sector:


• Contract type Contract


• Consultant: Michael Murray

An opportunity has arisen in the Active Defence Incident Response Team within Digital Excellence (DEX) for a Cyber Threat Operations specialist. Supporting the Active Defence & Incident Response Manger in assisting DEX meet the challenges and demands of countering the Cyber Threat. The successful applicant will drive a proactive ethos in an ever-changing cyber security environment and provide robust threat hunting, detection Engineering and analysis within a high performing team environment.

Responsibilities:

To support the Active Defence Incident Response Manager in assisting Information Management UK meet the challenges and demands of countering the Cyber Threat. Support for the operational functions of the UK SOC. To work with other UK SOC members, including the UK InfoSec Team and the IM Domains (Customer Support and Infrastructure / Information Systems).
It will cover Threat hunting, analysis, monitoring, Optimising, reporting, alerting and investigation activity utilising a wide variety of security platforms including AI/ML and behavioural analytics, SIEM (Security Information Event Management), Network Packet Capture platform, Anti Malicious Code, Threat Detection technologies and platforms across the UK Network Perimeter working with the best standard technologies.The Cyber Threat Operations specialist reports to the Active Defence & Incident Response Manager. The Cyber Threat Operations specialist conducts a range of analysis and assists the incident response team with investigations that need to be escalated to an embedded member of staff.The Cyber Threat Operations specialist key responsibilities are:

• Conduct proactive Threat Hunting in collaboration with the CTI function


• Lead Threat Detection Engineering effort working with the ISR function


• Assist with the maintenance of Security technologies


• Assisting the Cyber Eng Team with project activity


• Supporting the Incident responders with HR and InfoSec related investigations


• Attend routine security meetings

Skillset:

• A career background in Cyber Security. Security awareness in all areas of IT, primarily Network Security, Infrastructure and the secondary area being Operating Systems & Applications.


• Demonstrable knowledge with YARA and Sigma rulesets


• Knowledge of IT Security standard methodologies.


• Demonstrable understanding of the OSI Reference Model and the network communication protocols, including but not limited to DNS, HTTP/S, SSL, SMTP, FTP/S, LDAP/S.


• Security Information Event Monitoring Tools and/or Network Packet Capture tools.


• IDS/IPS technologies and threat hunting activities.


• Strong analytical mind-set.


• Defensive Cyber-attack methodologies and frameworks.


• Understanding of Malware capabilities, attack vectors, propagation and impact.


• Good communication skills liaising with the business and suppliers.