Lead Security Operations Engineer (SOC) - Ofsted - SEO

We are hiring a Lead Security Operations Engineer – Security Operations Centre (SOC) to join our Technology Team.

Reporting to the Principal Cloud and Security Operations Engineer, the postholder will be responsible for the day-to-day management of Ofsted’s Security Operation Centre (SOC).

The successful candidate will monitor the organisations technology and information estate, whilst containing, mitigating and remediating any incursions. Additionally, they will lead the identification, analysis and response to all cyber security incidents within Ofsted, undertake threat hunting and maintain incident response processes.

This is a fantastic opportunity to further your experience in Ofsted’s well-established team. The post holder will work with high-achieving professionals at all levels, surrounded by a friendly and supportive team. They will have access to amazing benefits, such as flexible working hours, the Civil Service Pension Scheme, and 32.5 days annual leave + 8 bank holidays. We offer a hybrid working model, so you may also choose to spend a proportion of time working from home.

Job description

Please refer to the job specification for further information.

Person specification

Please refer to the job specification for further information.

Qualifications

Security-related certifications (e.g., CompTIA Security+, SSCP, CEH, CISSP) or a minimum of 5 years’ experience in IT, with a strong emphasis on infrastructure, networks, and cyber security operations.

Behaviours

We'll assess you against these behaviours during the selection process:

Delivering at Pace
Making Effective Decisions
Managing a Quality Service
Communicating and Influencing

Technical skills

We'll assess you against these technical skills during the selection process:

Knowledge and strong hands-on experience working in a SOC environment using Microsoft Azure Sentinel to monitor, triage, and respond to security alerts and incidents.
Experience building and maintaining use cases, analytic rules, and automated playbooks in Sentinel.
Proven experience in triaging alerts, managing security incidents, and escalating issues appropriately in a structured SOC environment.
Strong analytical and problem-solving skills.