Operational Security Team Lead

At Sellafield Ltd, we are harnessing our expertise; bringing together world‑class skills and innovative technology to solve complex nuclear, infrastructure, and engineering challenges. By joining Sellafield Ltd, you join an amazing team of people, from all walks of life, where you can thrive in a connected, considerate culture of innovation, collaboration, and community; and play a significant part in the UK’s sustainable nuclear future.

The challenges we face are amongst the most complex anywhere in the world. We are using advanced technologies to shape, create and advance the world’s nuclear decommissioning knowledge and capability. That’s why our work is driven by people with a passion for problem‑solving and innovation.

We are seeking an Operational Security Team Lead to establish a new team managing day‑to‑day security and resilience of systems managed by the IT Service Delivery function. This role focuses on ensuring core operational security controls are consistently applied, including patching, vulnerability management, adherence to security standards and policies, and the governance of privileged user access.

This role will ensure that our systems, applications, and data are adequately protected against potential threats and vulnerabilities. The IT Operations Security Team take responsibility for identifying, assessing, and driving remediation efforts for vulnerabilities across Sellafield’s on‑premise and cloud infrastructure, adhering to stringent regulatory requirements and industry best practices.

The IT Operations Security Team are responsible for Access Management and maintenance of identity and access management solutions, enforcement of access policies and conducting regular access reviews. As well as point of approval for privileged activities and privileged Identity Management.

• Implement and manage robust security protocols and procedures, identifying potential threats and vulnerabilities across operational processes.
• Oversee regular vulnerability assessments, ensuring rapid response and ongoing improvement of penetration testing plans and methodologies across systems and applications.
• Ensure clear understanding within the IT Operations Security Team of the criticality and importance of information and technology resources to enable effective prioritisation of monitoring and remediation.
• Act as the primary liaison for security‑related matters, maintaining strong communication with the Cyber Team.
• Collaborate closely with IT and Cyber teams to strengthen the organisation’s security posture, support incident response, and contribute to the development and implementation of security policies, including process and governance for certificate and encryption key management.
• Provide oversight for the Access Management capability, managing team workload and ensuring delivery of privileged access management, including provisioning, deprovisioning, and auditing.
• In collaboration with CS&IA, ensure VA and ITHC results are analysed, triaged, and risk‑scored based on potential business impact.
• Ensure the organisation’s risk appetite for information security is understood and applied across the area of responsibility, and confirm all suppliers meet patch management requirements tied to SLA/KPI obligations.
• Analyse and elevate risks from SLA/KPI shortfalls, feeding into CS&IA for assessment and upward reporting through the Governance, Risk, and Compliance structure.
• Oversee the development, maintenance, and continuous improvement of the identity and access management framework and account‑level principles, working with ISO/ICT and business stakeholders to align with wider regulatory and organisational priorities.

• Degree in Cyber Security / Information Security or equivalent practical experience.
• Proven experience of leading or working in operational security teams.
• Strong knowledge of security processes, procedures, and vulnerability management (on‑premise and cloud).
• Experience using vulnerability scanning/management tools and interpreting results.
• Proven ability to analyse security issues, assess risks, and recommend corrective action.
• Expe…