Job Title : Principal Offensive Security Operator - SC Location: Remote with occasional travel to London - once every couple of months (depending on business need) - No expenses paid Contract Duration : 12 Months Daily Rate : £740/day (Umbrella) IR35 Status: Inside IR35 Security Clearance: SC The Role: You will conduct safe, simulated cyber-attack simulations against our technology estates, acting as a real-world adversary might, to test our defences, highlight weaknesses and contribute cyber security expertise and insight in support of the department's strategic security decision-making functions. You will be familiar with exploitation methodologies across a wide range of technologies, from classic enterprise technology stacks to modern digital services. You will have a well-developed ability to tactically assess and to execute a diversity of attack types, including chained attacks and evasion techniques, to achieve your desired goal. You have a keen instinct for evading detection and avoiding disruption to operations. Key Responsibilities Designing and executing threat intelligence-based full-spectrum cyber-attack simulations, including long-term campaign planning, persistence, and post-exploitation operations against the Ministry of Justice. Adopting a red team approach, discovering high-impact weaknesses across the organisation's most important technology estates and business areas, and validating whether the overarching cyber security apparatus is working effectively. Communicating technical findings in clear risk and impact-focused terms to senior stakeholders, enabling effective understanding and support for strategic decision-making. Development and implementation of tools and methodologies to augment and to automate team offensive and analytical capability. Mentoring junior Red Team members to improve their skills and capabilities, along with wider knowledge transfer to other security and non-security teams to help build a culture of cyber security in the department. Essential Proven ability to plan and execute complex, multi-phase operations. Scenario-driven adversary simulation Threat intelligence analysis and assessment Exploitation of a wide range of technologies, including infrastructure, web application and cloud platforms: Microsoft Entra, Active Directory, M365, macOS. Kubernetes, CI/CD, AWS, Azure. Post-exploitation, persistence and lateral movement, including tactical analysis of attack paths leading to high-value targets Conducting engagement activities in line with operational security best practice and within a range of threat actor capabilities and tradecraft Deep understanding of security technologies found in end-user and server operating systems and supporting infrastructure, including relevant architectural and operational patterns of at-scale deployment and administration of complex Legacy and modern enterprise environments. Experience using, developing and deploying tools in support of red teaming activities, including attack infrastructure, C2 frameworks and infrastructure-as-code technologies. Strong communication skills with the ability to clearly explain complex technical issues related to vulnerabilities and risk to diverse audiences, including senior stakeholders, in support of vulnerability management, threat mitigation, and risk-based decision-making. Participation in GCASE/GBEST/CBEST/TIBER engagements. Desirable: Experience in threat and/or vulnerability research, including publication and presentation to the wider cyber security community. Background in a related a discipline, such as protective monitoring, incident response, security engineering or security architecture. Certifications in the field of red team: CCSAS, CRTL Security Clearance: SC Disability Confident As a member of the disability confident scheme, CLIENT guarantees to interview all candidates who have a disability and who meet all the essential criteria for the vacancy. In cases where we have a high volume of candidates who have a disability who meet all the essential criteria, we will interview the best candidates from within that group. Armed Forces Covenant CLIENT is proud to support the Armed Forces Covenant and as such, we guarantee to interview all veterans or spouses/partners of military personnel who meet all the essential criteria for the vacancy. In cases where we have a high volume of ex-military candidates/military spouses or partners, who meet all of the essential criteria, we will interview the best candidates from within that group. If you qualify for the above, please notify us. We will be in touch to discuss your suitability and arrange your Guaranteed Interview. Should you require reasonable adjustments at any point during the recruitment process or if there is a more accessible way for us to communicate, please do let me know. To apply for this role please submit your latest CV or contact Aspect Resources
20/08/2026
Contractor
Job Title : Principal Offensive Security Operator - SC Location: Remote with occasional travel to London - once every couple of months (depending on business need) - No expenses paid Contract Duration : 12 Months Daily Rate : £740/day (Umbrella) IR35 Status: Inside IR35 Security Clearance: SC The Role: You will conduct safe, simulated cyber-attack simulations against our technology estates, acting as a real-world adversary might, to test our defences, highlight weaknesses and contribute cyber security expertise and insight in support of the department's strategic security decision-making functions. You will be familiar with exploitation methodologies across a wide range of technologies, from classic enterprise technology stacks to modern digital services. You will have a well-developed ability to tactically assess and to execute a diversity of attack types, including chained attacks and evasion techniques, to achieve your desired goal. You have a keen instinct for evading detection and avoiding disruption to operations. Key Responsibilities Designing and executing threat intelligence-based full-spectrum cyber-attack