Threat Team Lead

Sellafield; United Kingdom; Remote; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Annual bonus up to 15%

Defined contribution pension

30 days annual leave + bank holidays

Cycle to Work

Learning & Development opportunities

Rewards & Benefits page access

Job summary

Sellafield Ltd is seeking a Lead for the Threat team to drive proactive threat intelligence, threat hunting, and advanced analysis. You will identify and mitigate cyber threats targeting critical infrastructure and information assets, directing incident response and enhancing detection capabilities.

The role requires strategic leadership of a technical team, collaboration with ICT and SOC colleagues, and a strong focus on regulatory compliance and safe operations within a nuclear environment.

Qualifications

• Degree or equivalent experience in Cyber Security, Computer Science, or related field.
• Proven experience in threat intelligence, threat hunting, or advanced SOC operations.
• Strong knowledge of TTPs and MITRE ATT&CK framework.
• Experience leading technical teams in threat analysis.
• Familiarity with GDPR, NIS Directive, and security standards.
• Excellent analytical, communication, and stakeholder engagement skills.
• Experience automating threat analysis and hunting processes.

Responsibilities

• Define the strategic roadmap for threat intelligence and hunting aligned with risk appetite.
• Lead development and delivery of capabilities across IT and OT environments.
• Oversee collection, analysis, and dissemination of actionable threat intel to stakeholders.
• Drive proactive hunting to identify indicators of compromise and adversary techniques.
• Ensure timely escalation and coordination of incidents per regulatory requirements.
• Maintain threat management processes and dashboard reporting for KPIs.

Skills

Threat intelligence

Threat hunting

MITRE ATT&CK

Leadership

Regulatory frameworks

Automation scripting

Education

Degree in Cyber Security / Computer Science

Tools

Threat intel platforms

SIEM/SOAR

Cloud threat detection

Job description

At Sellafield Ltd, we are harnessing our expertise; bringing together world-class skills and innovative technology to solve complex nuclear, infrastructure, and engineering challenges. By joining Sellafield Ltd, you join an amazing team of people, from all walks of life, where you can thrive in a connected, considerate culture of innovation, collaboration, and community; and play a significant part in the UK’s sustainable nuclear future.

About the role

To lead the Threat team in delivering proactive threat intelligence, threat hunting, and advanced analysis to identify, assess, and mitigate cyber threats targeting Sellafield Ltd’s critical infrastructure and information assets. The role ensures timely identification of emerging threats, supports incident response, and drives improvements in threat detection capabilities. The Team Lead will manage operational processes, develop team capability, and ensure compliance with regulatory and organisational security standards, contributing to the safe and secure operation of the nuclear site.

Key responsibilities

• Define and maintain the strategic roadmap supporting the Head of Cyber Security Operations for threat intelligence and threat hunting capabilities, ensuring alignment with organisational risk appetite and long-term cyber resilience goals.
• Lead the development and delivery of threat intelligence and threat hunting capabilities across IT and OT environments.
• Oversee collection, analysis, and dissemination of actionable threat intelligence to internal stakeholders.
• Drive proactive threat hunting activities to identify indicators of compromise and adversary techniques.
• Ensure timely escalation and coordination of threat-related incidents in line with organisational and regulatory requirements.
• Maintain and improve threat management processes, ensuring alignment with industry best practices and compliance frameworks.
• Develop and maintain threat dashboards and reporting for senior stakeholders and regulators where appropriate, ensuring KPIs are tracked for threat intelligence and hunting effectiveness, driving measurable improvements in detection and response.
• Integrate threat intelligence into SOC detection workflows and automation pipelines where appropriate.
• Collaborate with detection engineers, SOC analysts, and ICT teams to enhance detection coverage and response capabilities.
• Provide technical leadership, mentoring, and performance management for Threat Analysts.
• Promote continuous improvement initiatives, including automation and advanced analytics for threat identification.
• Ensure adherence to data protection, confidentiality, and security standards across all threat-related activities.

Your Skills and Qualifications

Essential Skills

• Degree or equivalent experience in a relevant discipline g., Cyber Security, Computer Science, Digital Forensics.
• Proven experience in threat intelligence, threat hunting, or advanced SOC operations.
• Strong knowledge of adversary tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK.
• Experience managing and developing technical teams in a threat analysis context.
• Knowledge of regulatory frameworks (e.g., GDPR, NIS Directive) and security standards (e.g., NCSC CAF).
• Excellent analytical, problem-solving, and decision-making skills.
• Strong communication and stakeholder engagement abilities.
• Experience in automating threat analysis and hunting processes.
• Ability to communicate technical threat information to both technical and non-technical audiences, including senior management.

