SSMonitoring Specialist

Position: SS7 Monitoring Specialist
Location: Newbury

Join UsAt Vodafone, we’re not just shaping the future of connectivity for our customers – we’re shaping the future for everyone who joins our team. When you work with us, you’re part of a global mission to connect people, solve complex challenges, and create a sustainable and more inclusive world. If you want to grow your career whilst finding the perfect balance between work and life, Vodafone offers the opportunities to help you belong and make a real impact.

What you’ll do Cyber Defence Operations (CDO) is Vodafone Group’s Cyber Defence Operations Centre of Excellence. CDO’s mission is to protect Vodafone customers against global cyber risk. CDO is specifically accountable for delivering:

Cyber Defence operational leadership across Vodafone.

Cyber Defence operational capabilities to Vodafone Group, the Local Market Operating Companies, and Partner Markets to enhance Vodafone’s global cyber defence posture and reduce its cyber risk.

The is accountable for providing advanced operational defence against signalling based threats impacting Vodafone’s telecommunications networks. The role specialises in monitoring, analysing, detecting, and responding to security events across SS7, Diameter and GTP-C using Signalling Firewalls and Signalling Intrusion Detection Systems.

As an escalation point for complex signalling incidents, the role leads investigations through deep protocol analysis, telemetry interrogation and advanced analytics while also owning continuous improvement of playbooks, dashboards, and operational processes. Additionally, the role collaborates with global Vodafone Cyber Security teams, including CERT and Incident Management, to support major incident investigations and cross functional initiatives.

Define, maintain and continuously improve Cyber Defence playbooks for SigFW related events.

Develop clear and actionable incident reporting to support effective prioritisation, escalation and decision making.

Support development and production integration of Signalling Intrusion Detection Systems (SigIDS).Design and maintain operational dashboards and analytics to improve signalling security situational awareness.

Perform continuous monitoring and triage of signalling security events in line with defined severity and escalation criteria.

Lead the analysis of unusual signalling patterns, behaviours and anomalies within the network, identifying potential SS7/Diameter abuse and responding to threats before network impact occurs.

Analyse known and emerging signalling attack techniques (e.g. interception, location tracking, routing manipulation, fraud enablement) and translate these into effective detection logic, analytics and investigative guidance.

Maintain expert knowledge of SS7/Diameter abuse patterns and translate this into detection logic, alerts and investigative guidance.

Feed lessons learned from incidents and intelligence back into preventative controls, dashboards and playbooks.

Raise and manage incident and remediation tickets (e.g. Remedy)
Manage enrichment of signalling telemetry (e.g. via Cribl coordinated through Git Hub Enterprise).Consume telecom specific threat intelligence and integrate insights into SigFW/SigIDS detections, playbooks and operational workflows.

Identify control gaps and propose enhancements to detection logic, SigFW policies and operational procedures to improve signalling security posture.

Act as a technical liaison between Cyber Defence and Network Engineering to influence signalling security policy, control design and operational effectiveness.

Brief internal and external stakeholders including NCSC, NSIE and Ofcom where required.

Evaluate and optimise signalling security tooling to ensure effective defence against evolving threats and emerging attack techniques.

Continuously work to stabilize the process and procedures

Security Reporting and Advisories – take part in and may drive the delivery of signalling security reports and advisories to all key stakeholders

Who you are Strong willingness to learn and adapt to new tools, technologies and emerging signalling threats in a fast moving security environment.

Open minded, collaborative and comfortable working across…