Security Operations Lead -

Sanderson Government & Defence; Inverness; On-site; GBP 92,000 - 111,000; Full time

Job summary

Sanderson Government & Defence is seeking a Security Operations Lead to govern and orchestrate security incident management across multiple suppliers. You will provide governance, assurance, and strategic oversight, ensuring incidents are escalated, evidenced, reviewed, and reported to the client through a controlled, audit-ready process without performing operational response activities.

The role requires SC clearance, 5 days onsite in Inverness or Preston, and an initial contract to

Qualifications

• Significant experience in Security Incident Management, Cyber Governance, Service Management, or GRC roles.
• Strong understanding of security incident lifecycles, major incident management, and security reporting.
• Experience working within complex multi-supplier environments.
• Strong stakeholder engagement and supplier management skills.
• Experience presenting incident risk information to senior stakeholders.
• Knowledge of CSF, NCSC guidance, ITIL Major Incident Management, ISO 27001.

Responsibilities

• Govern security incident governance across suppliers and define the incident management framework.
• Maintain incident classification criteria, escalation models, reporting standards, and major incident governance processes.
• Ensure alignment to client policies, regulatory obligations and security controls.
• Lead supplier governance and performance management for incident governance and escalation.
• Drive consistency in reporting, escalation, communications, and evidence standards.
• Provide executive oversight of incident risk and risk-based decision making.
• Produce consolidated incident reporting and dashboards across suppliers.
• Support audits, assurance reviews, and regulatory inspections.
• Coordinate Post Incident Reviews and ensure root cause analysis and corrective actions.

Skills

Security incident management

Cyber governance

Service management

GRC roles

Multi-supplier environments

Stakeholder engagement

Senior stakeholder communication

Job description

Role Title: Security Operations Lead

Clearance: SC Cleared

Location: Inverness or Preston | 5 days onsite

Initial Contract to 31/03/2027

Pay: £500 - £600

Status: Inside IR35

Role Description:

The Senior Security Incident Management Consultant operates within the Operational Integrator (OI) function and provides governance, leadership, assurance, and strategic oversight of security incident management across a complex multi-supplier environment.

The role is responsible for ensuring suppliers manage security incidents consistently, effectively, and in accordance with client policy, regulatory obligations, and operational risk requirements. Acting as the primary OI lead for incident governance, the consultant provides a consolidated view of incident risk, drives supplier accountability, and supports continual improvement across the incident management lifecycle.

Key Responsibilities:

Security Incident Governance

• Own and govern the security incident management framework across suppliers
• Define and maintain:
  • Incident classification criteria
  • Escalation models
  • Reporting standards
  • Major incident governance processes
• Ensure alignment to client policies, regulatory obligations, and security controls

Supplier Governance & Performance Management

• Act as the primary OI lead for security incident governance
• Challenge, validate, and assure supplier incident management processes
• Drive consistency in reporting, escalation, communications, and evidence standards
• Manage escalations relating to significant or recurring incidents

Incident Risk & Executive Oversight

• Maintain visibility of security incident exposure across all suppliers
• Ensure major incidents receive appropriate governance attention
• Support risk-based decision making through accurate incident reporting
• Provide oversight of supplier corrective and preventative actions

Reporting & Executive Visibility

• Produce consolidated security incident reporting across suppliers
• Provide insight into:
  • Incident trends
  • Response performance
  • SLA adherence
  • Recurring root causes
  • Risk exposure
• Support governance boards, service review meetings, and client security leadership

Assurance & Evidence Management

• Define incident management evidence requirements
• Ensure traceability across:
  • Detection
  • Escalation
  • Investigation outcomes
  • Recovery activities
  • Closure decisions
• Support audits, assurance reviews, and regulatory inspections

Post-Incident Review & Continuous Improvement

• Coordinate governance of Post Incident Reviews (PIRs)
• Ensure suppliers provide:
  • Root cause analysis
  • Corrective actions
  • Improvement activities
• Identify opportunities to improve incident governance, reporting, and operational effectiveness

Your skills and experience

Essential

• Significant experience in Security Incident Management, Cyber Governance, Service Management, or GRC roles
• Strong understanding of:
  • Security incident lifecycles
  • Major incident management
  • Security reporting and governance
• Experience working within complex multi-supplier environments
• Strong stakeholder engagement and supplier management skills
• Experience presenting incident risk information to senior stakeholders

Desirable

• Knowledge of:
  • NIST Cyber Security Framework (CSF)
  • NCSC guidance
  • ITIL Major Incident Management
  • ISO 27001
• Experience supporting security assurance and audit activities
• Experience in Defence, Government, or highly regulated sectors

Key Deliverables

• Security Incident Management Framework
• Consolidated supplier incident reporting
• Executive incident dashboards
• Governance and assurance reporting packs
• Post Incident Review governance outputs
• Continuous improvement roadmap

Role Definition

The role governs and assures security incident management across suppliers, ensuring incidents are consistently escalated, evidenced, reviewed, and reported to the client through a controlled and audit-ready process, without performing operational security response activities

Reasonable Adjustments:

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.

If you need any help or adjustments during the recruitment process for any reason, please let us know when you apply or talk to the recruiters directly so we can support you.