Desirable Skills

• Professional certifications such as GPEN, GCTI, CISSP, CISM, or equivalent.
• Experience with threat intelligence platforms and integration into SIEM/SOAR.
• Familiarity with cloud threat detection and hybrid environments.
• Knowledge of malware analysis and reverse engineering.
• Scripting skills (Python, PowerShell) for automation and hunting.
• Experience in regulated environments (nuclear, defence, critical infrastructure).

Why us?

At Sellafield Ltd, we are committed to supporting our employees in fulfilling their potential. With having 100 years of work in front of us, we offer comprehensive training and development opportunities, enabling you to feel inspired in your role. Whatever area you join us in, you’ll find a genuinely exciting and rewarding career.

Making sure our employees feel supported is important to us. Therefore, to help you get the most out of life in and outside of work, we also offer a range of employee benefits:

• You will benefit from an annual bonus of up to 15%, made up of company and personal performance
• An attractive defined contribution pension scheme – the company will match up to 13.5% for a 7% employee contribution!
• 30 days annual leave + bank holidays. Plus, the ability to purchase an extra 2.5 days per year.
• The ability to carry over 10 days annual leave each financial year
• Paid Sick Leave
• Family Friendly Policies – Visit our Rewards & Benefits page to read more
• Cycle to Work Scheme
• Lifestyle Benefits sasra.co.uk
• Learning & Development Opportunities https://careers.sellafieldsite.co.uk/work-with-us/learning-and-development/
• Reward & Recognition Policies
• Welfare & Employee Assistance Programme
• Free Aviva Health App & Annual Health Check
• MyDiscounts – Employee Savings & Discounts
• MyBenefits – A Charity Giving Scheme
• Many, many more! Click this link to visit our Rewards & Benefits page: https://careers.sellafieldsite.co.uk/work-with-us/rewards-and-benefits/

Sellafield Ltd is a unique place to grow your career, offering a remarkable blend of role variety, job security, personal growth, professional development, and truly significant work. This is your opportunity to tackle some of the biggest challenges in the nuclear, infrastructural and engineering worlds and create a clean and safe environment for generations to come. Explore Sellafield Ltd today.

Additional Information

• The closing date for this vacancy is Monday 19th October 2026
• In the event of a high number of responses to any advert, Sellafield Ltd reserves the right to close the advert early. Once closed, the advert will be removed from our website. We encourage you to submit your application as soon as possible to avoid disappointment.
• Please regularly check your Spam/Junk folders for news about this vacancy, correspondence could contain invitations to interview and other important updates.
• Qualifications
  As part of the application process, you will be asked to provide evidence of your qualifications. Attaching them at application stage will ensure a smooth process and prevent delays.
• Right to Work in the UK
  As part of our screening process, all candidates must demonstrate their right to work in the UK.
  If you are not a UK national, you will be required to provide evidence of your immigration status. This is generated through the UK Government online service via the GOV.UK services below:
  -A valid eVisa (digital immigration status) share code
  https://www.gov.uk/evisa/view-evisa-get-share-code-prove-immigration-status
  -A Right to Work share code
  https://www.gov.uk/prove-right-to-work
• Please be aware that this role is subject to achieving security clearance. This role requires higher level of National Security Vetting where applicants must typically have 5 or 10 years of continuous residency in the UK. Factors such as your nationality, any nationalities you may have previously held, and your place of birth can restrict the level of clearance you’re able to achieve.
• Sellafield Ltd are recognised as a Disability Confident Employer (Level 3). Disability Confident employers offer an interview to disabled applicants that meet the minimum criteria for a vacancy. Sellafield Ltd define the minimum criteria as the ‘essential skills’ which are listed on the vacancy notice. Whilst completing your application form, you will be able to indicate if you wish to be considered under the disability confident scheme. If you would prefer to discuss this directly with us, please contact the GBS Recruitment team on [e-mail]

Applicants who are not UK nationals must provide a valid Right to Work share code and evidence of their eVisa status at the point of application. Applications submitted without this information are not able to be progressed.