If you’d like to be considered for this opportunity we encourage you to apply promptly to avoid disappointment as if applications are high the role will close before the closing date given.
Role: Active Cyber Defence Lead
Location: RG7 4PR, located between Reading and Basingstoke, with free onsite parking.
Package: starting from £65,100 p.a (depending on your suitability, qualifications, and level of experience)
Working pattern: AWE operates a 9-day working fortnight. We will consider flexible working requests so that your work may fit in with your lifestyle. Just let us know your preferred working pattern on your application.
Let us introduce the role:
The Active Cyber Defence Lead is responsible for the strategic leadership, development, and operational effectiveness of the organisations' active cyber defence capabilities. Reporting directly to the Head of Digital Operations, the role leads the proactive identification, disruption, and mitigation of cyber threats across the enterprise.
The role leads proactive threat detection, hunting, and disruption, ensuring cyber threats are identified, contained, and mitigated in line with organisational risk appetite and regulatory obligations. It provides assurance that cyber-defence capabilities are continuously improved through intelligence-led operations, performance metrics, and alignment to recognised frameworks.
The Active Cyber Defence Lead drives integration across the Security Operations Centre (SOC), Incident Response, Insider Threat, and Digital Forensics to deliver a cohesive, intelligence-led cyber defence posture.
Key Accountabilities:
- Active Cyber Defence Strategy and Governance: Accountable for defining, implementing, and governing the enterprise Active Cyber Defence strategy, ensuring alignment to direction from Chief Information Security Officer (CISO), organisational risk appetite, and regulatory requirements.
- Threat and Risk Identification: Accountable for the continuous identification, assessment, and prioritisation of cyber threats, vulnerabilities, attack paths, and insider risks.
- Detection and Monitoring Effectiveness: Accountable for the effectiveness, coverage, and continuous improvement of detection capabilities across SOC, SIEM, EDR, NDR, and insider threat monitoring.
- Incident Response and Disruption: Accountable for the timely and effective response, containment, and disruption of cyber threats, including advanced persistent threats, and insider activity.
- Integrated Cyber Defence Operations: Accountable for the seamless integration of the SOC, Incident Response, Insider Threat, and Digital Forensics into a unified, intelligence-led operating model.
- Protective Control Effectiveness: Accountable for ensuring defensive controls reduce attack surfaces and insider risk, including identity, endpoint, network, and data protection controls.
- Recovery and Resilience Improvement: Accountable for ensuring lessons learned from incidents drive measurable improvements in cyber resilience, controls, and detection capability.
- Performance, Metrics, and Assurance: Accountable for defining, tracking, and reporting cyber defence KPIs to the Head of Digital Operations, and Senior Leadership.
- Capability Development and Maturity: Accountable for continuous improvement of cyber defence maturity aligned to NIST CSF and recognised frameworks (e.g. MITRE ATT&CK)
- Leadership and People: Accountable for building and leading a high-performing, threat led cyber defence team with clear accountability and skills development.
Essential Criteria:
- Membership in a recognised professional organisation (e.g. BCS, ISACA, IAPP).
- Strong understanding of threat actor tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK.
- Able to communicate effectively at all levels with very good written and oral skills.
- Highly organized and capable of managing multiple concurrent tasks, whilst maintaining effective judgement in prioritizing and time allocation.
- Good interpersonal skills with the ability to explain technical problems to non-technical business stakeholders at all levels.
- Good presentation skills.
- Strong leadership, stakeholder management, and decision-making skills.
- Ability to work under pressure.
- Tenacious and able to defend conclusions.
- Good understanding of core information security principles.
- Strong analytical and documentation skills.
- Ability to communicate clearly and collaborate with technical and non-technical stakeholders.
- Able to work predominately onsite.
Work hard, be rewarded:
We ask a lot and set the bar high because our work truly matters. In return we offer balance, with award winning benefits including:
- 9-day working fortnight – meaning you get every other Friday off work, in addition to 270 hours of annual leave.
- Market leading contributory pension scheme (we will pay between 9% and 13% of your pensionable pay depending on your contributions).
- Family friendly policies: Maternity Leave - 39 Weeks Full Pay and Paternity Leave - 4 Weeks Full Pay.
- Opportunities for Professional Career Development including funding for annual membership of a relevant professional body.
- Employee Assistance Programme and Occupational Health Services.
- Life Assurance (4 x annual salary).
- Discounts – access to savings on a wide range of everyday spending.
- Special Leave Policy including paid time off for volunteering, public service (including reserve forces) and caring.
All candidates must be willing and able to obtain and maintain the appropriate security clearance for this role.
Next steps:
Everyone who works at AWE brings unique skills and perspectives to the table. We recognise that great people don’t always ‘tick every box’. That’s why we focus on your potential, your fit with our values, your transferable skills as well as your experience. Even if you don’t meet every point above, but you feel that this role and AWE are a great fit for you, please go ahead and apply, we’d love to receive your application.
Important things you need to know:
- We encourage you to apply promptly to avoid disappointment if applications are high and the role therefore closes.
- You will need to obtain and maintain the necessary security clearance for the role. This will be funded by AWE. The nature of our work does mean you need to be a British Citizen who has been resident in the UK for the past 5 years in order to apply for SC clearance and 10 years for DV.
- We want you to feel comfortable and able to shine during our recruitment process. Please let us know on your application form if you need any adjustments/accommodations during the process.
- Our interviews typically take place over Teams and for most roles are a 1 stage process.
Our ambition is to create workplaces where we recognise and celebrate differences, encourage diverse contributions and our employees feel able to be themselves at work. We strive to create a genuine culture of openness and inclusion and encourage diverse applicants. Any inclusion information you provide will be stored in accordance with GDPR and kept separate from your application form and CV, and the information will not be shared with anyone involved in interviewing or making hiring decisions.
Please note that you must be a British Citizen to apply for a role with us.
