There is an expectation to travel to different Chiltern sites outside of your base location to support wider colleagues and attend meetings. The IT Security Operations Engineer is responsible for protecting the digital services that support a safe and reliable journey for our passengers and a secure working environment for our staff. This is a hands‑on role focused on strengthening our security posture through technical expertise and cross‑departmental collaboration. You will report to the IT Information Security Manager with expected collaboration with the wider IT Team management, representing Digital, Data and Technology (DDaT).
Key responsibilities
* Safeguarding Operations: Actively manage and enhance our security platforms (primarily SIEM, XDR and IDAM policies) to detect, prevent, and respond to cyber threats across our IT and operational networks.
* Implementing and reviewing Security Controls: Serve as the subject matter expert for implementing technical security controls on applications, networks and infrastructure to mitigate risk.
* Fostering Collaboration: Work closely with a wide range of internal teams, from IT colleagues to Train Engineers, to ensure security best practices are understood and integrated into their processes and systems.
* Threat and Vulnerability Management
o Develop incident response and security measures for protection.
o Complete risk and exploitability assessments against vulnerabilities and live threats.
o Serve as a subject matter expert in vulnerability management for incident response and risk assessments.
o Oversee patching compliance and report/escalate vulnerabilities for remediation.
* Security Tooling and Process Improvement
o Manage the deployment of new security tools, ensuring existing tools are maintained and tuned.
o Identify gaps, implement enhancements, and drive automation for continuous improvement.
o Integrate tools with SIEM, CMDB and ticketing systems to streamline workflows.
o Create and update troubleshooting guides and knowledge base articles to support the wider team.
* Compliance and Governance
o Ensure practices meet known frameworks and standards including (but not restricted to): Cyber Essentials Plus, Cyber Assessment Framework, ISO 27001 and CIS.
o Support and participate in internal and external security audits, providing technical assurance and evidence to ensure our systems adhere to required standards.
* Collaboration and Mentorship
o Represent the function in cross‑functional forums, steering committees and stakeholder engagements.
o Provide mentorship to the DDaT team members, promoting a culture of continuous improvement.
Qualifications
* A background in IT infrastructure, cloud services and cyber security.
* Proven continuous development in both technical and soft domains.
* Proficiency with security tools and technologies such as SIEM, DLP, network protection, threat detection and endpoint protection.
* An understanding of network infrastructure such as VPNs, firewalls, switches, routers, LANs, intrusion detection, and vulnerability scanning.
* Understanding of IT and cyber security frameworks, standards and regulations (examples: ISO27001, NIS2, GDPR and CAF).
* Understanding of the Cyber Kill Chain and MITRE ATT&CK frameworks.
* Ability to collaborate effectively with various internal and external stakeholders.
* Relevant certifications such as Microsoft Security Operations Analyst (SC‑200) or Azure Security Engineer (AZ‑500), or the ability to demonstrate equivalent knowledge.
Desirable
* Familiarity with the Microsoft security suite: Defender, Intune, Purview, Entra ID and Azure.
* Further certifications such as CISSP, CISM or CRISC are advantageous.
* Familiarity with PCI‑DSS standards.
* Experience influencing cyber security investments and initiatives by providing expert advice to stakeholders and management.
* Educated to degree level or equivalent.
#J-18808-Ljbffr