Lead SOC Manager

National Highways; West of England; Hybrid; GBP 90,000 - 115,000; Full time

Job summary

National Highways is recruiting for a Lead SOC Manager to steer the Security Operations Centre, guiding incident response and risk reduction across IT, OT, people and physical security. The role demands strong leadership of diverse teams and collaboration with senior stakeholders.

You will oversee security monitoring, threat intelligence and remediation efforts, while championing continuous improvement and robust security posture across the organisation.

Qualifications

• Proven experience leading diverse security teams and SLAs.
• Advanced expertise in managing complex security incidents and investigations.
• Strong knowledge of threat detection, incident response and vulnerability management.
• Excellent communication with executives, governance and stakeholders.

Responsibilities

• Set the overall direction for the SOC and align priorities with government security standards.
• Lead day-to-day delivery of the hybrid SOC, overseeing monitoring, response, vulnerability management and threat intel.
• Act as SME for technical security and escalation point for major incidents.
• Drive continuous improvement of incident remediation processes and provide actionable recommendations to senior management.
• Mentor Security Analysts and foster collaboration across Security Operations, GRC, and partners.

Skills

SOC leadership

Incident response

Threat detection

Stakeholder engagement

Security architectures

Tools

SIEM

SOAR

EDR

IDS/IPS

Job description

As part of the development of our Digital Services function, we are recruiting to strengthen internal digital capability within Cyber Security, Digital Operational Services, and Digital Corporate and Shared Services. These roles are central to building sustainable in-house expertise that supports the management, development and delivery of digital solutions across the transport network.

As Lead SOC Manager you will be responsible for leading and managing all activities within the Security Operations Centre (SOC), including security incident response across SOC and National Highways. You will bring together people, processes, and technology within the SOC to deliver operational excellence, while providing leadership and direction to Security Analysts. You will guide and set direction for the escalation and resolution of IT, OT, personnel, and physical security incidents. Coordinate and align SOC efforts to protect National Highways' personnel, critical assets, and sensitive information.

This is a hybrid role, requiring two days per week in the office, and can be based at any National Highways office location across the UK, with some travel to attend team meetings.

Successful candidates will be required to hold or be willing to obtain SC clearance before starting employment. Five years' UK residency is normally required for the vetting process, although individual circumstances will be considered as part of the recruitment process.

• Set the overall direction for the SOC, aligning its priorities with organisational objectives and government security standards. Represent the SOC in leadership forums and serve as the primary liaison with senior management, governance, assurance, and key stakeholders.
• Lead the operational day to day delivery of the hybrid SOC delivery model. Manage and lead the delivery of SOC services, providing tactical leadership and oversight for security monitoring, incident response, vulnerability management, and threat intelligence.
• Be a technical security Subject Mater Expert (SME).
• Oversee the detection, analysis, and resolution of security incidents and breaches. Act as the escalation point for major incidents, leading investigations and coordinating response and mitigation efforts.
• Drive security assessments, including penetration testing, vulnerability assessments and risk evaluations, to identify and address weaknesses within National Highways' infrastructure and applications. Champion continuous improvement and enhancements to incident remediation processes and provide clear actionable recommendations to senior management to strengthen the organisation's security posture.
• Provide direction, guidance, and mentorship to Security Analysts. Foster collaborative culture that promotes knowledge sharing across Security Operations, GRC, third-party service providers, and Legal.

About you.

• Proven experience managing diverse teams, including permanent staff, contractors, and third-party suppliers.
• Advanced experience in managing complex, high-impact security incidents and investigations and in leading incident response lifecycle activities through to post-incident reviews.
• Strong technical expertise and proficiency in enterprise SOC tooling including SIEM, SOAR, EDR, IDS/IPS, with experience in the integration across IT and OT estates, people and physical security. Deep knowledge of threat detection, incident response, and vulnerability management, with a foundation in security frameworks such as MITRE ATT&CK and Cyber Kill Chain.
• Strong operational capability, with the ability to lead SOC service delivery and coordinate security incident response across IT, OT, people and physical security. Deep knowledge of computer networking principles and security architectures for both IT and Operational Technology environments.
• Excellent communication and stakeholder engagement skills, including the ability to report the security posture to executives and government bodies. Confidence acting as liaison between SOC and other departments, e.g. Digital Services, Fraud teams, People and Physical security).

About us.

Here at National Highways, we manage and improve England's motorways and major A roads, helping our customers have safer, smoother and more reliable journeys. Our priorities are safety, customers and delivery, and at the core of this, are our values of passion, integrity, safety, teamwork and ownership.

The Digital Services Directorate is helping to reshape the way National Highways operates by delivering digital, data, and technology services across all areas, from frontline to back office, in a modern and efficient manner. Our vision is to develop integrated information and technology that empowers our colleagues and provides real-time information to our customers, as well as integrating with intelligent vehicle and transport systems as they evolve, to enhance journey safety and reliability.

External candidates will be offered a starting salary at the lower end of the pay scale, while current employees will be appointed in accordance with our established pay policy.

We are committed to creating a diverse environment and welcome applicants from all backgrounds.