simulations, including long-term campaign planning, persistence, and post-exploitation operations against the Ministry of Justice. Adopting a red team approach, discovering high-impact weaknesses across the organisation's most important technology estates and business areas, and validating whether the overarching cyber security apparatus is working effectively. Communicating technical findings in clear risk and impact-focused terms to senior stakeholders, enabling effective understanding and support for strategic decision-making. Development and implementation of tools and methodologies to augment and to automate team offensive and analytical capability. Mentoring junior Red Team members to improve their skills and capabilities, along with wider knowledge transfer to other security and non-security teams to help build a culture of cyber security in the department. Essential Proven ability to plan and execute complex, multi-phase operations. Scenario-driven adversary simulation Threat intelligence analysis and assessment Exploitation of a wide range of technologies, including infrastructure, web application and cloud platforms: Microsoft Entra, Active Directory, M365, macOS. Kubernetes, CI/CD, AWS, Azure. Post-exploitation, persistence and lateral movement, including tactical analysis of attack paths leading to high-value targets Conducting engagement activities in line with operational security best practice and within a range of threat actor capabilities and tradecraft Deep understanding of security technologies found in end-user and server operating systems and supporting infrastructure, including relevant architectural and operational patterns of at-scale deployment and administration of complex Legacy and modern enterprise environments. Experience using, developing and deploying tools in support of red teaming activities, including attack infrastructure, C2 frameworks and infrastructure-as-code technologies. Strong communication skills with the ability to clearly explain complex technical issues related to vulnerabilities and risk to diverse audiences, including senior stakeholders, in support of vulnerability management, threat mitigation, and risk-based decision-making. Participation in GCASE/GBEST/CBEST/TIBER engagements. Desirable: Experience in threat and/or vulnerability research, including publication and presentation to the wider cyber security community. Background in a related a discipline, such as protective monitoring, incident response, security engineering or security architecture. Certifications in the field of red team: CCSAS, CRTL Security Clearance: SC Disability Confident As a member of the disability confident scheme, CLIENT guarantees to interview all candidates who have a disability and who meet all the essential criteria for the vacancy. In cases where we have a high volume of candidates who have a disability who meet all the essential criteria, we will interview the best candidates from within that group. Armed Forces Covenant CLIENT is proud to support the Armed Forces Covenant and as such, we guarantee to interview all veterans or spouses/partners of military personnel who meet all the essential criteria for the vacancy. In cases where we have a high volume of ex-military candidates/military spouses or partners, who meet all of the essential criteria, we will interview the best candidates from within that group. If you qualify for the above, please notify us. We will be in touch to discuss your suitability and arrange your Guaranteed Interview. Should you require reasonable adjustments at any point during the recruitment process or if there is a more accessible way for us to communicate, please do let me know. To apply for this role please submit your latest CV or contact Aspect Resources
Cyber Security Operations Centre (SOC) Manager Remote Working Contract: 12+ Month Contract Rate: 700 - 850 per day Fox Morris Group are currently recruiting for an experienced Cyber Security Operations Centre (SOC) Manager to join a high-profile public sector organisation on a long-term contract. This is an excellent opportunity for a strategic cyber security leader to take ownership of a mature Security Operations Centre, driving continuous improvement, enhancing threat detection capabilities and leading a high-performing security team. About the Role As the SOC Manager, you will be responsible for leading the Security Operations Centre, ensuring effective security monitoring, incident response and threat intelligence capabilities while shaping the future direction of the SOC. Working closely with internal stakeholders, external vendors and managed security service providers (MSSPs), you will play a key role in strengthening the organisation's cyber resilience. Essential Experience Proven experience as a SOC Manager or Security Operations Manager. Strategic leadership experience with the ability to develop and evolve SOC capabilities. Demonstrated experience leading and managing high-performing cyber security teams. Strong understanding of security incident management and response processes. Experience delivering and managing effective security monitoring capabilities. Proven experience in threat intelligence, threat assessment and cyber risk management. Hands-on experience with a wide range of cyber security tools and technologies. Experience managing relationships with external vendors, MSSPs and technology partners. Ability to effectively prioritise resources and drive operational excellence. Desirable CISSP, CISM or equivalent cyber security certification. Experience securing AWS and/or Microsoft Azure cloud environments. ITIL Foundation (or equivalent Service Management qualification). What's on Offer? 700 - 850 per day. 12+ month contract. Fully remote working. Opportunity to lead and shape a strategic cyber security function within a major public sector organisation. Immediate start available. Apply Today If you're an experienced SOC Manager, Cyber Security Manager, Security Operations Manager or Cyber Defence Lead, we'd love to hear from you.
