GCS
CGI
Metasys Technologies
Fruition Group
Connect with headhunters to apply for similar jobsLiverpool Football Club
Sword Group
Tesco UK
Head Resourcing Ltd
Nine Twenty
A leading cybersecurity firm is seeking a Director / Head of Security Operations to establish a world-class Security Operations capability for central government. This role involves defining the vision, shaping the SOC environment, and building the operational capability from the ground up. The ideal candidate has significant experience in leadership roles within security operations, particularly in high-assurance environments, and possesses deep knowledge of SOC functions and governance procedures. This position offers a hybrid/remote work model.
Contract: 2+ Years
Location: UK Hybrid / Remote
Clearance: SC Desirable
Sector: Central Government / Cyber Security Leadership
This appointment represents a rare opportunity to lead the establishment of a new, world‑class Security Operations capability for a major central government organisation. The Director / Head of Security Operations will take ownership of defining the vision, shaping the security operating environment, and leading the implementation of a fully modernised SOC that underpins high‑assurance digital services at national scale.
Rather than inheriting an existing function, the successful candidate will design and build the SOC from the ground up – setting strategic direction, selecting and integrating technologies, forming specialist teams, and embedding a proactive, intelligence‑led security culture. This role requires a senior cyber leader who has successfully created or transformed SOC environments in government or other highly regulated sectors and who is comfortable operating at the intersection of strategy, architecture, and operational delivery.
Establish the long‑term vision, purpose, and operating construct for a modern, scalable SOC capable of supporting sensitive, high‑volume government digital services. Set out the capability roadmap, defining service layers, command structure, resourcing needs, and maturity targets. Produce a SOC blueprint that supports reuse, standardisation, and extensibility across wider government environments.
Build out the full operational capability, including monitoring, detection engineering, cyber analytics, threat intelligence, forensics, and incident response. Lead the selection, integration, and alignment of tools, platforms, and cloud‑native services into a unified security ecosystem. Embed automation‑first and AI‑enhanced approaches to uplift detection, response speed, and operational resilience.
Provide authoritative leadership across cyber risk, operational assurance, investigative processes, and security governance frameworks. Ensure the SOC supports stringent data protection, identity management, and access control requirements, including PIM/PAM. Develop coherent processes for resilience, escalation, containment, and recovery across critical services.
Direct a blended model of internal teams, external partners, SMEs, and specialist consultancies. Hold delivery partners to account for performance, quality, and alignment with the SOC strategy. Oversee the technical and commercial evolution of services delivered under multi‑year Statements of Work.
Act as the senior cyber representative for the programme, engaging Directors, C‑level leaders, digital delivery groups, architects, and operational teams. Shape security behaviours, embed best practice, and develop a culture of proactive defence across the organisation. Support wider transformation initiatives by advising on security patterns, architectural direction, and investment priorities.
* The salary benchmark is based on the target salaries of market leaders in their relevant sectors. It is intended to serve as a guide to help Premium Members assess open positions and to help in salary negotiations. The salary benchmark is not provided directly by the company, which could be significantly higher or lower.