Genomics England is hiring a Cyber Security Engineer (we have office locations in Cambridge, Leeds & London)

As a Cyber Security Engineer at Genomics England, working within the Cyber Security team, you will operate at the intersection of cyber defence, threat analysis, and security engineering, protecting one of the UK’s most sensitive technology and data environments at national scale. Your primary focus will be on detecting, analysing, and responding to cyber threats, while improving the controls, tooling, and processes that enable effective security operations. Working closely with Platform Engineers, Cloud Engineers, and Architects, you will help ensure security controls are observable, resilient, and effective by design. This includes enhancing security monitoring and alerting capabilities, improving detection logic, and supporting incident response through technical investigation and root cause analysis. A significant part of the role involves hands-on cyber defence, including security event analysis, threat hunting, and incident response. You will work with logs and telemetry across cloud, platform, and application layers to identify genuine threats and support timely, effective response actions. You will also apply engineering principles to security challenges by automating workflows, integrating security tooling into engineering processes, and improving operational efficiency through scripting and configuration-as-code approaches. Skills and Experience for Success: - Hands-on experience monitoring, detecting, analysing, investigating, and responding to cyber security threats. - Strong understanding of cyber security operations and incident response, including root cause analysis and post-incident review activities. - Experience working with SIEM and SOAR platforms, including alert analysis, detection tuning, and response automation. - Experience performing threat hunting and integrating threat intelligence into operational security activities. - Practical experience with cloud security concepts and services, particularly within AWS environments, including logging, telemetry, native security controls, and common attack patterns. - Experience improving security operations through automation, and configuration-as-code approaches. - Familiarity with Infrastructure-as-Code and CI/CD tooling (e.g. Terraform, GitLab CI/CD, or equivalent), with the ability to review and influence security controls within engineering workflows. - Experience working within DevOps or squad-based delivery environments, collaborating closely with engineers and architects. - Strong communication skills, with the ability to explain security issues clearly to both technical and non-technical audiences, particularly during incidents.