Security Operations Manager

As Cyber Security Operations Manager, you’ll lead Nominet’s day-to-day security operations, helping to protect the critical services, infrastructure and data that people across the UK rely on. You’ll set the direction for monitoring, detection and incident response, and take the lead during significant cyber incidents. This is a hands-on leadership role that calls for sound technical judgement and clear decisions under pressure.

You’ll be responsible for the effectiveness of our security tools and operational processes, including alert triage, incident response and vulnerability escalation. You’ll manage and challenge our SOC/MSSP provider, working closely with Technology, Engineering, GRC, Threat and Vulnerability colleagues to improve how we detect threats, respond to incidents and reduce risk.

A key part of the role is improving how security operations work. You’ll identify where SOAR, automation and AI-enabled tools can reduce manual effort and make triage and response more consistent, while ensuring changes are tested and subject to appropriate human oversight. You’ll lead a small team of analysts and use evidence from incidents, security telemetry and supplier performance to show where the operation needs to improve.

What You'll Be Doing:

• Lead monitoring, detection, triage, escalation and incident response. Act as incident commander for material cyber incidents, from containment through recovery, communications and lessons learned.
• Own and exercise incident response plans and playbooks covering critical services, cloud, identity, endpoints, suppliers and data compromise.
• Manage and challenge the SOC/MSSP on alert quality, triage, escalation and measurable improvements in detection and response.
• Improve the effectiveness of security tooling, logging, detection rules and response workflows across SIEM, EDR/XDR, cloud, identity and vulnerability management.
• Introduce useful automation, including enrichment, case creation, triage and response playbooks. Use methods such as MITRE ATT&CK and NIST to improve detection and incident readiness.
• Ensure vulnerabilities and exposures are prioritised, assigned clear risk owners and tracked through treatment and closure.
• Lead and develop the analysts, report clearly to the CISO and senior stakeholders, and work with Engineering, Technology, GRC and Threat and Vulnerability colleagues. Deputise for the CISO on operational security matters when required.

About You:

What to expect next: