Senior Information Security Officer

As well as the exciting opportunities this role presents, we also offer some great benefits some of which are below:

• 41 Days holiday (27 days annual leave 8 bank holiday and 6 closure days)
• Additional 5 days' annual leave purchase scheme
• Defined benefit career average revalued earnings pension scheme (CARE)
• Cycle to work scheme and season ticket loan
• Immigration loan
• Relocation scheme for certain posts
• On-Site nursery
• On-site gym
• Enhanced maternity, paternity and adoption pay
• Employee assistance programme: Staff Support Service
• Discounted medical insurance

Visit https://www.ucl.ac.uk/work-at-ucl/rewards-and-benefits to find out more

Within ISD, this post is in the Information Security Group, which leads on all aspects of security at UCL. The role sits within Security Operations, which is responsible for security monitoring, incident response, vulnerability management and threat intelligence.

Working under the direction of the Cyber Threat Management Lead, you will lead day-to-day threat intelligence, threat hunting and detection engineering activity. You will help maintain UCL's intelligence requirements and threat model, produce actionable intelligence, plan and conduct threat hunts, and identify opportunities to improve detection coverage against priority threats.

You will work closely with analysts, technical teams, service providers and stakeholders across UCL to turn intelligence, hunt findings and incident evidence into practical improvements to detections, playbooks, tooling and security controls. You will also provide coaching and direction to colleagues, communicate complex threat information clearly, and support evidence-based decisions about UCL's defensive posture.

As the ideal candidate you will have a mix of the following skills and experience:

• Significant experience in cyber threat intelligence, threat hunting, detection engineering, SOC operations, incident response support or related operational security work.
• Strong knowledge of intelligence requirements, threat modelling, intelligence cycles, analytical methods and the production of actionable intelligence.
• Strong knowledge of threat hunting and detection engineering methods, including hunt planning, telemetry analysis, detection coverage, custom detections and false-positive management.
• Experience using relevant security tooling and platforms, such as SIEM, TIP, SOAR, CTEM, intelligence collection platforms, reporting platforms and related monitoring or investigation tools.
• Experience using threat intelligence, hunt findings, incident findings or other operational evidence to improve detections, reporting, playbooks, tooling or controls.
• The ability to analyse complex or incomplete threat information and support timely, data-led decisions.
• Experience coordinating intelligence, hunting or detection engineering activity across analysts, technical teams, suppliers and stakeholders.
• Strong written and verbal communication skills, with the ability to explain threats, detection gaps, hunt findings and recommended actions to technical and non-technical audiences.
• The ability to organise and prioritise multiple activities, maintain accurate documentation, and ensure actions are clearly assigned, tracked and completed.
• Experience providing day-to-day leadership, coaching, knowledge sharing or technical direction to colleagues.