Senior Information Security Officer

Overview

In this role you lead threat intelligence, threat hunting and detection engineering within UCL’s Security Operations. You’ll shape intelligence requirements, plan hunts and turn findings into practical improvements to detections, playbooks and security controls. You’ll collaborate with analysts, technical teams and stakeholders to strengthen UCL’s defensive posture, and you’ll coach colleagues while communicating complex threat information clearly. This is an opportunity to influence security across a leading HE institution and help drive secure digital transformation.

Pay / Benefits

• 41 Days holiday
• CARE pension
• Cycle to work scheme
• Season ticket loan
• On-site nursery and gym
• Enhanced maternity/paternity pay

Responsibilities

• Lead day-to-day threat intelligence, threat hunting and detection engineering activities
• Maintain intelligence requirements and the threat model; produce actionable intelligence
• Plan and conduct threat hunts to identify weaknesses and gaps
• Improve detection coverage against priority threats
• Collaborate with analysts, technical teams, service providers and stakeholders to translate findings into detections, playbooks, tooling and controls
• Provide coaching and direction to colleagues; communicate complex threat information clearly
• Support evidence-based decisions about UCL’s defensive posture

Key requirements

• Significant experience in cyber threat intelligence, threat hunting, detection engineering, SOC operations or related operational security work
• Strong knowledge of intelligence requirements, threat modelling, intelligence cycles and analytical methods
• Experience with hunt planning, telemetry analysis, detection coverage, custom detections and false-positive management
• Experience using security tooling and platforms (SIEM, TIP, SOAR, CTEM, intelligence collection platforms, reporting platforms)
• Ability to use threat intelligence and hunt/incident findings to improve detections, reporting, playbooks, tooling or controls
• Ability to analyse complex or incomplete threat information and support data-led decisions
• Experience coordinating intelligence, hunting or detection engineering across teams and stakeholders
• Strong written and verbal communication skills for technical and non-technical audiences
• Ability to organise and prioritise multiple activities and maintain clear documentation
• Experience providing day-to-day leadership, coaching and technical direction

• Strong written and verbal communication
• Leadership and coaching
• Cross-functional collaboration
• SIEM
• TIP
• SOAR

…