Cyber Security Operations Engineer (0833

The Role

The Cyber Security Operations Engineer for Transport for Wales (TfW) will be responsible for the implementation, configuration, and continuous improvement of technical security controls across TfW's cloud and on-premises platforms.

• Own the design authority and lifecycle management of technical security controls across TfW platforms by defining control standards, governing technical designs, and working with architecture, engineering, and delivery teams to embed security throughout the technology lifecycle, to provide scalable, risk-aligned protection that supports secure and resilient business services.
• Drive the vulnerability management capability across TfW technology services by overseeing tooling, governance, reporting, and risk‑based remediation activities with technology teams and suppliers, to reduce exposure to vulnerabilities and strengthen organisational cyber resilience.
• Develop and enhance TfW's monitoring and detection capability by working with SOC and MSSP providers to improve visibility, coverage, and threat detection effectiveness, to enable the timely identification and response to cyber threats.
• Lead the integration strategy for security technologies by defining roadmaps, governing implementation, and optimising the use of platforms including EDR, IAM, and cloud security solutions, to deliver cohesive and effective security controls across the enterprise.
• Provide technical leadership for SIEM and SOAR capabilities by overseeing use cases, automation opportunities, and operational improvements with internal and external partners, to maximise security operations effectiveness and support intelligence‑led threat detection and response.
• Drive the adoption of secure configuration standards across TfW platforms by establishing technical baselines, monitoring compliance, and supporting remediation activities, to maintain secure‑by‑default technology services aligned to recognised standards and organisational policy. Set and assure adherence to secure configuration standards, ensuring platforms are secure by default and aligned to recognised benchmarks and organisational policy.
• Embed secure‑by‑design principles across IT and Digital Services by collaborating with architects, engineers, and delivery teams throughout project and service life cycles, to reduce security risk and improve the resilience of technology solutions.
• Lead the identification and management of technical security risks by working with system owners to assess, prioritise, remediate, and govern risk treatment activities, to support informed risk management and protect organisational assets.
• Define and maintain technical security standards, procedures, and design patterns by providing governance, assurance, and technical guidance across technology teams, to achieve consistent, compliant, and auditable implementation of security controls.
• Provide senior technical leadership during cyber security incidents by coordinating investigation, containment, recovery, and post‑incident activities with relevant stakeholders, to minimise business impact and strengthen future security capabilities.

• Professional cyber security certification such as CompTIA Security+, Microsoft Security certifications (e.g. SC-200, SC-300), ISC2 CC, CISMP, or equivalent practical experience.
• Demonstrable experience leading security engineering, operational security, or technical security improvement work streams.
• Practical experience implementing and managing security controls across cloud and enterprise environments, including Microsoft 365, Azure, EDR, IAM, logging, SIEM, and cloud security technologies.
• Experience managing vulnerability remediation programmes, including vulnerability scanning, patch management processes, tooling, reporting, and risk‑based prioritisation.
• Knowledge of cyber security principles, secure configuration standards, security monitoring, and detection practices, including working with SOC and MSSP providers.
• Ability to analyse technical security data, assess risk, and prioritise remediation activities, with an understanding of risk management and control assurance frameworks such as…