SOC Consultant

On behalf of the Cabinet Office, we are looking for a SOC Consultant (Inside IR35) for a 9 Month contract based Hybrid in London.

We're seeking a SOC Consultant/Specialist to support a major cyber transformation programme within the Cabinet Office. This is a strategic, consultative role focused on improving and optimising an existing SOC. You'll bring deep experience in SOC design, review, and transformation, helping to fix Legacy issues, embed best practices, and improve how the SOC operates.

SC Clearance is an essential requirement for this role, as a minimum you must be willing & eligible to undergo checks. Please note, due to the exceptional requirements of this position (short-term nature of this role and speed at which we require a postholder in situ) preference may be given to candidates who meet all of the essential criteria and hold active security clearance.

As a SOC Consultant, your main responsibilities will be to:
. Lead the strategic delivery and continuous improvement of the Cyber Security Operations Centre (CSOC) to detect Real Time cyber security incidents/data breaches and manage our response and remediation activities.
. Review and assess the current SOC setup, identifying areas for improvement across processes, tooling, and governance, and implement strategic changes to optimise performance.
. Provide expert guidance on SOC best practices and transformation, working closely with senior stakeholders and external partners to drive long-term improvements.
. Provide strategic level advice to senior management regarding incident response, monitoring, logging and analysis of all relevant systems and processes.
. Define and evolve the cyber security operations strategy in line with threat posture and government direction.
. Develop and maintain a robust cyber incident response plan and identify the required levels of cyber investment within the CSOC to include governance, tooling and staffing.
. Analyse network traffic and behaviours to inform security posture and business decisions.

Essential:
. Experience managing Security Event Monitoring and operational response using SIEM, antivirus, and network/host-based IDS/IPS tooling.
. Proven experience setting up SOCs from scratch.
. Strong background in SOC strategy, optimisation, and transformation.
. Experience in incident response, threat detection, and monitoring frameworks.
. Familiarity with tools such as SIEM, IDS/IPS, antivirus, and correlation platforms.
. Knowledge of cyber security regulations and frameworks (eg GDPR, NIS, NCSC, ITIL, MITRE ATT&CK).
. Understanding of National Cyber Security Centre incident response and information security processes and policies.

Desirable:
. Experience onboarding critical applications and services into SOC monitoring and response workflows.
. Public sector experience.

Please be aware that this role can only be worked within the UK and not Overseas.

Disability Confident

As a member of the Disability Confident Scheme, The Cabinet Office guarantees to interview all candidates who have a disability and who meet all the essential criteria for the vacancy. In cases where we have a high volume of candidates who have a disability who meet all the essential criteria, we will interview the best candidates from within that group. This scheme encourages candidates with a disability and/or neurodivergence to apply. In exceptional circumstances, we may also need to apply the desirable criteria in our shortlisting process which may include holding active security clearance.

Armed Forces Covenant

The Cabinet Office guarantees to interview veterans or spouses/partners of military personnel who meet all the essential criteria for the vacancy. In cases where we have a high volume of ex-military candidates/military spouses or partners, who meet all of the essential criteria, we will interview the best candidates from within that group. In exceptional circumstances, we may also need to apply the desirable criteria in our shortlisting process which may include holding active security clearance.

In applying for this role, you acknowledge the following "this role falls in scope of the Off Payroll Working in the Public Sector legislation. Any rates of payment quoted will reflect the gross rate per day for the assignment and will be subject to appropriate taxes and statutory costs. As such the payment to the intermediary and your income resulting from this contract will be different".