Security Operations Manager

Select how often (in days) to receive an alert: Create Alert Location: Hybrid, with a minimum of 20% in the Oxford office per month About Us: We’re Nominet – a world-leading domain name registry operating at the heart of the UK internet. While we're best known for running .UK domains, our DNS expertise also underpins critical internet infrastructure that government services, including the NHS, rely on. As a public benefit company, our work has a positive impact on society. We’ve donated millions to projects that use technology to improve people’s lives and have committed to delivering £60m worth of support over the next three years. The Role: As Cyber Security Operations Manager, you’ll lead Nominet’s day‑to‑day security operations, helping to protect the critical services, infrastructure and data that people across the UK rely on. You’ll set the direction for monitoring, detection and incident response, and take the lead during significant cyber incidents. This is a hands‑on leadership role that calls for sound technical judgement and clear decisions under pressure. You’ll be responsible for the effectiveness of our security tools and operational processes, including alert triage, incident response and vulnerability escalation. You’ll manage and challenge our SOC/MSSP provider, working closely with Technology, Engineering, GRC, Threat and Vulnerability colleagues to improve how we detect threats, respond to incidents and reduce risk. A key part of the role is improving how security operations work. You’ll identify where SOAR, automation and AI-enabled tools can reduce manual effort and make triage and response more consistent, while ensuring changes are tested and subject to appropriate human oversight. You’ll lead a small team of analysts and use evidence from incidents, security telemetry and supplier performance to show where the operation needs to improve. What You’ll Be Doing: Lead monitoring, detection, triage, escalation and incident response. Act as incident commander for material cyber incidents, from containment through recovery, communications and lessons learned. Own and exercise incident response plans and playbooks covering critical services, cloud, identity, endpoints, suppliers and data compromise. Manage and challenge the SOC/MSSP on alert quality, triage, escalation and measurable improvements in detection and response. Improve the effectiveness of security tooling, logging, detection rules and response workflows across SIEM, EDR/XDR, cloud, identity and vulnerability management. Introduce useful automation, including enrichment, case creation, triage and response playbooks. Use methods such as MITRE ATT