Senior Security Specialist - Threat Detection/Hunting
Job summary
Are you passionate about cyber security and protecting essential public services from evolving threats? Digital Health and Care Wales (DHCW) is seeking a Senior Security Specialist - Threat Hunting to join our Cyber Security Operations Centre (CSOC).
This is an exciting opportunity to play a leading role in identifying cyber threats, strengthening security monitoring and improving the resilience of systems that support NHS Wales. Working as a senior technical specialist, you will lead proactive threat hunting activities, investigate complex security events and enhance detection capabilities across a diverse technology landscape.
You will collaborate with colleagues across DHCW, providing expert advice, driving continuous improvement and helping to protect critical national infrastructure and sensitive information. We welcome applications from people with a variety of backgrounds and experiences who share our commitment to innovation, collaboration and making a difference through cyber security.
Main duties of the job
As a Senior Security Specialist - Threat Hunting, you will proactively search for indicators of compromise, analyse security events and investigate complex cyber threats across DHCW and NHS Wales services. Using intelligence-led approaches, you will identify emerging risks and recommend actions to strengthen organisational security.
You will develop and improve security monitoring capabilities by refining SIEM analytics, detection rules, dashboards and investigation processes. Working closely with technical teams, you will help improve visibility across cloud, identity, endpoint, network and application environments.
The role also includes analysing trends, conducting horizon scanning, supporting incident response activities and contributing to cyber security projects and service improvements. As a senior member of the team, you will provide technical guidance, share knowledge with colleagues and support the ongoing development of the Cyber Security Operations Centre.
The ability to speak Welsh is desirable for this post; Welsh and/or English speakers are equally welcome to apply.
About us
Digital Health and Care Wales (DHCW) is part of the NHS Wales family and has an important role in changing the way health and care services are delivered through technology and data. The organisation supports frontline staff with modern systems and access to important information about their patients, while empowering the people of Wales to manage their own health through digital NHS Wales services.
Working for DHCW offers lots of employee benefits, including flexible working, a competitive salary, 28 days of annual leave plus Bank Holidays and opportunities for career development. We are committed to recognising and celebrating our staff as the most valuable part of our organisation.
Join our game changing, life-saving team and start making a real difference to health and care services in Wales.
Job description
Job responsibilities
You will be able to find a full Job description and Person Specification attached within the supporting documents or please click "Apply now" to view in Trac.
- Lead proactive threat hunting activities to identify suspicious or malicious activity.
- Act as a senior escalation point for complex cyber security investigations and incidents.
- Develop and optimise SIEM detections, analytics, dashboards and monitoring use cases.
- Analyse security telemetry from multiple sources to identify risks and improve resilience.
- Conduct threat-informed analysis and horizon scanning to understand emerging threats.
- Identify monitoring gaps and work with stakeholders to enhance security visibility.
- Produce clear technical reports, recommendations and investigation findings.
- Develop and maintain operational procedures, playbooks and technical documentation.
- Coach and support colleagues, sharing specialist knowledge and best practice.
- Build effective relationships with internal teams, suppliers and external partners.
- Present technical information to a range of audiences, including senior stakeholders.
- Participate in the cyber on-call rota and contribute to continuous service improvement.
Person Specification
Qualifications and Knowledge
- Degree and / or equivalent skills and experience in a relevant technical, cyber security or digital field
- Good understanding of cyber security operations, threat detection, incident response and threat hunting principles
- Strong knowledge of security monitoring, SIEM, identity, endpoint, cloud and network security concepts
- Strong technical expertise in areas such as network security, application security, cloud security, encryption, identity and access management, and security frameworks (e.g., NIST, ISO)
- Experience of threat hunting, detection engineering, threat intelligence or digital forensics
Experience
- Experience of working in cyber security operations, security monitoring, incident response or a related technical security role within a complex environment
- Experience of analysing security events, incidents and data from multiple sources to identify risks and support investigation or response
- Experience of using security tools and technologies, ideally including SIEM, endpoint, cloud or identity security tooling
- Experience of undertaking or supporting proactive threat hunting, detection tuning, security monitoring improvement or investigation of suspicious activity.
Skills and Attributes
- Experience of threat hunting, detection tuning or development of security use cases
- Highly developed ability to think logically and clearly, analyse problems and develop improvement strategies
Disclosure and Barring Service Check
This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.
Certificate of Sponsorship
Applications from job seekers who require current Skilled worker sponsorship to work in the UK are welcome and will be considered alongside all other applications. For further information visit the UK Visas and Immigration website.
From 6 April 2017, skilled worker applicants, applying for entry clearance into the UK, have had to present a criminal record certificate from each country they have resided continuously or cumulatively for 12 months or more in the past 10 years. Adult dependants (over 18 years old) are also subject to this requirement. Guidance can be found here Criminal records checks for overseas applicants.
Employer details
Employer name
Digital Health and Care Wales
Address
Hybrid working
Location to be confirmed at interview
CF11 9AD
United Kingdom
Employer's website
https://nwis.nhs.wales/