SecOps Analyst

Job Title: MDA Security Operations (SecOps) Engineer

Clearance: DV required or ability to obtain

Location: Portsmouth

About the Role

We are seeking a hand-on Security Operations (SecOps) Engineer to secure and operate a MoD-hosted private cloud environment and its associated services.

You will play a key role in active defence of live services, combining security, vulnerability management, platform hardening, and operational security assurance.

You will work across infrastructure, platform and data layers to ensure systems are secure, compliant and resilient within a highly governed environment.

Key Responsibilities

• Monitor and respond to security events, alerts and incidents across cloud, platform, and application layers.

• Execute vulnerability scanning, patch assurance and configuration compliance checks.
• Maintain security tooling such as SIEM, EDR, vulnerability scanners, and cloud-native controls.
• Support ISO 27001 control operation and evidence collection.
• Ensure compliance with MoD security standards including JSP 440 and SbD requirements.
• Support internal/external audit, accreditation and remediation activities.
• Maintain secure configurations, firewall rules, access control policies, and logging standards.
• Provide security assurance during change, deployment and release activities.
• Support improvement of SecOps processes, SOPs and monitoring automation.

Essential Skills

• Experience operating within a Security Operations or SecOps function

• Hands-on experience with SIEM (e.g. ELK), EDR and vulnerability tooling
• Experience securing Linux and Windows environments
• Understanding of ISO 27001 and secure configuration principles
• Experience supporting cloud or virtualised platforms (e.g. VMware)
• Ability to investigate and respond to security incidents
• Strong understanding of operational security within governed environments
• Eligible for DV clearance

Desirable

• Experience in MOD or classified environments

• Automation experience (Ansible, Terraform, scripting)
• Experience with Nessus/Tenable or similar tools
• Familiarity with JSP 440/441/453 and NCSC guidance

Role Purpose

To deliver security operations for a private cloud platform, ensuring systems are actively monitored, vulnerabilities are managed, and services remain secure, compliant and resilient.

Key Responsibilities

Security Monitoring & Response

• Monitor SIEM, EDR and platform telemetry.

• Investigate alerts and perform incident triage and escalation.
• Conduct structured incident response activities.

Vulnerability & Patch Management

• Execute vulnerability scans and interpret results.

• Prioritise remediation based on risk and impact.
• Track and verify remediation activities.

Platform Security Engineering

• Maintain secure configurations across:
  • VMware / virtualisation platforms.
  • Linux and Windows systems.
  • Network security controls (firewalls, proxies).
• Support least privilege and zero-trust principles.

Security Tooling & Automation

• Operate and maintain SIEM, EDR and scanning tools.
• Improve detection rules and alert quality.
• Contribute to automation of security processes.

Compliance & Assurance

• Support ISO 27001 control operation and evidence collection.
• Maintain audit trails and configuration baselines.
• Support JSP 440/441/453 compliance and accreditation.

Change & Release Security

• Assess changes for security impact.
• Ensure deployments meet security requirements.
• Support secure-by-design implementation.

Documentation & Continuous Improvement

• Maintain SOPs, runbooks and incident documentation.
• Contribute to improvement of SecOps processes and tooling.

Essential Experience & Skills

• Experience in Security Operations or SecOps.

• SIEM, EDR and vulnerability management tooling experience.
• Strong Linux/Windows security and administration knowledge.
• Experience securing virtualised or cloud platforms.
• Understanding of ISO 27001 controls and audit processes.
• Ability to investigate and resolve security incidents.
• Awareness of networking and infrastructure security.

Desirable

• MOD or defence environment experience.

• Knowledge of JSP 440/441/453.
• Automation/scripting (Python, Bash, PowerShell).
• Experience with VMware NSX-T, vSphere.
• Security certifications (CISSP, Security+, GIAC etc.).

Guidant, Carbon60, Lorien & SRG - The Impellam Group Portfolio are acting as an Employment Business in relation to this vacancy.