IT SecOps Engineer

Role: IT SecOps Engineer
Contract Type: Permanent
Location: Banbury / Hybrid working, 3 days in office. This role can be based out of any office on the Chiltern network
Salary: Up to £58,000 per annum
Closing Date: Monday 24th November 2025

There is an expectations to travel to different Chiltern sites outside of your base location to support wider colleagues and attend meetings.

Job Purpose
The IT Security Operations Engineer is responsible for protecting the digital services that support a safe and reliable journey for our passengers and a secure working environment for our staff. This is a hands-on role focused on strengthening our security posture through technical expertise and cross-departmental collaboration. You will report into the IT Information Security Manager with expected collaboration with the wider IT Team management, representing Digital, Data and Technology (DDaT).

Key purposes of this role include:

• Safeguarding Operations: Actively manage and enhance our security platforms (primarily SIEM, XDR and IDAM polices) to detect, prevent, and respond to cyber threats across our IT and operational networks.
  
  
• Implementing and reviewing Security Controls: Serve as the subject matter expert for implementing technical security controls on applications, networks, and infrastructure to mitigate risk.
  
  
• Fostering Collaboration: Work closely with a wide range of internal teams, from IT colleagues to Train Engineers, to ensure security best practices are understood and integrated into their processes and systems.
  
  Key Accountabilities
  
  Threat and Vulnerability Management
  
  
• Develop incidence response and security measures for protection.
  
  
• Complete risk and exploitability assessments against vulnerabilities and live threats.
  
  
• Serve as a subject matter expert in vulnerability management for incident response and risk assessments.
  
  
• Oversee patching compliance and report/escalate vulnerabilities for remediation.
  
  Security tooling and Process Improvement
  
  
• Manage the deployment of new security tools, ensuring existing tools are maintained and tuned.
  
  
• Identify gaps, implement enhancements, and drive automation for continuous improvement.
  
  
• Integrate tools with SIEM, CMDB, and ticketing systems to streamline workflows.
  
  
• Create and update troubleshooting guides and knowledge base articles to support the wider team.
  
  Compliance and Governance
  
  
• Ensure practices meet known frameworks and standards including (but not restricted to): Cyber Essentials Plus, Cyber Assessment Framework, ISO 27001, and CIS.
  
  
• Support and participate in internal and external security audits, providing technical assurance and evidence to ensure our systems adhere to required standards.
  
  Collaboration and Mentorship
  
  
• Represent the function in cross-functional forums, steering committees, and stakeholder engagements.
  
  
• Provide mentorship to the DDaT team members, promoting a culture of continuous improvement.
  
  Person Specification
  
  Essential
  
  
• A background in IT infrastructure, cloud services, and cyber security.
  
  
• Proven continuous development in both technical and soft domains.
  
  
• Proficiency with security tools and technologies such as SIEM, DLP, network protection, threat detection, and endpoint protection.
  
  
• An understanding of network infrastructure such as VPNs, firewalls, switches, routers, LANs, Intrusion Detection, and vulnerability scanning.
  
  
• Understanding of IT and cyber security frameworks, standards, and regulations (examples: ISO27001, NIS2, GDPR, and CAF).
  
  
• Understanding of the Cyber Kill Chain and MITRE ATT&CK frameworks.
  
  
• Ability to collaborate effectively with various internal and external stakeholders.
  
  
• Relevant certifications such as Microsoft Security Operations Analyst (SC-200) or Azure Security Engineer (AZ-500), or the ability to demonstrate equivalent knowledge.
  
  Desirable
  
  
• Familiarity with the Microsoft security suite: Defender, InTune, Purview, EntraID, and Azure.
  
  
• Further certifications such as CISSP, CISM, or CRISC are advantageous
  
  
• Familiarity with PCI-DSS standards.
  
  
• Experience influencing cyber security investments and initiatives by providing expert advice to stakeholders and management.
  
  
• Educated to degree level or equivalent