Security Operations Lead

Security Operations Lead Salary: Up to £85,000 FTE Location: Home-based, with occasional travel to meetings as required Hours: 40 hours per week Reporting to: Director of Cyber Security and Resilience We are working with a leading UK-based organisation within the digital healthcare sector that is looking to appoint an experienced Security Operations Lead to join its growing Cyber Security and Resilience function. This is an exciting opportunity for a technically strong security professional to take ownership of security operations, driving improvements across cloud security, threat detection, incident response, vulnerability management and security engineering. This is a senior, hands-on leadership role where you will play a key part in strengthening the organisation's security posture, translating security policies and risk requirements into practical technical solutions, automated processes and effective security controls. Working closely with Cyber Security, Platform Engineering, Software Engineering, IT, Data Science and external security partners, you will lead the day-to-day security operations capability and help ensure the organisation remains resilient against an evolving threat landscape. Key Responsibilities Security Operations Leadership Lead the day-to-day operation and continuous improvement of the security operations function. Provide technical leadership, establishing operational standards, priorities and effective ways of working. Act as a senior escalation point for complex and high-severity security incidents. Deputise for the Director of Cyber Security and Resilience on operational security matters when required. Security Incident Management Lead technical investigations, containment, eradication and recovery activities during cyber security incidents. Coordinate incident response across internal teams and external security partners. Ensure incidents are properly documented, investigated and reviewed, with lessons learned translated into improvements. Develop and maintain incident response plans, playbooks and operational procedures. SOC, MDR and Threat Detection Manage relationships with external Security Operations Centre (SOC), Managed Detection and Response (MDR) and forensic investigation partners. Monitor service performance against agreed KPIs, SLAs and detection coverage. Improve threat detection capabilities across the organisation's technology environment. Lead proactive threat hunting and translate threat intelligence into actionable security measures. Identify and address gaps in monitoring, logging and detection capabilities. Work with penetration testing and red-team providers to strengthen defensive security controls. Vulnerability and Exposure Management Lead the end-to-end vulnerability management process, from identification and prioritisation through to remediation and verification. Ensure vulnerabilities are assessed based on severity, exploitability, active threats, asset exposure and business impact. Maintain vulnerability coverage across endpoints, cloud infrastructure, applications, containers and internet-facing systems. Work with engineering teams to agree remediation plans, ownership and delivery timelines. Monitor and report on critical and high-risk vulnerabilities, remediation performance and overall attack-surface exposure. Oversee external vulnerability scanning and coordinate remediation of penetration testing findings. Security Tooling and Automation Own and continuously improve the security tools used for threat detection, investigation, response and vulnerability management. Identify opportunities to automate security processes, reducing manual activity and improving response times. Improve integrations between security platforms to provide greater visibility across the technology estate. Ensure monitoring coverage and data quality support effective security decision-making. Operational Assurance and Reporting Own security operations reporting, covering incidents, vulnerabilities, emerging threats, detection coverage and remediation activity. Establish meaningful KPIs and KRIs to identify trends, weaknesses and areas requiring improvement. Provide clear operational updates and recommendations to senior Cyber Security and Technology leadership. Maintain audit-ready evidence to support ISO 27001, Cyber Essentials Plus and NHS Data Security and Protection Toolkit (DSPT) requirements. Identify operational security risks and ensure significant weaknesses are appropriately recorded and managed. About You We are looking for an experienced security professional with a strong background in security operations, incident response and threat detection, ideally with previous experience in a senior or leadership position. You will ideally have: Significant experience in Security Operations, SOC, Incident Response or Detection and Response. Strong practical experience managing the full cyber incident lifecycle, including triage, investigation, containment, eradication and recovery. Hands-on experience with Microsoft Defender XDR, particularly Defender for Endpoint, Office 365, Cloud Apps and Entra ID/Identity Protection. Strong SIEM, log analysis, detection engineering and threat-hunting capabilities. Experience investigating identity, endpoint, email, cloud and application security incidents. A good understanding of MITRE ATT&CK, attacker techniques, tactics and procedures (TTPs), and Indicators of Compromise (IoCs). Practical experience managing enterprise vulnerability programmes, including risk-based prioritisation, remediation and validation. Knowledge of security across AWS, Microsoft 365 and Azure environments. Experience managing or working closely with external SOC, MDR or MSSP providers. The ability to coordinate technical responses during high-pressure incidents and communicate security risks effectively to technical and senior stakeholders. Experience providing team leadership, mentoring and developing technical talent. Desirable Experience and Skills The following experience would be advantageous: Experience with Datadog Security, AWS GuardDuty, AWS Security Hub, AWS Inspector, Rapid7 and Cloudflare WAF. Security automation and scripting experience using PowerShell, Python or KQL. Knowledge of ISO/IEC 27001, Cyber Essentials Plus, NHS DSPT, NIST Cybersecurity Framework and NIST incident response practices. Experience working within healthcare, NHS suppliers or another regulated environment. Relevant professional certifications such as CISSP, CISM, GCIH, GCIA, Microsoft SC-200, SC-100, AWS Certified Security – Specialty or ISO 27001 Lead Implementer/Auditor. A degree in Cyber Security, Computer Science or a related discipline, or equivalent professional experience. Personal Attributes Alongside your technical expertise, you will demonstrate: Strong leadership skills and the ability to develop and motivate a technical team. A pragmatic, delivery-focused approach to security, balancing essential controls with business priorities. Excellent analytical and problem-solving skills, with meticulous attention to detail. The confidence to constructively challenge decisions and take ownership of recommendations and outcomes. The ability to communicate complex security matters clearly to technical and non-technical stakeholders. A collaborative approach to working across multidisciplinary teams. A commitment to continuous improvement, knowledge sharing and maintaining high professional standards. Strong integrity, discretion and an understanding of the importance of confidentiality. A service-focused mindset, recognising the real-world impact of security and resilience decisions. Why Consider This Opportunity? Salary of up to £85,000 FTE. Fully home-based working arrangement. Senior leadership opportunity within an established Cyber Security and Resilience function. Opportunity to shape and improve security ope