SOAR Engineer

Sanderson Government and Defence; Warmley; On-site; GBP 70,000 - 110,000; Full time

Job summary

Sanderson Government and Defence seeks a SOAR/SIEM Security Engineer for a critical national infrastructure project. You will design and automate detection workflows, tune Splunk dashboards and support live incident response in OT/IT environments, while maintaining high availability and safety standards.

This 18-month FTC role requires active SC clearance and proven OT experience. You will join a high-visibility team working closely with safety and engineering colleagues to defend essential

Qualifications

• Active SC clearance is required.
• Proven experience in CNI or OT environments.
• Ability to operate in high-consequence OT/IT settings with sound judgement.

Responsibilities

• Design, build and maintain SOAR playbooks to automate detection and response.
• Develop and tune Splunk use cases, dashboards and correlation searches across IT and OT data sources.
• Support incident detection and response within CNI/OT environments, coordinating with engineering and safety teams.
• Contribute to the maturity of security monitoring across converged industrial and enterprise networks.
• Work in a team that understands OT constraints such as availability, safety and legacy systems.

Skills

Incident response

Threat detection

OT security awareness

Tools

SOAR platforms

Splunk

Job description

SOAR/SIEM Security Engineer - Critical National Infrastructure (OT)
18-Month FTC | SC Cleared

A leading cyber security firm is looking for a SOAR/SIEM Security Engineer to join a critical national infrastructure (CNI) client on an 18-month fixed-term contract, supporting the protection of operational technology (OT) environments that underpin essential national services.

This is a high-visibility role within a security operations function tasked with detecting, responding to, and automating defence against threats across converged IT/OT infrastructure. You'll be working on live, high-stakes environments.

What you'll be doing

• Designing, building, and maintaining SOAR playbooks to automate detection and response workflows


• Developing and tuning Splunk use cases, dashboards, and correlation searches across IT and OT data sources


• Supporting incident detection and response within CNI/OT environments, working closely with engineering and safety teams


• Contributing to the maturity of security monitoring across converged industrial and enterprise networks


• Working within a team that understands the unique constraints of OT - availability, safety, and legacy systems - versus traditional IT security

What you'll need

• Active SC clearance


• Proven experience working within CNI or OT environments


• Strong hands-on experience with SOAR platforms and Splunk


• A solid grasp of the differences between securing OT and IT - this isn’t a generic SOC role


• Comfortable operating in a live, high-consequence environment where good judgement matters as much as technical skill

The contract

• 18-month FTC


• Strong potential for extension or conversion to a permanent role further down the line (not guaranteed, but a realistic prospect based on programme trajectory)

Reasonable Adjustments:

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.

If you need any help or adjustments during the recruitment process for any reason