Senior Threat Hunter

Sellafield; United Kingdom; Remote; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Annual bonus up to 10–15%

Pension scheme

30 days annual leave + bank holidays

Cycle to Work Scheme

Learning & Development opportunities

Job summary

Sellafield Ltd is seeking a Senior Threat Hunter to lead proactive threat detection across IT and OT in a regulated nuclear environment. You will develop advanced methodologies, integrate threat intelligence, and drive automation while mentoring junior staff and ensuring compliance with security standards.

The role focuses on uncovering adversary tactics, balancing technical delivery with collaboration, and contributing to continuous cyber defence improvement within a safety-critical site.

Qualifications

• Essential: extensive threat hunting, SOC operations, or cyber forensics experience.
• Understanding of TTPs and MITRE ATT&CK frameworks.
• Familiarity with SIEM platforms and threat intel integration.
• Scripting skills (Python, PowerShell, REGEX) to support hunting and automation.
• Strong analytical and communication abilities.

Responsibilities

• Develop and maintain structured threat hunting methodologies and playbooks.
• Execute threat hunting activities to identify indicators of compromise and emerging techniques.
• Identify telemetry gaps and work with SOC engineering to improve data visibility and detection logic.
• Adapt hunting methodologies for OT environments with limited telemetry and safety requirements.
• Analyze threat intelligence and correlate with internal telemetry to detect risks.
• Develop and refine hunting hypotheses based on adversary TTPs and MITRE ATT&CK.
• Produce clear reports and remediation recommendations.
• Assist incident response with technical analysis and threat context.

Skills

Threat hunting

SOC operations

Cyber forensics

Python

PowerShell

REGEX

Analytical skills

Communication

Regulatory knowledge (GDPR, NIS)

Education

Degree in Cyber Security or related field

Certifications (GIAC GDAT, GCFA, GCIA)

Tools

SIEM platforms

Threat intelligence integration

Job description

At Sellafield Ltd, we are harnessing our expertise; bringing together world-class skills and innovative technology to solve complex nuclear, infrastructure, and engineering challenges. By joining Sellafield Ltd, you join an amazing team of people, from all walks of life, where you can thrive in a connected, considerate culture of innovation, collaboration, and community; and play a significant part in the UK’s sustainable nuclear future.

About the role

This is a newly established role within Sellafield Ltd’s CS&IA Organisation, designed to enhance proactive threat detection capabilities within the Cyber Security Operations capability.

The role is crucial for uncovering hidden threats and adversary tactics across complex, regulated IT and OT environments, enabling timely detection and response to protect nuclear safety and operational resilience. The Senior Threat Hunter leads in developing advanced methodologies, integrating threat intelligence and driving automation, while balancing technical delivery with mentoring and collaboration. This position requires adaptability to evolving threats, commitment to regulatory compliance and proactive contribution to the continuous improvement of cyber defence.

The Senior Threat Hunter, as a technical specialist, leads continuous improvement, mentors junior staff and ensures compliance with regulatory and organisational security standards and operates within the regulated nuclear environment to ensure resilience, compliance and the safe and secure operation of the site.

Key responsibilities

• Develop and maintain structured threat hunting methodologies and playbooks to ensure repeatable, high‑quality hunting activities.
• Execute threat hunting activities to identify indicators of compromise and emerging attack techniques.
• Identify telemetry gaps and work with the SOC engineering team to improve data visibility and detection logic across IT and OT environments.
• Adapt hunting methodologies for OT environments, considering unique constraints such as limited telemetry, legacy systems, and operational safety requirements.
• Analyse threat intelligence and correlate findings with internal telemetry to detect potential risks.
• Develop and refine/test hunting hypotheses based on adversary TTPs and frameworks such as MITRE ATT&CK.
• Produce clear, actionable reports and recommendations for remediation and risk reduction.
• Assist incident response by providing technical analysis and threat context during investigations.
• Drive/Contribute to automation and scripting initiatives to streamline hunting workflows.
• Maintain awareness of threat actor behaviours, tools, and emerging vulnerabilities.
• Support/mentor capability development within the Threat team through knowledge sharing and best practices.
• Ensure adherence to data protection, confidentiality, and security standards in all threat hunting activities.

Authorities & Dimensions:

• Provide technical guidance and mentoring to junior staff.
• Influence stakeholders across CS&IA, HR and the wider Sellafield Ltd organisation.

