Job Description

To deliver advanced and proactive threat hunting and analysis activities that identify indicators of compromise and adversary tactics across Sellafield Ltd’s IT & OT environments. These roles are instrumental in strengthening cyber resilience by uncovering hidden threats, supporting incident response and improving detection capabilities.

The Senior Threat Hunter, as a technical specialist, leads continuous improvement, mentors junior staff and ensures compliance with regulatory and organisational security standards, while the Threat Hunter contributes technical expertise and supports capability development within the threat team. Both positions operate within the regulated nuclear environment to ensure resilience, compliance and the safe and secure operation of the site.

Principal Accountabilities

For both roles, with the senior role leading/directing and the junior role supporting/delivering:

• Develop and maintain structured threat hunting methodologies and playbooks to ensure repeatable, high‑quality hunting activities.
• Execute threat hunting activities to identify indicators of compromise and emerging attack techniques.
• Identify telemetry gaps and work with the SOC engineering team to improve data visibility and detection logic across IT and OT environments.
• Adapt hunting methodologies for OT environments, considering unique constraints such as limited telemetry, legacy systems, and operational safety requirements.
• Analyse threat intelligence and correlate findings with internal telemetry to detect potential risks.
• Develop and refine/test hunting hypotheses based on adversary TTPs and frameworks such as MITRE ATT&CK.
• Produce clear, actionable reports and recommendations for remediation and risk reduction.
• Assist incident response by providing technical analysis and threat context during investigations.
• Drive/Contribute to automation and scripting initiatives to streamline hunting workflows.
• Maintain awareness of threat actor behaviours, tools, and emerging vulnerabilities.
• Support/mentor capability development within the Threat team through knowledge sharing and best practices.
• Ensure adherence to data protection, confidentiality, and security standards in all threat hunting activities.

Authorities & Dimensions

Threat Hunter:
• Elevated access to threat hunting platforms, SIEM, and forensic tools.

Senior Threat Hunter:
• Provide technical guidance and mentoring to junior staff
• Influence stakeholders across CS&IA, HR and the wider Sellafield Ltd organisation

Essential Skills

• Practical (threat hunter) or extensive (senior threat hunter) experience in threat hunting, SOC operations, or cyber forensics.
• Understanding of adversary tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK.
• Familiarity with SIEM platforms and threat intelligence integration.
• Scripting skills (Python, PowerShell, REGEX) to support hunting and automation.
• Strong analytical and problem-solving skills; ability to work under pressure.
• Ability to communicate technical findings clearly to technical and non-technical audiences.
• Knowledge of regulatory frameworks (GDPR, NIS Directive) and security standards (NCSC CAF) relevant to critical infrastructure

Desirable Skills

• Degree or equivalent experience in a relevant discipline (e.g., Cyber Security, Computer Science, Digital Forensics).
• Certifications such as GIAC GDAT, GCFA, GCIA, or equivalent.
• Familiarity with cloud and hybrid environments.
• Knowledge of OT-specific threats and ICS/SCADA security principles.
• Experience in regulated environments (nuclear, defence, critical infrastructure).

Additional Information

• Open VN
• Number of Vacancies: 3
• Contact/s: Andrew Shutak

The interview dates for this vacancy are to be confirmed.

ASW’s may have the right to apply for internal Sellafield Ltd vacancies. Please note if you are an Agency Supplied Worker you are required to attach evidence of all qualifications obtained to support your application. We require a minimum of A*-C (9-4) GCSE in English Language, Maths & Science/IT or equivalent / higher qualification.

If you choose to apply for this role and your application is shortlisted by the hiring manager, you will be invited to a competency based interview.

Competencies will be provided if you are invited to interview.

Please see link to the competency framework for further information:
https://slportal.ssa-intra.net/pub/SC001/00027/Competency%20Framework/Forms/AllItems.aspx

If your technical competency is not in the above framework, please refer to the profession’s share point page for further information.

Sellafield Ltd are recognised as a Disability Confident Employer (Level 3). Disability Confident employers offer an interview to disabled applicants that meet the minimum criteria for a vacancy. Sellafield Ltd define the minimum criteria as the ‘essential skills’ which are listed on the vacancy notice. Whilst completing your application form, you will be able to indicate if you wish to be considered under the disability confident scheme. If you would prefer to discuss this directly with us, please contact the GBS Recruitment team on recruitment@sellafieldcloud.co.uk

Please ensure that you save a copy of this advert for future reference if you make an application for this role.

The closing date for this vacancy is Monday 20th July 2026.

Job Context and Challenges

These are newly established roles within Sellafield Ltd’s CS&IA Organisation, designed to enhance proactive threat detection capabilities within the Cyber Security Operations capability. Both roles are crucial for uncovering hidden threats and adversary tactics across complex, regulated IT and OT environments, enabling timely detection and response to protect nuclear safety and operational resilience.

The Senior Threat Hunter leads in developing advanced methodologies, integrating threat intelligence and driving automation, while balancing technical delivery with mentoring and collaboration.

Both positions require adaptability to evolving threats, commitment to regulatory compliance and proactive contribution to the continuous improvement of cyber defence.