Security Operations Manager

ZipRecruiter; Crawley; On-site; GBP 60,000 - 100,000; Full time

Job summary

An established industry player in the power sector is seeking a proactive Security Operations Manager to lead their in-house security team. This pivotal role involves managing cyber security operations, enhancing incident response strategies, and fostering a culture of continuous improvement. The ideal candidate will possess extensive experience in cyber defense leadership, a solid educational background in cybersecurity, and relevant industry certifications. Join a forward-thinking organization dedicated to optimizing security measures and ensuring operational resilience against emerging threats. This is an exciting opportunity to make a significant impact in a dynamic environment.

Qualifications

• 5+ years leading Cyber Security Defense and Operations teams.
• Bachelor's degree in Cybersecurity or related field required.
• Industry-recognized qualifications like CISSP or GIAC preferred.

Responsibilities

• Manage the Cyber Security Response team and third-party services.
• Lead incident response and develop cyber security incident response plans.
• Drive security orchestration and automation solutions.

Skills

Cyber Security Defense Leadership

Incident Response Management

Cyber Threat Detection

Cyber Security Metrics Reporting

Team Development and Coaching

Education

Bachelor's Degree in Cybersecurity or related field

Industry-recognized security qualifications (CISSP, GIAC)

Tools

SIEM solutions (e.g., FortiSIEM, Q-Radar)

SOAR technologies

EDR, AV, IDS/IPS tools

Data Loss Prevention tools

Job description

Job Description

We have been closely working with a company in the power sector to build an inhouse security team and we are in search for a Security Operations Manager. They are looking to become the best performer in its's sector and building a team to achieve this through the provision of technology solutions, as well optimising of current solutions to improve how the company operates.

This role works closely with the Cyber Security Architecture Manager, Cyber Security Testing Manager, Cyber Security Governance Manager, Cyber Security Portfolio Manager, and Cyber Security Engineering Manager. This role will support all other team members, the rest of Information Systems team, IT Service Providers and business stakeholders across the company to implement and optimise cyber security operations capabilities.

Responsibilities

• Accountable for managing the Cyber Security Response team and the quality of third party services and deliverables, reviewing performance, and driving continuous improvement.
• Take the lead management responsibility for all cyber security event monitoring and incident response services received from all partner organisations with particular focus on the company’s Manage Security Service relationship (MSS).
• Proactively manage the search for cyber threats that may go undetected in our environment that have evaded our automated security tools and defences.
• Accountable for Cyber Security incident response management including the establishment, maintenance and improvement of cyber security incident response plans, procedures, and playbooks.
• Manage post-incident activity to include scheduling and chairing Post Incident Reviews (PIR), the documentation of Root Cause Analysis (RCA) for security incidents and the tracking of actions to prevent incident recurrence and strengthen relevant controls.
• Plan, execute and learn lessons from regular cyber-attack simulation exercises to test the company’s IT and organisation resilience to improve cyber defences and attack preparedness.
• Manage and maintain the suite of Cyber Security tools and platforms to enable effective prevention and detection of cyber threats.
• Drive security orchestration, automation, and response (SOAR) solutions for systems and operational playbooks to enable efficient discovery of security events and response actions.
• Produce relevant and accurate cyber security metrics dashboards and reports for both technical and business stakeholders on the performance and effectiveness of the companies continuous cyber security monitoring, defence and incident response capabilities.
• Drive and undertake effective role-modelling, coaching, mentoring, development, motivation and evaluation of staff within the team, creating an environment where the team excels.
• Support the development and implementation of the companies Cyber Security Strategy ensuring alignment to the company vision, values and strategic objectives.
• Deputise for the Head of Cyber Security and Technology Risk as required for certain pre agreed tasks and activities.

Skills, Qualification and Experience

• Minimum 5 years+ experience leading Cyber Security Defense and Operations teams.
• Bachelor's Degree in Cybersecurity, Computer Science, Information Systems, related field or equivalent training and/or experience.
• Hold an industry recognised information security qualification such as GIAC/GCIA/GCIH, CISSP or CompTIA Advanced Security Practitioner (CASP+) and/or SIEM-specific training and certification.
• An understanding and knowledge of compliance and regulatory frameworks such as Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF) and ISA/IEC 62443, ISO/IEC 27001/27002, GDPR.
• Working knowledge of security technologies including but not limited to SIEM, SOAR, EDR, AV, IDS/IPS, NAC, AD, DLP, Web Filtering, Email Filtering, Behavioural Analytics.
• Knowledge of adversarial tactics, techniques, procedures (TTPs) and industry standard frameworks (Mitre ATT&CK).
• Practical experience of incident response governance (lifecycles, frameworks, incident handling, etc.) and developing incident response playbooks/processes, Security Orchestration, Automation and Response (SOAR), running red-team exercises and tabletop crisis war games.
• Working knowledge of SIEM and SOAR solutions, and Access Management and Data Loss Prevention tools and technologies preferably including FortiSIEM, Q-Radar, Sentinel, Darktrace, Microsoft Defender.
• Log correlation and analysis, including chain of custody and forensics investigations and requirements.
• Experience managing suppliers for an outsourced Managed Security Services (MSS) in an environment with both internal and external IT service providers.
• Experience with monitoring Operational Technology (OT) systems, including Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA)
• Experience working within a regulated environment, preferably Energy sector Critical Infrastructure (CNI)