DV-Cleared Cyber Security Specialist: Incident Response Lead

BT Group; Reading; On-site; GBP 65,000 - 90,000; Full time

Benefits offered by this job

DV allowance up to £5k per annum

25 days annual leave

BT pension scheme

World-class training

Flexible benefits

Job summary

BT Group is seeking a security operations professional based near Reading to monitor, detect and respond to security incidents. You will lead incident response activities, perform threat hunting, and develop robust detection rules and playbooks to strengthen security operations.

The role requires DV level security clearance and a commitment to operate on-site, with a comprehensive package including a DV allowance and extensive development opportunities within BT’s security teams.

Qualifications

• Experience in Security Operations Centre (SOC), Cyber Defence, or Incident Response environments.
• Strong knowledge of cyber security frameworks (e.g. MITRE ATT&CK) and defensive controls.
• Hands-on experience with SIEM, EDR/XDR, vulnerability management, and email security technologies.

Responsibilities

• Monitor, analyse, and respond to security alerts and events from SIEM, EDR, NDR, and other security monitoring platforms.
• Act as an incident response lead for cyber security incidents where required, ensuring timely resolution and clear communication with stakeholders.
• Conduct threat hunting to identify emerging threats and weaknesses across the environment(s).
• Develop and maintain security use cases, detection rules, playbooks, and procedures for improved monitoring and response capabilities.
• Integrate threat intelligence into security operations to translate indicators into actionable use cases and responses.
• Mentor and escalate for cyber security analysts, promoting best practices and team development.

Skills

SOC experience

MITRE ATT&CK

SIEM/EDR

Threat hunting

Incident response

Tools

Elasticsearch/Kibana

Jira/Confluence

Job description

BT Group is seeking a security operations professional based near Reading to monitor, detect and respond to security incidents. You will lead incident response activities, perform threat hunting, and develop robust detection rules and playbooks to strengthen security operations.

The role requires DV level security clearance and a commitment to operate on-site, with a comprehensive package including a DV allowance and extensive development opportunities within BT’s security teams.