06/08/2026
Contractor
Cyber Security Operations Centre (SOC) Manager Remote Working Contract: 12+ Month Contract Rate: 700 - 850 per day Fox Morris Group are currently recruiting for an experienced Cyber Security Operations Centre (SOC) Manager to join a high-profile public sector organisation on a long-term contract. This is an excellent opportunity for a strategic cyber security leader to take ownership of a mature Security Operations Centre, driving continuous improvement, enhancing threat detection capabilities and leading a high-performing security team. About the Role As the SOC Manager, you will be responsible for leading the Security Operations Centre, ensuring effective security monitoring, incident response and threat intelligence capabilities while shaping the future direction of the SOC. Working closely with internal stakeholders, external vendors and managed security service providers (MSSPs), you will play a key role in strengthening the organisation's cyber resilience. Essential Experience Proven experience as a SOC Manager or Security Operations Manager. Strategic leadership experience with the ability to develop and evolve SOC capabilities. Demonstrated experience leading and managing high-performing cyber security teams. Strong understanding of security incident management and response processes. Experience delivering and managing effective security monitoring capabilities. Proven experience in threat intelligence, threat assessment and cyber risk management. Hands-on experience with a wide range of cyber security tools and technologies. Experience managing relationships with external vendors, MSSPs and technology partners. Ability to effectively prioritise resources and drive operational excellence. Desirable CISSP, CISM or equivalent cyber security certification. Experience securing AWS and/or Microsoft Azure cloud environments. ITIL Foundation (or equivalent Service Management qualification). What's on Offer? 700 - 850 per day. 12+ month contract. Fully remote working. Opportunity to lead and shape a strategic cyber security function within a major public sector organisation. Immediate start available. Apply Today If you're an experienced SOC Manager, Cyber Security Manager, Security Operations Manager or Cyber Defence Lead, we'd love to hear from you.
Academy Education Network Ltd
Manchester, Lancashire
Overview Cybersecurity Analysts protect organisations from cyber threats. Depending on the speciality, roles may involve monitoring live security events in a Security Operations Centre (SOC), researching threat intelligence, conducting penetration tests to uncover vulnerabilities, or managing Governance, Risk & Compliance (GRC) workstreams. All work aligns with recognised frameworks such as NIST CSF, ISO 27001, and CIS Controls. Responsibilities Monitor security events and respond to active threats in real time. Run vulnerability assessments, penetration tests, and incident response exercises. Specialise in SOC analysis, threat intelligence, penetration testing, GRC, or cloud security. Work for banks, telcos, defence contractors, government agencies, NHS and FTSE 100 corporates. Career Progression Typical career stages for a Cybersecurity Analyst: Years 0-2: SOC Analyst (Tier 1) - monitor events and respond to common incidents; progression via CompTIA Security+ and SANS GCIH or CEH. Years 2-5: Cybersecurity Analyst / Penetration Tester - specialise in penetration testing (CREST CRT, OSCP), threat intelligence or GRC (ISO 27001 Lead Auditor). Years 5-8: Senior Analyst / Security Engineer - lead complex incident response, run major risk assessments, or design enterprise security architecture; often required to hold CISSP. Years 8+: Lead / Head of Security / CISO - strategic leadership of an organisation's security function; requires technical depth and business/board level communication. Qualifications & Skills Required technical knowledge and professional traits include: Calm decision making under incident pressure. Clear written reporting for non technical executives. Ethical decision making and professional integrity. Continuous learning across rapidly evolving threats. Methodical, evidence based investigation. Teamwork across IT, business and law enforcement. Relevant certifications such as CompTIA Security+, CEH, SANS GCIH, OSCP/CREST CRT, CISM/CISSP, ISO 27001 Lead Auditor. Typical Salary Ranges (UK) Junior SOC analysts at major banks and managed service providers start at £35,000-£45,000. Penetration testers and threat intelligence analysts at top consultancies earn £45,000-£65,000 within 3 years. Senior engineers and CISO track leaders in FTSE 100 companies can reach £100,000+. Education and Entry Routes Common pathways include: MSc Cybersecurity - 1 year postgraduate specialist degree (many are NCSC certified). Cybersecurity Apprenticeship - 2-4 years, fully employer funded (Levels 4 & 6). CompTIA Security+ plus a Tier 1 SOC role - common entry for career changers. University undergraduate degree in Cybersecurity or Computer Science - 3 years; with student loans and progression into junior roles. FAQ - Becoming a Cybersecurity Analyst in the UK How long does it take to become a cyber analyst? Typically straight after a 3 year undergraduate degree, or via CompTIA Security+ and a Tier 1 SOC role. Do I need a cybersecurity degree to work in the UK? Not strictly, but a specialist degree and relevant certifications are the most reliable route. Is the role on the Skilled Worker visa shortage list? No; however, salaries often meet the threshold and most private sector employers sponsor international analysts. What's the difference between a SOC analyst and a penetration tester? SOC analysts monitor events; penetration testers actively find vulnerabilities. Which UK certifications matter most? CompTIA Security+, CEH, SANS GCIH, OSCP/CREST CRT, CISM/CISSP. Can I move into cybersecurity from another career? Yes - career changers can transition via Security+ and a Tier 1 SOC role within 6-12 months.
