Hybrid SOC Lead — Incident Response & Security Ops

National Highways; United Kingdom; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

National Highways is expanding its Digital Services function and seeks a Lead SOC Manager to oversee the Security Operations Centre, guiding incident response, threat intelligence and vulnerability management across IT, OT, personnel and physical security. The role requires leadership of a diverse team and adherence to government security standards.

The position is hybrid, two days per week in office, with travel to team meetings.

Qualifications

• Experience managing diverse teams including permanent staff, contractors, and third-party suppliers.
• Advanced experience in managing complex, high-impact security incidents and investigations.
• Strong knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain.

Responsibilities

• Set the overall direction for the SOC and align priorities with organisational objectives and government security standards.
• Lead the day-to-day delivery of the hybrid SOC, including security monitoring, incident response, vulnerability management, and threat intelligence.
• Act as a technical security SME and escalation point for major incidents, coordinating response and mitigation.
• Drive security assessments, including penetration testing and risk evaluations, to address weaknesses.
• Provide direction and mentorship to Security Analysts and foster knowledge sharing across teams.

Skills

Leadership

Incident response

SOC tooling

MITRE ATT&CK

Cyber Kill Chain

Penetration testing

Tools

SIEM

SOAR

EDR

IDS/IPS

Job description

National Highways is expanding its Digital Services function and seeks a Lead SOC Manager to oversee the Security Operations Centre, guiding incident response, threat intelligence and vulnerability management across IT, OT, personnel and physical security. The role requires leadership of a diverse team and adherence to government security standards.

The position is hybrid, two days per week in office, with travel to team meetings.