Help us shape the future!

The CTOC Manager will have overall accountability for the delivery and development of the Cyber Threat Operations Centre (CTOC). This is a critical role, driving operational excellence, implementing cutting-edge solutions, maintaining robust digital security and will have a major impact on the strategy and direction of operational security within the company.

The core purpose of the CTOC Manager is to design, develop and implement the strategy for the CTOC across technology, people and processes. This is to ensure that the CTOC is continually developing against emerging threat actors and improving the maturity of the function, ensuring the team has robust procedures in place and effective coverage of the estate for security tooling.

The key stakeholders for this role are the CTOC, Cyber Defence, CISO and wider Digital and business teams, including C-Suite level as required. The CTOC Manager will work closely with the Head of Cyber Defence to ensure that the strategy for the CTOC aligns with that of the wider Cyber Defence teams and the business.

You will be responsible for identifying capabilities gaps and working with the business to bring in new technologies to ensure this is remediated, which will involve justifying return on investment, as well as technical integration and onboarding into the CTOC Team.

You will have:

• Demonstrable experience (5+ years') in successfully leading a high-performance team, including security analysts at all levels.
• Define and measure key performance indicators (e.g., MTTD, MTTR) to evaluate SOC performance and meet objectives and SLAs.
• Experience in designing, implementing and measuring relevant security and technology management critical success factors, key performance indicators, and metrics
• Proficient in security operations, including technical analysis, investigations, and handling security incidents in large-scale, fast-paced corporate environments both on premise and in the cloud.
• Experience with a broad range of enterprise security technologies including EDR, SIEM and SOAR.
• Ability to review technical or procedural documents or process outputs to assure defined requirements have been fulfilled
• Ability to interpret technical information and be able to relay this in an understandable manner
• Demonstrate continual self-development, keeping up to date with the latest developments within cyber security
• Ability to influence senior management (Internal & customer) on security operations good practice and best in class tooling
• Ability to identify and drive security operations improvement
• Willingness to self-development of own and team's knowledge according to market, customer, and HL requirements
• Ability to create regular reports at detailing the delivery of services offered

What's on offer

• Discretionary annual bonus* and annual pay review
• 25 days* holiday plus bank holidays and one additional Christmas closure day
• Option to purchase up to five additional days' holiday**
• Flexible working options, including hybrid working
• Enhanced parental leave
• Pension scheme with up to 11% employer contribution
• Income protection and life insurance (four times salary at core cover level)
• Private medical insurance*
• Healthcare cash plans, including optical, dental and outpatient care
• Health screening programme
• Help@hand, including confidential mental health counselling and remote GP support
• Free on-site gym including classes
• Wellhub access to fitness providers and wellness coaching
• Travel-to-work schemes, bike storage and shower facilities
• In-house barista and deli with subsidised coffee and sandwiches
• Two paid volunteering days each year

* Dependent on role level.
** Available for selection during the annual benefits window in November.

Belonging at HL

HL is an inclusive employer and we value the different perspectives and experiences people bring. We welcome applications from everyone and are committed to providing an accessible recruitment process. If you need an adjustment at any stage, please let the Recruitment & Onboarding team know.

Flexible working: This role may be available on a flexible-working or part-time basis. Please ask the Talent Acquisition team for more information.

Sponsorship: We are unable to provide employment sponsorship for this role.