GSOC Team Lead

NDA group; Greater London, Harwell; Hybrid; GBP 46,000 - 54,000; Full time

Benefits offered by this job

Hybrid working

Flexible working arrangements

Job summary

The Nuclear Decommissioning Authority seeks a dynamic GSOC leader to direct security operations, incident response, and threat hunting across the NDA group. You will translate threat intelligence into improved detection, coordinate across multiple operating companies and manage a skilled team in a hybrid environment.

You will develop playbooks, drive continuous improvement, and mentor graduates and junior analysts while participating in an on‑call rota and supporting cyber resilience across

Qualifications

• Educated to degree level in Cyber Security, Computer Science, Digital Forensics, Information Security or a related discipline, or able to demonstrate equivalent professional experience.
• Candidates should typically possess three years or more of relevant cyber security experience, although exceptional candidates will be considered.
• Experience in Security Operations, Incident Response, Threat Intelligence, Detection Engineering, Threat Hunting, Adversary Emulation, Digital Forensics or Cyber Defence.

Responsibilities

• Lead GSOC personnel delivering Security Operations, Incident Response, Threat Hunting, Detection Engineering and specialist cyber operations capabilities.
• Provide day‑to‑day operational leadership across GSOC monitoring, triage, investigation, containment and response activities, including on‑call oversight.
• Lead threat‑informed defence by translating threat intelligence, adversary emulation outputs, security testing and incident learning into improved detection and response.
• Develop and maintain GSOC playbooks, procedures and reporting artefacts; ensure auditable outputs.

Skills

Cyber security leadership

Security operations

Incident response

Threat hunting

Threat intelligence

OT security

AI-enabled security

Communication

Education

Degree in cyber security / CS / forensics or related

Job description

Flexible – Herdus House, West Cumbria, Hinton House, Warrington; London or Harwell, Oxfordshire Hybrid working available with 40% of time in an NDA office, CA24 3HU

Contract Type: Permanent

Salary: £45,815 - £53,900 dependent on skills and experience (incl. on call payment)

Job Category: Security and Corporate Services

Reporting to the GSOC Manager, this role is responsible and accountable for leading and managing GSOC analyst resources that deliver cyber security operations services across the NDA Group. The role will provide operational leadership, technical oversight and people management across a range of cyber security disciplines, ensuring the effective delivery of security monitoring, incident response, threat detection, threat hunting, threat intelligence integration and operational resilience activities.

The role is accountable for ensuring GSOC personnel deliver effective operational capability, whilst participating in an on-call rota, and developing specialist expertise aligned to business priorities across the NDA and its Operating Companies. Key specialisms include Security Operations and Incident Response, Detection Engineering and Security Analytics, Threat Hunting, Threat‑Informed Defence, Threat Intelligence integration, Operational Technology (OT) security monitoring, and AI‑enabled augmentation, automation and workflow optimisation .

The role will support the ongoing delivery, maturity and continuous improvement of GSOC services, ensure operational effectiveness while remaining flexible to respond to changing threat landscapes, cyber incidents, emerging technologies and business priorities . The GSOC Team Lead will work closely with wider cyber security functions, Operating Companies and external stakeholders to improve monitoring, investigation, detection capability, threat‑informed analysis, operational processes, service performance, reporting and cyber resilience outcomes .

What you’ll do

• Lead, manage and develop GSOC personnel delivering Security Operations, Incident Response, Threat Hunting, Detection Engineering and specialist cyber operations capabilities .
• Provide day‑to‑day operational leadership across GSOC monitoring, triage, investigation, containment and response activities, including participation in and oversight of on‑call arrangements .
• Lead threat‑informed defence activities by translating cyber threat intelligence, adversary emulation outputs, security testing and incident learning into improved detection, monitoring and response capabilities .
• Oversee the development, tuning, validation and continuous improvement of detection content, analytics, correlation rules, use cases and monitoring coverage across GSOC tooling.
• Lead proactive threat hunting across IT, cloud and Operational Technology environments using intelligence‑led, behavioural and hypothesis‑driven techniques .
• Support automation, orchestration and AI‑assisted capabilities to improve analytical capacity, investigation quality, response times and operational efficiency, ensuring appropriate governance, human oversight, auditability and risk management .
• Support the onboarding, correlation, enrichment and effective utilisation of security telemetry, threat intelligence and contextual data sources across GSOC customers .
• Lead and coordinate multi‑Operating Company cyber security incident response activities, ensuring effective communication, escalation, decision support and operational coordination .
• Provide technical leadership and subject matter expertise to NDA Operating Companies on cyber operations, security monitoring, detection engineering, threat‑informed defence and AI‑enabled security operations.
• Develop, maintain and continuously improve GSOC playbooks, procedures, operational standards, knowledge management and reporting artefacts, ensuring output remains controlled, repeatable and auditable.
• Contribute to service reviews, operational reporting, performance metrics, capability maturity assessments and strategic improvement initiatives across the NDA Group.
• Support the development of graduates, apprentices and junior analysts through coaching, mentoring, quality assurance and performance development activities .
• Participate in the on‑call rota for out‑of‑hours events and incidents
• Deputise for GSOC leadership as required
• Candidates must either hold or be capable of achieving SC security clearance

