Senior Threat Hunter

At Sellafield Ltd, we are harnessing our expertise; bringing together world-class skills and innovative technology to solve complex nuclear, infrastructure, and engineering challenges. By joining Sellafield Ltd, you join an amazing team of people, from all walks of life, where you can thrive in a connected, considerate culture of innovation, collaboration, and community; and play a significant part in the UK’s sustainable nuclear future.

This is a newly established role within Sellafield Ltd’s CS&IA Organisation, designed to enhance proactive threat detection capabilities within the Cyber Security Operations capability.

The role is crucial for uncovering hidden threats and adversary tactics across complex, regulated IT and OT environments, enabling timely detection and response to protect nuclear safety and operational resilience. The Senior Threat Hunter leads in developing advanced methodologies, integrating threat intelligence and driving automation, while balancing technical delivery with mentoring and collaboration. This position requires adaptability to evolving threats, commitment to regulatory compliance and proactive contribution to the continuous improvement of cyber defence.

The Senior Threat Hunter, as a technical specialist, leads continuous improvement, mentors junior staff and ensures compliance with regulatory and organisational security standards and operates within the regulated nuclear environment to ensure resilience, compliance and the safe and secure operation of the site.

• Develop and maintain structured threat hunting methodologies and playbooks to ensure repeatable, high‑quality hunting activities.
• Execute threat hunting activities to identify indicators of compromise and emerging attack techniques.
• Identify telemetry gaps and work with the SOC engineering team to improve data visibility and detection logic across IT and OT environments.
• Adapt hunting methodologies for OT environments, considering unique constraints such as limited telemetry, legacy systems, and operational safety requirements.
• Analyse threat intelligence and correlate findings with internal telemetry to detect potential risks.
• Develop and refine/test hunting hypotheses based on adversary TTPs and frameworks such as MITRE ATT&CK.
• Produce clear, actionable reports and recommendations for remediation and risk reduction.
• Assist incident response by providing technical analysis and threat context during investigations.
• Drive/Contribute to automation and scripting initiatives to streamline hunting workflows.
• Maintain awareness of threat actor behaviours, tools, and emerging vulnerabilities.
• Support/mentor capability development within the Threat team through knowledge sharing and best practices.
• Ensure adherence to data protection, confidentiality, and security standards in all threat hunting activities.

Authorities & Dimensions:

• Provide technical guidance and mentoring to junior staff.
• Influence stakeholders across CS&IA, HR and the wider Sellafield Ltd organisation.

Essential:

• Extensive experience in threat hunting, SOC operations, or cyber forensics.
• Understanding of adversary tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK.
• Familiarity with SIEM platforms and threat intelligence integration.
• Scripting skills (Python, Power Shell, REGEX) to support hunting and automation.
• Strong analytical and problem-solving skills; ability to work under pressure.
• Ability to communicate technical findings clearly to technical and non-technical audiences.
• Knowledge of regulatory frameworks (GDPR, NIS Directive) and security standards (NCSC CAF) relevant to critical infrastructure.

Desirable:

• Degree or equivalent experience in a relevant…