Your Skills and Qualifications

Essential:

• Extensive experience in threat hunting, SOC operations, or cyber forensics.
• Understanding of adversary tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK.
• Familiarity with SIEM platforms and threat intelligence integration.
• Scripting skills (Python, PowerShell, REGEX) to support hunting and automation.
• Strong analytical and problem-solving skills; ability to work under pressure.
• Ability to communicate technical findings clearly to technical and non-technical audiences.
• Knowledge of regulatory frameworks (GDPR, NIS Directive) and security standards (NCSC CAF) relevant to critical infrastructure.

Desirable:

• Degree or equivalent experience in a relevant discipline (e.g., Cyber Security, Computer Science, Digital Forensics).
• Certifications such as GIAC GDAT, GCFA, GCIA, or equivalent.
• Familiarity with cloud and hybrid environments.
• Knowledge of OT‑specific threats and IC/SCADA security principles.
• Experience in regulated environments (nuclear, defence, critical infrastructure).

Why us?

At Sellafield Ltd, we are committed to supporting our employees in fulfilling their potential. With having 100 years of work in front of us, we offer comprehensive training and development opportunities, enabling you to feel inspired in your role. Whatever area you join us in, you’ll find a genuinely exciting and rewarding career.

Making sure our employees feel supported is important to us. Therefore, to help you get the most out of life in and outside of work, we also offer a range of employee benefits:

• You will benefit from an annual bonus of up to 10% – 15%, made up of company and personal performance
• An attractive defined contribution pension scheme – the company will match up to 13.5% for a 7% employee contribution!
• 30 days annual leave + bank holidays. Plus, the ability to purchase an extra 2.5 days per year.
• The ability to carry over 10 days annual leave each financial year
• Paid Sick Leave
• Family Friendly Policies – Visit our Rewards & Benefits page to read more
• Cycle to Work Scheme
• Lifestyle Benefits sasra.co.uk
• Learning & Development Opportunities https://careers.sellafieldsite.co.uk/work-with-us/learning-and-development/
• Reward & Recognition Policies
• Welfare & Employee Assistance Programme
• Free Aviva Health App & Annual Health Check
• MyDiscounts – Employee Savings & Discounts
• MyBenefits – A Charity Giving Scheme
• Many, many more!

Click this link to visit our Rewards & Benefits page: https://careers.sellafieldsite.co.uk/work-with-us/rewards-and-benefits/

Sellafield Ltd is a unique place to grow your career, offering a remarkable blend of role variety, job security, personal growth, professional development, and truly significant work. This is your opportunity to tackle some of the biggest challenges in the nuclear, infrastructural and engineering worlds and create a clean and safe environment for generations to come. Explore Sellafield Ltd today.

Additional Information

The closing date for this vacancy is Monday 26th October 2026.

In the event of a high number of responses to any advert, Sellafield Ltd reserves the right to close the advert early. Once closed, the advert will be removed from our website. We encourage you to submit your application as soon as possible to avoid disappointment.

Please regularly check your Spam/Junk folders for news about this vacancy, correspondence could contain invitations to interview and other important updates.

Qualifications
As part of the application process, you will be asked to provide evidence of your qualifications. Attaching them at application stage will ensure a smooth process and prevent delays.

Right to Work in the UK
As part of our screening process, all candidates must demonstrate their right to work in the UK.
If you are not a UK national, you will be required to provide evidence of your immigration status. This is generated through the UK Government online service via the GOV.UK services below:
-A valid eVisa (digital immigration status) share code
https://www.gov.uk/evisa/view-evisa-get-share-code-prove-immigration-status
-A Right to Work share code
https://www.gov.uk/prove-right-to-work

Applicants who are not UK nationals must provide a valid Right to Work share code and evidence of their eVisa status at the point of application. Applications submitted without this information are not able to be progressed.

Please be aware that this role is subject to achieving security clearance. This role requires higher level of National Security Vetting where applicants must typically have 5 or 10 years of continuous residency in the UK. Factors such as your nationality, any nationalities you may have previously held, and your place of birth can restrict the level of clearance you’re able to achieve.

Sellafield Ltd are recognised as a Disability Confident Employer (Level 3). Disability Confident employers offer an interview to disabled applicants that meet the minimum criteria for a vacancy. Sellafield Ltd define the minimum criteria as the ‘essential skills’ which are listed on the vacancy notice. Whilst completing your application form, you will be able to indicate if you wish to be considered under the disability confident scheme. If you would prefer to discuss this directly with us, please contact the GBS Recruitment team on [e-mail]