Lead Security Operations Specialist

**Details**:
**Reference number**:

- 401399

**Salary**:

- £41,571 - £56,784
- Base salary is £41571 - £45,784 with an additional DDaT allowance of £4,350 - £11,000 available. The final salary and allowance awarded will be based on an assessment of your skills and experience as demonstrated at interview.
- A Civil Service Pension with an employer contribution of 28.97%

GBP

**Job grade**:

- Senior Executive Officer
- DDaT Lead

**Contract type**:

- Permanent

**Business area**:

- CH - Digital Services

**Type of role**:

- Security
Other

**Working pattern**:

- Flexible working, Full-time

**Number of jobs available**:

- 1

**Contents**:

- Location
- About the job
- Benefits
- Things you need to know

**Location**:

- Cardiff, Wales, CF14 3UZ

**About the job**:
**Job summary**:
We are looking for a motivated and experienced **Lead Security Operations Specialist** to help strengthen and deliver our core monitoring, triage, and response capabilities. As Companies House grows and transforms, so too does our security team—and this role is essential to ensuring we can detect, investigate, and respond to threats effectively. This is an exciting opportunity for someone who thrives in fast-paced operational environments, enjoys solving complex technical problems, and is eager to contribute to a modern, collaborative, and high-performing Security Operations Centre (SOC). You’ll support the day-to-day monitoring of our systems, lead investigations, and provide guidance to junior SOC analysts. This role offers real impact and room to grow.

Companies House offers a flexible and welcoming culture that promotes a healthy work life balance as well as a proactive approach to wellbeing that allows us to be our best at work. We recognise that people are the key to our success so offer a fantastic benefits package including flexible working with no core hours, 30 days annual leave, 8 bank holidays and 1 privilege day as well as enrolment into the Civil Service Pension scheme with a contribution rate averaging 28%.

Find out more about what a great place Companies House is to work

**Job description**:
As a Lead Security Operations Specialist, you’ll play a central role in the day-to-day running of the Security Operations Centre. You’ll take ownership of alert triage, support incident response efforts, and work to optimise our use of security tools like Microsoft Sentinel and Defender.

Key deliverables:

- Monitoring security alerts and logs to identify, assess, and respond to potential threats and suspicious activity.
- Leading investigations into incidents and determining appropriate escalation or remediation actions.
- Fine-tuning rules and queries in Microsoft Sentinel and Microsoft Defender to improve detection accuracy and reduce false positives.
- Supporting and guiding junior SOC analysts, helping to build capability through coaching, shadowing, and knowledge sharing.
- Maintaining and improving playbooks, dashboards, and incident workflows.
- Working with IT, platform, and development teams to ensure effective integration of monitoring and security tooling.
- Advising on security improvements and collaborating on automation opportunities using scripting and playbooks.
- Providing technical input into incident reports and contributing to policy or procedural updates where needed.

**About the team**

The Cyber Security Team sits within the Data and Cyber Security Directorate, a growing part of Companies House that plays a central role in keeping our systems, data, and services secure as we undergo a large-scale digital transformation. You’ll be joining the Security Operations Centre, a collaborative and skilled team responsible for monitoring, detecting, and responding to security threats across the organisation. We are building out a modern SOC, focused on automation, proactive detection, and intelligent response. The team works closely with digital, platform, data, and infrastructure teams to embed security into everything we do. The team culture is open, inclusive, and centred around learning and collaboration. We believe in shared responsibility, encourage knowledge-sharing, and support individual growth. You’ll have opportunities to shape tooling and processes, contribute ideas, and help build a security function that evolves with the organisation’s needs.

**Person specification**:
We are looking for the following experience and skills which will be assessed at sift and interview.

**Experience**

We are seeking someone with strong experience in operational cyber security and a passion for improving security outcomes through hands-on problem-solving.

We are looking for applicants who have:

- Experience working in a Security Operations Centre or cyber operations team, ideally with exposure to public sector or enterprise environments.
- Technical knowledge of SIEM platforms such as Microsoft Sentinel, with experience in writing and tuning detection rules.
- Familiarity with Microsoft Defender, Microso