The successful candidate will be able to demonstrate:

• Leadership and operation of cyber security monitoring, detection, investigation, threat hunting and incident response activities within a Security Operations environment .
• Configuration, operation and continuous improvement of secure systems, security monitoring platforms and detection capabilities, including identification, investigation and response to cyber security incidents .
• Collection, analysis, application and operationalisation of cyber threat intelligence to inform monitoring, detection engineering, threat hunting and incident response activities .
• Detection engineering principles, including the development, tuning and validation of detection content, analytics, use cases and security monitoring coverage.
• Threat‑informed defence methodologies, including the application of adversary behaviours, attack chains and frameworks such as MITRE ATT&CK.
• Security challenges associated with cyber‑physical environments, Industrial Control Systems, Operational Technology, Internet of Things and large‑scale critical national infrastructure.
• Effective use of security automation, orchestration and AI‑assisted capabilities, including appropriate governance, human oversight, auditability and operational risk management.
• Communication of complex technical and operational issues to both technical and non‑technical stakeholders, including during incidents and periods of heightened operational activity.

Your background, skills, and strengths

• Educated to degree level in Cyber Security, Computer Science, Digital Forensics, Information Security or a related discipline, or able to demonstrate equivalent professional experience.
• Candidates should typically possess three years or more of relevant cyber security experience, although consideration will be given to exceptional candidates who can demonstrate equivalent levels of technical capability, operational responsibility and leadership potential.
• Candidates must be able to demonstrate practical experience within one or more of the following disciplines: Security Operations, Incident Response, Threat Intelligence, Detection Engineering, Threat Hunting, Adversary Emulation, Digital Forensics or Cyber Defence .
• Experience operating within complex enterprise, critical infrastructure, regulated or operational technology environments would be advantageous.
• Relevant industry certifications are desirable and may include CISSP, OSCP, CREST, CCP, SANS, EnCE, CompTIA, Microsoft Security certifications or equivalent recognised cyber security qualifications.
• Candidates who do not currently hold certifications but can demonstrate equivalent technical expertise, operational experience and leadership capability will also be considered.
• Academic qualifications, certifications and professional development are valued; however, demonstrated technical competence, operational experience and the ability to apply knowledge in real‑world cyber security environments will be given consideration during assessment .

We value the unique differences that each of our colleagues bring to work every day and are committed to creating an environment where everyone feels respected, included and able to perform at their best. At NDA, we are committed to creating a workplace that is diverse and inclusive . We value the diversity of our people and actively seek to have a workforce that represents the rich diversity of the communities we support .

Currently, we are underrepresented in some areas, and would particularly welcome applicants from Women, Black, Asian and Ethnic Minorities, LGBTQ+ and candidates who have a disability.

NDA is a member of the disability confident scheme, when requested we will make reasonable adjustments to the recruitment process and we guarantee to interview all candidates who have a disability who meet all of the essential criteria for the vacancy.

We are happy to discuss flexible working. We will also make workplace adjustments for disabled employees if these are needed to help them perform at their best in the role, and we are happy to discuss this once a job offer has been made.

The following content displays a map of the jobs location - Flexible – Herdus House, West Cumbria, Hinton House, Warrington; London or Harwell, Oxfordshire Hybrid working available with 40% of time in an NDA office

Salary

£45,815 - £53,900 dependent on skills and experience (incl. on call payment)

Job Category

Security and Corporate Services

Location

Flexible – Herdus House, West Cumbria, Hinton House, Warrington; London or Harwell, Oxfordshire Hybrid working available with 40% of time in an NDA office