IT Manager - Cyber Intelligence

Location/s

Newcastle, UK

Nikki George

Mott Mac Donald is a global engineering, management, and development consultancy with over 20,000 employees across more than 50 countries and 140+ offices.

We work across incredible global industries, delivering exciting work that is defining our future and making an important societal impact in the communities we serve. Our people power our performance – we succeed when they do. With countless opportunities to collaborate, learn, and grow, the possibilities for excellence are as varied as every individual.

Whether you want to grow as a subject matter expert or broaden your experience with roles across our international community, you’re surrounded by global specialists who want to combine their expertise and champion you to be your best. As a proudly employee‑owned business, we benefit our clients, our communities, and each other, investing in creating the right space for everyone to feel empowered, included, and valued.

Whatever your ambition, Mott Mac Donald is where people come to be brilliant.

As the Cyber Security Manager for Cyber Intelligence, you will lead the organisation's detection and response strategy, ensuring robust operational resilience against evolving threats. This senior role is accountable for enhancing SIEM capabilities and driving improvements across Vulnerability & Patch Management, Incident Response & Disaster Recovery, and Asset & Threat Discovery.

You will manage a high‑performing team of engineers, embed automation and best practices, and collaborate with IT, engineering, and risk teams to deliver measurable reductions in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). You will influence strategic decisions, champion a security‑first culture, and ensure detection and response are integrated into enterprise operations.

We are committed to building a diverse, inclusive, and high‑performing security function. In this role, you will nurture talent, foster innovation, and create an environment where people feel supported, empowered, and valued in their mission to protect the organisation.

• Define and execute the SOC and SIEM strategy, aligning with organisational objectives, regulatory requirements, and risk appetite
• Lead and develop a high‑performing SOC and SIEM team, fostering accountability, innovation, and continuous improvement
• Champion automation and advanced analytics to improve detection, correlation, and response speed
• Maintain strong partnerships with IT operations, architecture, engineering, and risk teams to ensure integrated security operations and early threat detection
• Oversee SIEM platform architecture, log ingestion, and correlation accuracy, ensuring robust detection engineering and alert tuning aligned to frameworks such as MITRE ATT&CK
• Drive process optimisation, reducing false positives and improving triage efficiency
• Establish and monitor KPIs for detection coverage and operational performance
• Own vulnerability management strategy and patching governance across endpoints, servers, and cloud workloads, implementing automation to minimise exposure windows
• Report remediation progress to leadership and ensure SLA compliance
• Lead the development and maintenance of incident response and disaster recovery playbooks for critical attack scenarios
• Direct tabletop exercises and simulations to validate readiness and improve response metrics
• Act as escalation point during major incidents, ensuring rapid containment, root cause analysis, and recovery
• Govern continuous asset discovery and threat hunting programmes, ensuring accurate inventory feeds into CMDB and SIEM for correlation and reporting
• Drive proactive threat identification and risk reduction initiatives
• Own SOC governance reporting and ensure audit readiness for Cyber Essentials, ISO 27001, and regulatory frameworks
• Maintain risk register entries related to detection and response
• Develop and enforce security policies, standards, and operational procedures
• Act as the primary point of contact for SOC and SIEM matters with senior leaders and cross‑functional teams, providing clear, actionable insights and recommendations