04/08/2026
Full time
Overview Cybersecurity Analysts protect organisations from cyber threats. Depending on the speciality, roles may involve monitoring live security events in a Security Operations Centre (SOC), researching threat intelligence, conducting penetration tests to uncover vulnerabilities, or managing Governance, Risk & Compliance (GRC) workstreams. All work aligns with recognised frameworks such as NIST CSF, ISO 27001, and CIS Controls. Responsibilities Monitor security events and respond to active threats in real time. Run vulnerability assessments, penetration tests, and incident response exercises. Specialise in SOC analysis, threat intelligence, penetration testing, GRC, or cloud security. Work for banks, telcos, defence contractors, government agencies, NHS and FTSE 100 corporates. Career Progression Typical career stages for a Cybersecurity Analyst: Years 0-2: SOC Analyst (Tier 1) - monitor events and respond to common incidents; progression via CompTIA Security+ and SANS GCIH or CEH. Years 2-5: Cybersecurity Analyst / Penetration Tester - specialise in penetration testing (CREST CRT, OSCP), threat intelligence or GRC (ISO 27001 Lead Auditor). Years 5-8: Senior Analyst / Security Engineer - lead complex incident response, run major risk assessments, or design enterprise security architecture; often required to hold CISSP. Years 8+: Lead / Head of Security / CISO - strategic leadership of an organisation's security function; requires technical depth and business/board level communication. Qualifications & Skills Required technical knowledge and professional traits include: Calm decision making under incident pressure. Clear written reporting for non technical executives. Ethical decision making and professional integrity. Continuous learning across rapidly evolving threats. Methodical, evidence based investigation. Teamwork across IT, business and law enforcement. Relevant certifications such as CompTIA Security+, CEH, SANS GCIH, OSCP/CREST CRT, CISM/CISSP, ISO 27001 Lead Auditor. Typical Salary Ranges (UK) Junior SOC analysts at major banks and managed service providers start at £35,000-£45,000. Penetration testers and threat intelligence analysts at top consultancies earn £45,000-£65,000 within 3 years. Senior engineers and CISO track leaders in FTSE 100 companies can reach £100,000+. Education and Entry Routes Common pathways include: MSc Cybersecurity - 1 year postgraduate specialist degree (many are NCSC certified). Cybersecurity Apprenticeship - 2-4 years, fully employer funded (Levels 4 & 6). CompTIA Security+ plus a Tier 1 SOC role - common entry for career changers. University undergraduate degree in Cybersecurity or Computer Science - 3 years; with student loans and progression into junior roles. FAQ - Becoming a Cybersecurity Analyst in the UK How long does it take to become a cyber analyst? Typically straight after a 3 year undergraduate degree, or via CompTIA Security+ and a Tier 1 SOC role. Do I need a cybersecurity degree to work in the UK? Not strictly, but a specialist degree and relevant certifications are the most reliable route. Is the role on the Skilled Worker visa shortage list? No; however, salaries often meet the threshold and most private sector employers sponsor international analysts. What's the difference between a SOC analyst and a penetration tester? SOC analysts monitor events; penetration testers actively find vulnerabilities. Which UK certifications matter most? CompTIA Security+, CEH, SANS GCIH, OSCP/CREST CRT, CISM/CISSP. Can I move into cybersecurity from another career? Yes - career changers can transition via Security+ and a Tier 1 SOC role within 6-12 months.
