Security Operations Manager

Nominet; Oxford; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Early Finish Friday

30 days annual leave

Private healthcare

Pension scheme

EV scheme

Rewards platform

Medicash discounts

Annual company bonus

Job summary

Nominet is seeking a Cyber Security Operations Manager in the UK, hybrid with Oxford presence. You will lead daily security operations, oversee monitoring, incident response and vulnerability management, and direct a small team of analysts.

You will manage a SOC/MSSP, improve detection and response capabilities, and drive automation and playbooks to reduce manual effort while maintaining rigorous human oversight.

Qualifications

• Substantial experience in security operations, detection and response, including leading significant incidents.

Responsibilities

• Lead monitoring, detection, triage, escalation and incident response. Act as incident commander for material cyber incidents, from containment through recovery, communications and lessons learned.
• Own and exercise incident response plans and playbooks for critical services, cloud, identity, endpoints, suppliers and data compromise.
• Manage and challenge the SOC/MSSP on alert quality, triage, escalation and improvements in detection and response.
• Improve the tooling, logging, detection rules and response workflows across SIEM, EDR/XDR, cloud, identity and vulnerability management.
• Introduce automation and MITRE ATT&CK/NIST driven improvements to detection and triage.
• Prioritise vulnerabilities with clear risk owners and track through treatment and closure.
• Lead analysts, report to the CISO and senior stakeholders, and deputise for the CISO when required.

Skills

Security operations

Incident response

SOC management

Threat detection

Security telemetry

SIEM/EDR

Cloud security

Risk-based prioritisation

Stakeholder communication

Team leadership

Job description

Select how often (in days) to receive an alert: Create Alert

Location:

Hybrid, with a minimum of 20% in the Oxford office per month

About Us:

We’re Nominet – a world-leading domain name registry operating at the heart of the UK internet. While we're best known for running .UK domains, our DNS expertise also underpins critical internet infrastructure that government services, including the NHS, rely on.
As a public benefit company, our work has a positive impact on society. We’ve donated millions to projects that use technology to improve people’s lives and have committed to delivering £60m worth of support over the next three years.

The Role:

As Cyber Security Operations Manager, you’ll lead Nominet’s day‑to‑day security operations, helping to protect the critical services, infrastructure and data that people across the UK rely on. You’ll set the direction for monitoring, detection and incident response, and take the lead during significant cyber incidents. This is a hands‑on leadership role that calls for sound technical judgement and clear decisions under pressure.

You’ll be responsible for the effectiveness of our security tools and operational processes, including alert triage, incident response and vulnerability escalation. You’ll manage and challenge our SOC/MSSP provider, working closely with Technology, Engineering, GRC, Threat and Vulnerability colleagues to improve how we detect threats, respond to incidents and reduce risk.

A key part of the role is improving how security operations work. You’ll identify where SOAR, automation and AI-enabled tools can reduce manual effort and make triage and response more consistent, while ensuring changes are tested and subject to appropriate human oversight. You’ll lead a small team of analysts and use evidence from incidents, security telemetry and supplier performance to show where the operation needs to improve.

What You’ll Be Doing:

• Lead monitoring, detection, triage, escalation and incident response. Act as incident commander for material cyber incidents, from containment through recovery, communications and lessons learned.
• Own and exercise incident response plans and playbooks covering critical services, cloud, identity, endpoints, suppliers and data compromise.
• Manage and challenge the SOC/MSSP on alert quality, triage, escalation and measurable improvements in detection and response.
• Improve the effectiveness of security tooling, logging, detection rules and response workflows across SIEM, EDR/XDR, cloud, identity and vulnerability management.
• Introduce useful automation, including enrichment, case creation, triage and response playbooks. Use methods such as MITRE ATT&CK and NIST to improve detection and incident readiness.
• Ensure vulnerabilities and exposures are prioritised, assigned clear risk owners and tracked through treatment and closure.
• Lead and develop the analysts, report clearly to the CISO and senior stakeholders, and work with Engineering, Technology, GRC and Threat and Vulnerability colleagues. Deputise for the CISO on operational security matters when required.

About You:

• Substantial experience in security operations, detection and response, or a closely related cyber security discipline, including leading or coordinating significant incidents.
• Strong practical knowledge of security telemetry and tools across endpoints, networks, cloud, identity and applications, including SIEM and EDR/XDR.
• Experience managing or challenging a SOC, MSSP or managed detection and response provider, with a focus on service quality and outcomes.
• Hands‑on experience improving security automation, such as SOAR playbooks, alert enrichment, case workflows or response orchestration.
• Sound judgement on investigations, evidence handling and risk‑based vulnerability prioritisation, with familiarity with relevant frameworks such as MITRE ATT&CK, NIST, Cyber Essentials and ISO 27001.
• The ability to lead analysts, make decisions under pressure and explain technical risks clearly to senior stakeholders and other teams.
• Relevant certifications are welcome, but demonstrable operational experience matters most.
• As a manager at Nominet, you’ll also be expected to support people’s development, set clear goals, act with empathy and accountability, and help others understand the direction of the work.

What to expect next:

1st stage: Introduction call with a member of the TA team (30‑45 mins, Teams)

2nd stage: Hiring manager interview (60 mins, Teams)

3rd stage: Onsite interview & psychometric assessment (60 mins, Oxford)

Our Values:

• We Make Things Happen
• We Pull Together
• We Bring A Positive Mindset
• We Keep It Simple

Our people make things happen, but our values are our compass as a company, guiding our day‑to‑day work and building our culture. They reflect that we're strongest when we're proactive and pull together, while underlining the importance of a “glass half full” mindset and aiming to keep things simple for success.

What We Offer:

• Early Finish Friday – 34‑hour working week with full‑time pay (finish at midday on Friday)
• 30 days annual leave plus bank holidays, with the option to buy an additional 5 days
• Bupa private healthcare + Employee Assistance Programme
• Pension scheme matched to 7%
• Electric vehicle scheme with on‑site charging points
• Rewards platform with discounts at hundreds of retailers and restaurants
• Medicash discounts on routine healthcare including optical and dental
• Annual company bonus

Diversity Statement:

We're passionate about creating a workplace where every individual is valued, respected, and empowered. Somewhere we can benefit from all forms of diversity and discover the true value in our differences. If there are any adjustments we could make to the recruitment and selection process to support you, please let us know.

Security Statement:

Nominet is committed to the safeguarding and welfare of the internet and expects all employees and volunteers to share this commitment by participating in the relevant security and screening processes. All roles working for Nominet will be subject to a Baseline Personnel Security Standard (BPSS) check. Some roles, due to the nature of their work, will require additional security clearance.

Please note that Nominet is unable to provide visa sponsorship or relocation support for this position.