Cyber Security Manager

Applied Computing was founded in 2024 to build Orbital, a physics-informed foundation model for energy operations. We're live across oil and gas, refineries, and petrochemicals, working towards our mission: sustainable abundance for a growing planet.

The hydrocarbon industry keeps the world running. But its complexity has left operators tied to legacy systems, making critical decisions on less than 10% of available data.

We built Orbital to change that. It's a foundation model built specifically for energy that lets companies use AI at scale, harnessing all of their operational data and optimising in real time for any metric. Decisions get faster, operations get safer, and carbon intensity falls.

We've raised over $32 million, including one of the largest seed rounds for an AI company in the UK. We're just getting started.

This is the first role in the company whose whole job is to keep us secure day to day. Right now detection, identity, endpoints, IT service and the UK estate are spread across four people and a Director, and nobody owns the operational half of it end to end. You would.

You will run security operations for a fast-moving AI business supporting three lines: our core business, our commercial client work, and Metis Red, our agentic security testing platform. You own identity and access, endpoints, network controls, vulnerability remediation, resilience testing, and the UK IT service and facilities that sit underneath all of it.

The part that makes this role unusual: we are not building a twenty-person SOC, we are building an autonomous one and we have not built it yet. The first job is to take the estate as it is, establish honestly where the monitoring gaps are, and close them.

From there you work with the team to design and build the agentic detection and response capability, validated against attacks from our own internal red team. You will run operations by hand while that is being built, and you will run what you helped build afterwards. If you want to shape a capability from the ground up and own the outcome, this is the right role.

If you want a mature toolchain and a large team to inherit, it is not.

• Own alert triage, investigation and response end to end, be the named person who declares an incident, runs it, and closes it out.
• Operate and tune the autonomous security operations capability. Treat agent output as a first line, never as a verdict.
• Own detection engineering: logging standards, alert quality, coverage gaps and false positive reduction.
• Validate detection coverage against attack paths from our internal red team, and close what it finds.
• Run post-incident reviews and drive the actions to genuine closure, not to a spreadsheet.

• Joiners, movers and leavers; privileged access; single sign-on; secrets management.
• Endpoint fleet hardening, patch compliance, EDR administration and device lifecycle.
• Network and edge controls, remote access and segmentation.
• Run access reviews that stand up to an auditor without a fire drill beforehand.

• Own the UK IT service: end user support, devices, and the on-premise server estate.
• Own the SaaS estate, roughly 85 products, including licensing, access, spend and rationalisation.
• Set and report service levels and keep the queue healthy rather than merely open.
• Own IT procurement and asset management.

• Own backup security and ransomware recovery, and test recovery rather than document it.
• Run the business continuity and disaster recovery exercise schedule and keep the evidence current.
• Establish and prove an out-of-hours arrangement that does not depend on one person's phone.

• Line manage and develop our offshore security resource, building them into first-line detection work.
• Set the standard, hold it, and be the escalation point when it is not met.

• Produce operational evidence for ISO 27001 and SOC 2 continuously, as a by-product of the work, not in an audit sprint.
• Answer the operational half of client due diligence so commercial is never waiting on us.
• Keep asset, log and…