{"id":4020128,"url":"https://alion.io/job/awe-active-cyber-defence-lead","title":"Active Cyber Defence Lead","company":{"id":1799578,"name":"AWE","domain":"awe.co.uk","url":"https://alion.io/company/awe-co-uk","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Reading, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":65100,"max":null,"currency":"GBP","period":"year","gross":null,"usd_annual":87320},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-11-10T14:43:11Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T14:43:11Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"If you’d like to be considered for this opportunity we encourage you to apply promptly to avoid disappointment as if applications are high the role will close before the closing date given.\nRole: Active Cyber Defence Lead\nLocation: RG7 4PR, located between Reading and Basingstoke, with free onsite parking.\nPackage: starting from £65,100 p.a (depending on your suitability, qualifications, and level of experience)\nWorking pattern: AWE operates a 9-day working fortnight. We will consider flexible working requests so that your work may fit in with your lifestyle. Just let us know your preferred working pattern on your application.\nLet us introduce the role:\nThe Active Cyber Defence Lead is responsible for the strategic leadership, development, and operational effectiveness of the organisations' active cyber defence capabilities. Reporting directly to the Head of Digital Operations, the role leads the proactive identification, disruption, and mitigation of cyber threats across the enterprise.\nThe role leads proactive threat detection, hunting, and disruption, ensuring cyber threats are identified, contained, and mitigated in line with organisational risk appetite and regulatory obligations. It provides assurance that cyber-defence capabilities are continuously improved through intelligence-led operations, performance metrics, and alignment to recognised frameworks.\nThe Active Cyber Defence Lead drives integration across the Security Operations Centre (SOC), Incident Response, Insider Threat, and Digital Forensics to deliver a cohesive, intelligence-led cyber defence posture.\nKey Accountabilities:\nActive Cyber Defence Strategy and Governance: Accountable for defining, implementing, and governing the enterprise Active Cyber Defence strategy, ensuring alignment to direction from Chief Information Security Officer (CISO), organisational risk appetite, and regulatory requirements. \nThreat and Risk Identification: Accountable for the continuous identification, assessment, and prioritisation of cyber threats, vulnerabilities, attack paths, and insider risks. \nDetection and Monitoring Effectiveness: Accountable for the effectiveness, coverage, and continuous improvement of detection capabilities across SOC, SIEM, EDR, NDR, and insider threat monitoring. \nIncident Response and Disruption: Accountable for the timely and effective response, containment, and disruption of cyber threats, including advanced persistent threats, and insider activity. \nIntegrated Cyber Defence Operations: Accountable for the seamless integration of the SOC, Incident Response, Insider Threat, and Digital Forensics into a unified, intelligence-led operating model. \nProtective Control Effectiveness: Accountable for ensuring defensive controls reduce attack surfaces and insider risk, including identity, endpoint, network, and data protection controls. \nRecovery and Resilience Improvement: Accountable for ensuring lessons learned from incidents drive measurable improvements in cyber resilience, controls, and detection capability. \nPerformance, Metrics, and Assurance: Accountable for defining, tracking, and reporting cyber defence KPIs to the Head of Digital Operations, and Senior Leadership. \nCapability Development and Maturity: Accountable for continuous improvement of cyber defence maturity aligned to NIST CSF and recognised frameworks (e.g. MITRE ATT&CK) \nLeadership and People: Accountable for building and leading a high-performing, threat led cyber defence team with clear accountability and skills development. \nEssential Criteria:\nMembership in a recognised professional organisation (e.g. BCS, ISACA, IAPP). \nStrong understanding of threat actor tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK. \nAble to communicate effectively at all levels with very good written and oral skills. \nHighly organized and capable of managing multiple concurrent tasks, whilst maintaining effective judgement in prioritizing and time allocation. \nGood interpersonal skills with the ability to explain technical problems to non-technical business stakeholders at all levels. \nGood presentation skills. \nStrong leadership, stakeholder management, and decision-making skills. \nAbility to work under pressure. \nTenacious and able to defend conclusions. \nGood understanding of core information security principles. \nStrong analytical and documentation skills. \nAbility to communicate clearly and collaborate with technical and non-technical stakeholders. \nAble to work predominately onsite. \nWork hard, be rewarded:\nWe ask a lot and set the bar high because our work truly matters. In return we offer balance, with award winning benefits including:\n9-day working fortnight - meaning you get every other Friday off work, in addition to 270 hours of annual leave.\n Market leading contributory pension scheme (we will pay between 9% and 13% of your pensionable pay depending on your contributions).\nFamily friendly policies: Maternity Leave - 39 Weeks Full Pay and Paternity Leave - 4 Weeks Full Pay.\nOpportunities for Professional Career Development including funding for annual membership of a relevant professional body.\nEmployee Assistance Programme and Occupational Health Services.\n Life Assurance (4 x annual salary).\nDiscounts - access to savings on a wide range of everyday spending.\n Special Leave Policy including paid time off for volunteering, public service (including reserve forces) and caring.\nAll candidates must be willing and able to obtain and maintain the appropriate security clearance for this role.\nNext steps: \nEveryone who works at AWE brings unique skills and perspectives to the table. We recognise that great people don’t always ‘tick every box’. That’s why we focus on your potential, your fit with our values, your transferable skills as well as your experience. Even if you don’t meet every point above, but you feel that this role and AWE are a great fit for you, please go ahead and apply, we’d love to receive your application.\nImportant things you need to know:\nWe encourage you to apply promptly to avoid disappointment if applications are high and the role therefore closes.\nYou will need to obtain and maintain the necessary security clearance for the role. This will be funded by AWE. The nature of our work does mean you need to be a British Citizen who has been resident in the UK for the past 5 years in order to apply for SC clearance and 10 years for DV. \n We want you to feel comfortable and able to shine during our recruitment process. Please let us know on your application form if you need any adjustments/accommodationsduring the process.\nOur interviews typically take place over Teams and for most roles are a 1 stage process.\nOur ambition is to create workplaces where we recognise and celebrate differences, encourage diverse contributions and our employees feel able to be themselves at work. Westrive to create a genuine culture of openness and inclusion and encourage diverse applicants. Any inclusion information you provide will be stored in accordance with GDPR and kept separate from your application form and CV, and the information will not be shared with anyone involved in interviewing or making hiring decisions.\nPlease note that you must be a British Citizen to apply for a role with us.","description_format":"text","description_chars":7286,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Flexible schedule"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Incident Response","Defense Manufacturing","Nuclear Engineering"],"lifecycle":[{"event":"open","at":"2026-11-10T14:43:11Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":15,"reasons":["conf:2","win:early"],"computed_at":"2026-11-10T17:41:51Z"},"pay":{"stated_usd_annual":87320,"is_top_pay":false},"html_url":"https://alion.io/job/awe-active-cyber-defence-lead","json_url":"https://alion.io/job/awe-active-cyber-defence-lead.json","meta":{"generated_at":"2026-11-10T17:41:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6669,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1799578},"rest":"https://alion.io/mcp/rest/get_company?id=1799578"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fawe-active-cyber-defence-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fawe-active-cyber-defence-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fawe-active-cyber-defence-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/awe-active-cyber-defence-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fawe-active-cyber-defence-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4020128}},{"tool":"search_jobs","arguments":{"company":"awe.co.uk","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4020128},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}