Interim Cyber Security Officer

Civic Recruitment Limited; Greater London; On-site; GBP 75,000 - 105,000; Full time

Job summary

Civic Recruitment Limited is seeking a senior cybersecurity engineer for a 6-month contract with a local authority in London. You will lead CrowdStrike Falcon deployment and ongoing management, design and tune Splunk dashboards, and act as a technical escalation point for security incidents.

You will mentor the internal team, help mature security capabilities during a period of transition, and drive threat detection, incident response and automation enhancements within the SOC.

Qualifications

• Minimum of 5+ years’ experience in Cyber Security Engineering or SOC Tier 3 role.
• Hands-on experience with endpoint security and SIEM platforms in enterprise environments.
• Experience supporting or working with managed SOC providers.
• At least 2 years’ experience in vulnerability assessment tools (desirable).
• Exposure to penetration testing and web application security testing (desirable).
• Expert-level experience with CrowdStrike Falcon (Prevent, Insight, Discover).
• Strong expertise in Splunk, including SPL, dashboards, alerts, and Splunk ES.
• Solid understanding of network protocols, cloud security (AWS/Azure), and threat detection.
• Working knowledge of the MITRE ATT&CK framework.
• Experience building automation or SOAR playbooks for security operations.
• CrowdStrike certifications (CCFA / CCFR / CCSE – any combination preferred).
• Splunk Certified Cybersecurity Defense Engineer (mandatory preferred).
• Security certifications such as Security+, CySA+, GSEC, CISSP, GCIH, GCIA, or CCSP (desirable).

Responsibilities

• Lead the deployment, configuration, and ongoing management of the CrowdStrike Falcon platform, including endpoint protection policies.
• Collaborate with the SOC provider to design, optimize, and maintain Splunk dashboards, alerts, and security data models.
• Serve as a technical escalation point for high‑severity security incidents, facilitating rapid investigation, containment, and remediation using EDR and SIEM tools.
• Develop and implement SOAR workflows to automate detection, response, and security operations processes.
• Conduct proactive threat hunting using SIEM/EDR data and MITRE ATT&CK-aligned techniques.
• Support vulnerability assessment and security scanning activities using relevant tools.
• Provide input into penetration testing activities and interpret findings for remediation.
• Deliver training, coaching, and knowledge transfer to enhance the existing cybersecurity team's skills in CrowdStrike, Splunk, and threat analysis.
• Contribute to the development of security policies, standards, and technical documentation as needed.

Skills

CrowdStrike Falcon

Splunk (ES, SPL)

EDR

SIEM

MITRE ATT&CK

SOAR

Threat hunting

Vulnerability assessment

Penetration testing

Cloud security (AWS/Azure)

Automation / scripting

Education

CrowdStrike certifications (CCFA/CCFR/CCSE)

Splunk Certified Cybersecurity Defense Engineer

Security certifications (Security+, CySA+, GSEC, CISSP, GCIH, GCIA, CCSP)

Tools

Splunk Enterprise Security

CrowdStrike Falcon platform

Job description

Hackney, United Kingdom | Posted on 03/06/2026

At Civic Recruitment and Limited, we know that individuals are more than just fixed expenses; they are the cornerstone of every thriving organisation. That’s why we are passionate about transforming recruitment in the public and private sectors.

In the modern job market, organisations in both public and private sectors face significant workforce challenges. Public sector entities, such as local councils and central government departments, often struggle with lengthy recruitment processes, limited access to qualified candidates, and stringent budgetary and regulatory constraints. Private sector businesses, on the other hand, encounter high turnover rates, difficulties managing a mix of permanent and temporary staff, and challenges in sourcing specialised talent for niche industries. These sector‑specific obstacles, coupled with the universal complexities of payroll management, create a pressing need for efficient workforce solutions.

Civic Recruitment Limited addresses these challenges with innovative recruitment and payroll solutions tailored for diverse organisational needs. Recognising the critical hurdles organisations face, the company leverages its expertise to streamline processes, reduce recruitment times, and alleviate administrative burdens. With an extensive database of over 1 million pre‑screened candidates, Civic Recruitment Limited is well‑positioned to cater to the specific needs of both public and private sectors.

Job Description

6-month contract opportunity with a local authority

Summary

• This is a 6-month contract opportunity with a local authority, focused on providing senior‑level cybersecurity engineering expertise. The role is pivotal in supporting and optimizing the Council’s outsourced Security Operations Center (SOC) through the use of CrowdStrike and Splunk platforms. The successful candidate will ensure the effective integration, configuration, and operational use of security tools to enhance threat detection, incident response, and overall security maturity. Additionally, the role involves providing technical leadership, mentoring, and knowledge transfer to bolster internal cyber capabilities during a period of team transition.

Key Responsibilities

• Lead the deployment, configuration, and ongoing management of the CrowdStrike Falcon platform, including endpoint protection policies.
• Collaborate with the SOC provider to design, optimize, and maintain Splunk dashboards, alerts, and security data models.
• Serve as a technical escalation point for high‑severity security incidents, facilitating rapid investigation, containment, and remediation using EDR and SIEM tools.
• Develop and implement SOAR workflows to automate detection, response, and security operations processes.
• Conduct proactive threat hunting using SIEM/EDR data and MITRE ATT&CK‑aligned techniques.
• Support vulnerability assessment and security scanning activities using relevant tools.
• Provide input into penetration testing activities and interpret findings for remediation.
• Deliver training, coaching, and knowledge transfer to enhance the existing cybersecurity team's skills in CrowdStrike, Splunk, and threat analysis.
• Contribute to the development of security policies, standards, and technical documentation as needed.

Requirements

• Minimum of 5+ years’ experience in Cyber Security Engineering or SOC Tier 3 role.
• Strong hands‑on experience with endpoint security and SIEM platforms in enterprise environments.
• Experience supporting or working alongside managed SOC providers.
• At least 2 years’ experience in vulnerability assessment tools (desirable).
• Exposure to penetration testing and web application security testing (desirable).
• Expert‑level experience with CrowdStrike Falcon (Prevent, Insight, Discover).
• Strong expertise in Splunk, including SPL, dashboards, alerts, and Splunk Enterprise Security (ES).
• Solid understanding of network protocols, cloud security (AWS/Azure), and threat detection methodologies.
• Working knowledge of the MITRE ATT&CK framework.
• Experience building automation or SOAR playbooks for security operations.
• CrowdStrike certifications (CCFA / CCFR / CCSE – any combination preferred).
• Splunk Certified Cybersecurity Defense Engineer (mandatory preferred requirement).
• Security certifications such as Security+, CySA+, GSEC, CISSP, GCIH, GCIA, or CCSP (desirable).