At a Glance
- Tasks: Lead a team of analysts in tackling cyber threats and improving security measures.
- Company: Join Made Tech, a leader in enhancing digital services for the UK public sector.
- Benefits: Competitive salary, flexible hours, and opportunities for professional growth.
- Other info: Collaborative environment with a focus on continuous learning and improvement.
- Why this job: Make a real difference in cybersecurity while developing your leadership skills.
- Qualifications: Experience in security analysis and strong communication skills required.
The predicted salary is between 60000 - 75000 £ per year.
Hackajob is collaborating with Made Tech to connect them with exceptional professionals for this role. Made Tech helps UK public sector organisations build and run better digital services. Our Cyber practice sits at the heart of that mission — working alongside government departments, agencies, and critical national infrastructure owners to improve how they detect, respond to, and learn from cyber threats.
As a Lead Security Analyst, you'll be the most senior analyst on your engagement, setting the technical direction for the SOC and owning the quality of what the team produces — from detection engineering to threat-hunting to incident response. This includes:
- Pairing on complex investigations and setting tradecraft standards.
- Ensuring the team's detection content is version-controlled, peer-reviewed, and continuously improved.
- Being the trusted technical interface for client security stakeholders, translating what the SOC is seeing into the language that informs decisions.
You'll align your work to NCSC guidance, the Cyber Assessment Framework, and OFFICIAL handling requirements — not because compliance is the goal, but because those frameworks reflect the real risk environment your clients operate in. You'll engage with cross-government security communities, feed detection content and runbooks back into the Cyber practice, and help grow a bench of analysts who can operate at the same standard.
Own the threat-landscape narrative for your engagement — turn intelligence from NCSC advisories, sector feeds, and threat actor reporting into hunt themes, coverage gap analysis, and detection priorities that the SOC and client stakeholders can act on. Run the intelligence cycle as a managed discipline — maintain a collection plan, produce timely and rigorous intelligence products, and build feedback loops that keep the cycle honest and improving.
Establish and lead security incident response practice — build playbooks, define the severity model, run exercises, and lead the team's response to significant incidents. Be the trusted technical interface for client security stakeholders — communicate what the SOC is detecting, investigating, and covering without losing fidelity; surface risks early and honestly, and align the team's priorities to the client's risk picture.
Grow the analysts around you — pair on detection authorship and incident response as a default, set pairing as the team norm, and actively build the capability of L1 and L2 analysts through structured mentoring and coaching so knowledge isn't concentrated in one person. Contribute to the Cyber practice beyond your engagement — feed detection content, runbooks, and lessons learned back into shared practice resources; and engage with public-sector security communities including NCSC CISP and relevant ISACs.
Required qualifications include:
- Certified Information Systems Security Professional (CISSP)
- Certified Information Security Manager (CISM)
- CompTIA Advanced Security Practitioner (CASP+)
- Experience leading detection engineering in a SOC or similar environment — including writing and tuning detections in KQL, SPL, EQL, or Sigma, and managing coverage against MITRE ATT&CK.
