SOC - Cyber Threat Operations Specialist

Tatton Recruitment; Stevenage; On-site; GBP 160,000 - 170,000; Full time

Job summary

World Class Defence Organisation is seeking a Cyber Threat Operations Specialist subcontractor for an initial 12-month contract based in Stevenage. No current security clearance is required to apply, but SC clearance will be required before starting, with DV clearance to follow.

The role focuses on proactive threat hunting, detection engineering and incident response within the Active Defence Incident Response Team, employing SIEM, IDS/IPS, network monitoring and malware analytics in a

Qualifications

• Career background in Cyber Security across Network Security, Infrastructure and OS/Applications.
• Experience with YARA and Sigma rulesets.
• Knowledge of IT Security standard methodologies.
• Understanding of OSI model and network protocols (DNS, HTTP/S, SSL, SMTP, FTP/S, LDAP/S).

Responsibilities

• Conduct proactive threat hunting in collaboration with CTI function.
• Lead threat detection engineering efforts with ISR.
• Assist with maintenance of security technologies.
• Support the Cyber Eng Team with project activity.
• Assist Incident responders with HR and InfoSec investigations.
• Attend routine security meetings.

Skills

Cyber Security

Threat Hunting

Security Analytics

Threat Detection

Communication skills

Tools

SIEM Tools

Network Packet Capture

YARA rules

Sigma rules

IDS/IPS

Job description

World Class Defence Organisation is currently looking to recruit a Cyber Threat Operations Specialist subcontractor on an initial 12 month contract. You do not need to hold any current security clearance in order to apply. However, SC security clearance will be required prior to starting the position, with DV clearance also required eventually.

A background working as a Cyber Security Engineer, SOC Engineer, SOC Analyst, Senior SOC Analyst, Cyber Security Analyst, Security Operations Engineer, SIEM Engineer, SIEM Analyst, Threat Detection Engineer, Security Infrastructure Engineer would be well suited to this position.

Rate: £85.00 per hour

Location: Stevenage

Hybrid / Remote working: Onsite 5 days per week. Shift pattern of 07:00-15:00 or 09:00-18:00 (subject to change)

Contract: 37 Hours per week

Overtime: Hours worked over 37 hours per week will be calculated at ‘time and a quarter’

Duration: 12 Months (initially and then ongoing and long-term thereafter)

IR35 status: Inside IR35 (Umbrella)

Cyber Threat Operations Specialist Job Description:

An opportunity has arisen in the Active Defence Incident Response Team within Digital Excellence (DEX) for a Cyber Threat Operations specialist. Supporting the Active Defence & Incident Response Manager in assisting DEX meet the challenges and demands of countering the Cyber Threat. The successful applicant will drive a proactive ethos in an ever‑changing cyber security environment and provide robust threat hunting, detection Engineering and analysis within a high performing team environment.

Responsibilities:

To support the Active Defence Incident Response Manager in assisting Information Management UK meet the challenges and demands of countering the Cyber Threat. Support for the operational functions of the UK SOC. To work with other UK SOC members, including the UK InfoSec Team and the IM Domains (Customer Support and Infrastructure / Information Systems).

It will cover Threat hunting, analysis, monitoring, Optimising, reporting, alerting and investigation activity utilising a wide variety of security platforms including AI/ML and behavioural analytics, SIEM (Security Information Event Management), Network Packet Capture platform, Anti Malicious Code, Threat Detection technologies and platforms across the UK Network Perimeter working with the best standard technologies.

The Cyber Threat Operations specialist key responsibilities are:

• Conduct proactive Threat Hunting in collaboration with the CTI function
• Lead Threat Detection Engineering effort working with the ISR function
• Assist with the maintenance of Security technologies
• Assisting the Cyber Eng Team with project activity
• Supporting the Incident responders with HR and InfoSec related investigations
• Attend routine security meetings

Skillset/experience required:

• A career background in Cyber Security. Security awareness and experience in all areas of IT, primarily Network Security, Infrastructure and the secondary area being Operating Systems & Applications.
• Demonstrable experience with YARA and Sigma rulesets
• Knowledge of IT Security standard methodologies.
• Demonstrable understanding of the OSI Reference Model and the network communication protocols, including but not limited to DNS, HTTP/S, SSL, SMTP, FTP/S, LDAP/S.
• Demonstrable experience with Security Information Event Monitoring Tools and/or Network Packet Capture tools.
• Hands on experience with IDS/IPS technologies and threat hunting activities.
• Strong analytical experience and mind-set.
• Experience within Defensive Cyber-attack methodologies and frameworks.
• Understanding of Malware capabilities, attack vectors, propagation and impact.
• Good communication skills liaising with the business and suppliers