Our client Scottish Power are looking for a Security Operations Lead for an initial 12 month contract role, which will in all likelihood extend further. This is based at the client offices in Glasgow, working hybrid, 3 days in the office. SP Energy Networks (SPEN) has kicked off an ambitious security transformation programme to transparently reduce risk, achieve compliance with NIS regulations and deliver a cyber resilient business, the Security Operations Lead will be essential in achieving our goals. The Security Operations Lead will be a subject matter expert on security incident detection and response. They will drive continuous improvement across the outsourced SOC and in-house SOC teams of analysts and engineers. Youll have experience of configuring SIEM tools, onboarding sources, writing processes and alerts, understanding business environments and managing incidents affecting applications and infrastructure across a varied technology stack spanning operational technology and information technology environments. You ll also be able to undertake post incident reviews to identify root causes and put follow-up mitigations in place. The postholder will work within a security operations team containing various cyber security functions such as threat intelligence, identity & access management, response & recovery and vulnerability management. What Youll be doing Support the Security Operations Manager in the running of BAU activities Implement and maintain 3rd line security incident / event management, escalation and technical response process and investigate suspected and actual incidents / events. Acting as a key escalation point in the team to the relevant team/individual Design, implement, manage, monitor, and upgrade security measures for the protections of the information systems and networks Identify and feedback any potential improvements from a cyber perspective to OT systems and infrastructure Ensuring incident identification, assessment, quantification, reporting, communication, mitigation and monitoring Ensuring compliance to policy, process, and procedure adherence and process improvisation to achieve operational objectives Revise and develop processes to strengthen the current Security Operations Framework Review policies and highlight the challenges in managing SLAs Ensuring daily management, administration & maintenance of security technology to achieve operational effectiveness Ensure the orchestration and integration of security services and platforms to maximise its usage and coverage The role will be integrated into an active and ambitious global cyber security function, contributing to SPEN s cyber security purpose of delivering cyber resilient OT and IT, to enable a safe and reliable electricity supply to customers What Youll bring Skills and experience in understanding at a technical level security operations. Awareness of key legislation and regulation impacting IT/OT General Control requirements in an energy utility. Experience in working within a SOC. Record of academic achievement, including some form of recognised qualification from further education, such as a degree or diploma. Good oral and written communication skills. Must be a proven team player to work, promote and consolidate efficient team working relationships.
04/08/2026
Contractor
Our client Scottish Power are looking for a Security Operations Lead for an initial 12 month contract role, which will in all likelihood extend further. This is based at the client offices in Glasgow, working hybrid, 3 days in the office. SP Energy Networks (SPEN) has kicked off an ambitious security transformation programme to transparently reduce risk, achieve compliance with NIS regulations and deliver a cyber resilient business, the Security Operations Lead will be essential in achieving our goals. The Security Operations Lead will be a subject matter expert on security incident detection and response. They will drive continuous improvement across the outsourced SOC and in-house SOC teams of analysts and engineers. Youll have experience of configuring SIEM tools, onboarding sources, writing processes and alerts, understanding business environments and managing incidents affecting applications and infrastructure across a varied technology stack spanning operational technology and information technology environments. You ll also be able to undertake post incident reviews to identify root causes and put follow-up mitigations in place. The postholder will work within a security operations team containing various cyber security functions such as threat intelligence, identity & access management, response & recovery and vulnerability management. What Youll be doing Support the Security Operations Manager in the running of BAU activities Implement and maintain 3rd line security incident / event management, escalation and technical response process and investigate suspected and actual incidents / events. Acting as a key escalation point in the team to the relevant team/individual Design, implement, manage, monitor, and upgrade security measures for the protections of the information systems and networks Identify and feedback any potential improvements from a cyber perspective to OT systems and infrastructure Ensuring incident identification, assessment, quantification, reporting, communication, mitigation and monitoring Ensuring compliance to policy, process, and procedure adherence and process improvisation to achieve operational objectives Revise and develop processes to strengthen the current Security Operations Framework Review policies and highlight the challenges in managing SLAs Ensuring daily management, administration & maintenance of security technology to achieve operational effectiveness Ensure the orchestration and integration of security services and platforms to maximise its usage and coverage The role will be integrated into an active and ambitious global cyber security function, contributing to SPEN s cyber security purpose of delivering cyber resilient OT and IT, to enable a safe and reliable electricity supply to customers What Youll bring Skills and experience in understanding at a technical level security operations. Awareness of key legislation and regulation impacting IT/OT General Control requirements in an energy utility. Experience in working within a SOC. Record of academic achievement, including some form of recognised qualification from further education, such as a degree or diploma. Good oral and written communication skills. Must be a proven team player to work, promote and consolidate efficient team working relationships.
