Companies House operates across Microsoft Azure, Amazon Web Services and enterprise technology environments, with Microsoft Sentinel and Microsoft Defender forming key parts of our security monitoring and investigation capability.

Your Key Responsibilities Will Include

• Leading security investigations and incident response – taking technical ownership of complex or high-impact incidents and coordinating investigation, containment, remediation and escalation.
• Providing technical leadership – acting as a senior escalation point for analysts, providing guidance on complex investigations and supporting effective decision making.
• Developing security monitoring and detection – creating, reviewing and tuning security detections to improve our ability to identify malicious and suspicious activity.
• Managing and improving Microsoft Sentinel and Microsoft Defender – using and developing our security technologies to investigate threats, improve detection coverage and maintain effective monitoring.
• Monitoring cloud environments – detecting and investigating security activity across Amazon Web Services and Microsoft Azure using cloud security services, logs and other security telemetry.
• Improving automation and processes – identifying opportunities to automate Security Operations activities and improve monitoring, investigation and response workflows.
• Developing incident response capability – improving investigation procedures, playbooks and escalation processes and supporting security exercises and readiness activities.
• Developing the team – mentoring analysts, sharing technical knowledge and supporting the development of investigative and technical capability.
• Supporting operational leadership – helping prioritise and coordinate Security Operations activity and providing operational leadership in the absence of the Head of Security Operations when required.
• Working across Companies House – collaborating with security, cloud, platform, infrastructure and software engineering teams to investigate security issues and improve monitoring and response.
• Advising senior stakeholders – communicating significant incidents, risks and technical findings clearly and providing evidence-based recommendations.
• Driving continuous improvement – keeping pace with emerging threats and technologies and using lessons from incidents and operational activity to continually improve our security capability.

This is a hands-on technical role with technical and operational leadership responsibility. You will remain actively involved in security monitoring, investigations, detection engineering and incident response while helping to develop the capability of the wider Security Operations team.

Please note - Companies House cannot offer Visa sponsorship to candidates through this campaign.

About The Team

The Security Operations team sits within the wider Security function at Companies House and is responsible for monitoring, detecting, investigating and responding to cyber security threats across our technology and cloud environments.

We are a collaborative and technically focused team made up of Security Operations analysts, senior specialists and threat intelligence capability, working closely with colleagues across security, cloud, platform and engineering teams as well as external security partners.

The team is continuing to develop and modernise its Security Operations capability, with a strong focus on Microsoft Sentinel and Microsoft Defender, alongside increasing security monitoring and response across Amazon Web Services. We are also investing in improved security telemetry, detection engineering, automation and threat intelligence to help us identify and respond to threats more effectively.

There is significant opportunity to influence how the capability develops. We encourage new ideas, continuous improvement and knowledge sharing, with team members given the opportunity to develop their technical skills, take ownership of meaningful work and contribute to the future direction of Security Operations at Companies House.

We have a supportive and collaborative culture where people are encouraged to challenge existing approaches, share knowledge and learn from each other. As a Senior Lead, you will play an important role in maintaining that culture and helping develop the technical capability of the wider team.

Where will you be working?

You will be aligned to either the Cardiff or Edinburgh office, where you will be expected to attend at least once a week. We are currently using a hybrid approach to the way we work which provides opportunities for you to be adaptable in the way you work so that you can achieve a healthy balance between your work and home life. Your manager will agree regular patterns of attendance with you; however, you may be required to make yourself available to attend the office more frequently when required to meet business needs.

Person specification

What we’re looking For

The successful candidate will be an experienced cyber security professional with:

• Strong hands-on Security Operations expertise and the technical capability and judgement required to operate as a senior technical lead.
• Significant hands-on experience working within Security Operations, including investigating, triaging and responding to complex security alerts and incidents.
• Strong practical experience using Microsoft Sentinel, including security monitoring, log analysis, incident investigation, developing and tuning detection rules, and improving monitoring coverage.
• Strong experience working with Amazon Web Services, including investigating security activity using cloud security services and telemetry such as CloudTrail, GuardDuty and Identity and Access Management.
• Experience leading complex security investigations, coordinating containment and remediation activities, and making risk-based decisions during security incidents.
• Experience developing and improving Security Operations capabilities, including monitoring processes, incident response procedures, playbooks and automation.
• Advanced knowledge of Microsoft Sentinel, including Kusto Query Language, analytics rules, security investigations, log analysis and automation.
• Strong knowledge of Amazon Web Services security, including cloud logging, identity and access management, threat detection and the investigation of activity across cloud environments.
• Good working knowledge of Microsoft Defender security technologies and their use for threat detection, investigation and response.
• Strong analytical and diagnostic skills, with the ability to correlate security information from multiple data sources, identify malicious or suspicious activity and determine appropriate response actions.
• Practical knowledge of scripting and security automation using technologies such as PowerShell, Python, Terraform or equivalent tooling.
• Strong understanding of cyber threats, attacker techniques and security monitoring principles, with knowledge of relevant frameworks and good practice such as MITRE ATT&CK and the National Cyber Security Centre Cyber Assessment Framework.

Leadership and Abilities

• Ability to provide technical leadership within Security Operations, lead complex investigations and provide authoritative guidance to analysts and other technical teams.
• Ability to mentor and develop others while communicating complex security incidents, risks and recommendations clearly to technical, non-technical and senior stakeholders.