Secuity Operations Lead

Morson Talent; Glasgow; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

Scottish Power in Glasgow is seeking a Security Operations Lead for an initial 12-month contract, likely to extend. The role is based at client offices with a hybrid pattern, three days in the office, as part of SP Energy Networks' security transformation to reduce risk and achieve regulatory compliance.

The successful candidate will be the SME for security incident detection and response, drive improvements across both outsourced and in-house SOC teams, configure SIEMs, onboard sources, and

Qualifications

• Experience configuring SIEM tools and onboarding sources.
• Ability to write detections and alerts across OT and IT environments.
• Experience leading security operations and incident response.
• Familiarity with cyber security frameworks and regulatory awareness.

Responsibilities

• Support Security Operations Manager in running BAU activities.
• Design and maintain incident response processes and escalation paths.
• Manage security controls across in-house and outsourced SOCs.
• Review incidents, perform root-cause analysis and implement mitigations.
• Ensure compliance with policy and SLAs; drive process improvements.
• Oversee daily management of security tools and integration across platforms.

Skills

SIEM configuration

SOC experience

Incident management

Security operations

Education

Degree or Diploma in a relevant field

Tools

SIEM tools

Job description

Our client Scottish Power are looking for a Security Operations Lead for an initial 12 month contract role, which will in all likelihood extend further.

This is based at the client offices in Glasgow, working hybrid, 3 days in the office.

SP Energy Networks (SPEN) has kicked off an ambitious security transformation programme to transparently reduce risk, achieve compliance with NIS regulations and deliver a cyber resilient business, the Security Operations Lead will be essential in achieving our goals.

The Security Operations Lead will be a subject matter expert on security incident detection and response.

They will drive continuous improvement across the outsourced SOC and in-house SOC teams of analysts and engineers.

Youll have experience of configuring SIEM tools, onboarding sources, writing processes and alerts, understanding business environments and managing incidents affecting applications and infrastructure across a varied technology stack spanning operational technology and information technology environments.

You'll also be able to undertake post incident reviews to identify root causes and put follow-up mitigations in place.

The postholder will work within a security operations team containing various cyber security functions such as threat intelligence, identity & access management, response & recovery and vulnerability management.

What Youll be doing

• Support the Security Operations Manager in the running of BAU activities
• Implement and maintain 3rd line security incident / event management, escalation and technical response process and investigate suspected and actual incidents / events. Acting as a key escalation point in the team to the relevant team/individual
• Design, implement, manage, monitor, and upgrade security measures for the protections of the information systems and networks
• Identify and feedback any potential improvements from a cyber perspective to OT systems and infrastructure
• Ensuring incident identification, assessment, quantification, reporting, communication, mitigation and monitoring
• Ensuring compliance to policy, process, and procedure adherence and process improvisation to achieve operational objectives
• Revise and develop processes to strengthen the current Security Operations Framework
• Review policies and highlight the challenges in managing SLAs
• Ensuring daily management, administration & maintenance of security technology to achieve operational effectiveness
• Ensure the orchestration and integration of security services and platforms to maximise its usage and coverage
• The role will be integrated into an active and ambitious global cyber security function, contributing to SPEN's cyber security purpose of delivering cyber resilient OT and IT, to enable a safe and reliable electricity supply to customers

What Youll bring

• Skills and experience in understanding at a technical level security operations.
• Awareness of key legislation and regulation impacting IT/OT General Control requirements in an energy utility.
• Experience in working within a SOC.
• Record of academic achievement, including some form of recognised qualification from further education, such as a degree or diploma.
• Good oral and written communication skills.
• Must be a proven team player to work, promote and consolidate efficient team working relationships.