Job Description

About the Role

The Cyber Operations Engineering (COE) Team forms a key part of the Security function within Digital, Data & Technology (DD&T). Our team are responsible for:

• Onboarding new data sources from both cloud and on-prem solutions into our SIEM tooling, centralising the forensic telemetry from across the various critical systems which balance the UK energy system.
• Building and maintaining innovative security technologies that support the wider Cyber Security functions across NESO, serving as the foundation of NESO’s Cyber Security Operations (CSO) capability.
• Building automation to support secure and scalable delivery across the COE team and wider functions.

The Senior Cyber Security Operations Engineer will report to the COE Delivery Manager and will be responsible for delivery of the core COE responsibilities; including but not limited to the design, implementation, and operational support of SIEM Engineering and CSO tooling capabilities within NESO. They will have strong communication and stakeholder management skills, and work in closely with the business and cyber teams as the COE internal-customers to meet these objectives.

In addition to technical delivery, they will collaborate with the Cyber Operations teams to contribute to continuous improvement initiatives, automation, and reporting – supporting and uplifting overall team maturity.

This role can be based from Wokingham or Warwick and we continue to offer hybrid working from office and home. We are open to flexible working arrangements.

This role is designated as requiring a National Security Vetting (NSV) clearance. You will usually need to have been a resident in the UK for the last five years to apply for the required level of clearance. We would invite any applicants who do not currently meet this residency requirement to still express an interest in the role.

Key Accountabilities

Delivery

• Collaborate with application administrators across the business to onboard data sources into the SIEM data lake.
• Build and deploy innovative technical solutions to advance the security capability of the Cyber Security Operations function.
• Maintain and improve various security tools to enable key stakeholders, such as CSOC and Threat Hunting and Detection Engineering (THaDE).
• Build resilient forensic telemetry collection technologies to support 24/7/365 security monitoring.
• Optimise forensic telemetry collection mechanisms to ensure accurate and efficient parsing and ingestion to the SIEM.
• Contribute to process improvement and an internal cyber engineering knowledgebase.

Stakeholder Engagement

• Collaborate with the business to support the smooth and successful engagement of log source onboarding
• Develop relationships with Cyber teams to ensure outputs from security capabilities and onboard meet their requirements.

Applicants must have the right to work in the UK by the start of employment. Visa sponsorship may not be available for this role and will be considered in line with business requirements.

About You

We’re forging the path, and we know we can’t do it alone. That’s why we need visionary minds like yours to join us on this transformative journey. In this case, we’re looking for someone who:

• Is passionate about security and building secure infrastructure and secure foundations.
• Is curious. We often deal with bespoke or less common data sources at NESO, and a willingness and enthusiasm to take on the challenge of making sense of these data sources is a must.
• Has proven experience working with SIEM platforms and related tooling.
• Is knowledgeable about various data source formats and protocols (e.g., syslog, JSON, REST API).
• Is comfortable with scripting or programming languages (Python, Bash, PowerShell, etc).
• Has experience in troubleshooting and resolving data quality or ingestion issues.
• Has previously worked closely with security tooling such as EDR, Deception Tech, Malware Sandboxes, Vulnerability Management Tooling, etc.
• Has strong analytical and problem-solving skills and ability to handle complex and dynamic situations.
• Has strong communication and collaboration abilities.
• Is aware of treating cyber operations engineering with a Software Development Lifecycle mindset (Using tooling such as Git forges, CI/CD pipelines, Infrastructure as Code, Detection as Code, etc).
• Is aware of security incident response and investigation processes.
• Is aware of current and emerging cyber threats, trends, and best practices.
• May have relevant certifications (e.g. GIAC), but this is not required.

What You'll Get

A competitive salary of £50,000 - £58,000 dependent on experience and capabilityAs well as your base salary, NESO's core benefits are the essential perks and advantages that form part of your employee package. - You will receive a bonus based on company performance- 26 days annual leave as standard - A competitive contributory pension scheme where we will double match your contribution to a maximum company contribution of 12%. - Annual Enrollment to NESO Savings Plan, when you save between £20- £500 a month from your take-home pay, we will pay a 50% matching contribution.

NESO's flexible benefits programme provides you with more flexibility around your health, lifestyle and protection benefits, here's just a few available:
- Flexible Bank Holidays & Holiday Trading
- Additional Birthday Day Off
- Cycle to Work Scheme, Retail & Gym Discounts
- Private Medical Insurance, Critical Illness Insurance & Personal Accident Insurance

About Us

At the National Energy System Operator (NESO), we play a vital role in tackling climate change and securing Great Britain's energy future. We already operate the world's fastest decarbonising electricity system and are working towards our ambition to run it carbon-free for a short period this year - provided the market supplies electricity exclusively from renewable sources. Alongside this, we provide expert advice to government on how to deliver a clean power system by 2030.

In autumn 2024, the Electricity System Operator (ESO) transitioned to become NESO - an independent, expert public corporation with a whole-system view across electricity, gas, and hydrogen. NESO operates independently and transparently, always acting in the best interests of all energy users.

Licensed and regulated by Ofgem, we make impartial decisions that balance sustainability, affordability and security. Our organisation is fully independent from government, the regulator and all commercial interests, with a clear focus on system-wide benefit, long term thing and public value.

The time to deliver is now. Join the energy transformation and help shape the future.
Your energy. Our future. Together

National Energy System Operator (NESO) recognises the potential of bright and talented individuals, and we encourage you to join us as Great Britain’s energy system undergoes an ambitious, exciting, and vital transformation. Together with industry, we are creating a cleaner, more sustainable energy future.

More Information

This role closes at 23:59, on the day before date shown above, however we encourage candidates to submit their application as early as possible and not wait until the published closing date as this can vary.

This role closes at 23:59, on the day before date shown above, however we encourage candidates to submit their application as early as possible and not wait until the published closing date as this can vary.

Research shows that some people may hesitate to apply unless they meet every single requirement. At NESO, we believe potential comes in many forms and we're committed to a fair, inclusive recruitment

We're committed to building a workforce that represents the communities we serve, and a working environment in which each individual feels valued, respected, fairly treated, and able to reach their full potential. If this role sparks your interest but you're not sure you tick every box, we still want to hear from you. process where everyone has the opportunity to show their talents. We celebrate the difference people can bring into our organisation, and welcome and encourage applicants with diverse experiences and backgrounds.