Lead OT Cyber Security & Monitoring Engineer

About Us

National Grid Electricity Transmission (NGET) is at the heart of energy in the UK. The electricity that our network provides gets the nation to work, powers schools and brings energy to life. Our network connects the nation, so it’s essential that it’s continually evolving, advancing, and improving. In NGET we are passionate about both operating safely and providing highly reliable quality of supply for our customers.

We are seeking a Lead OT Security Engineer to strengthen the cyber security monitoring capability across National Grid Electricity Transmission's OT environment. You will provide technical leadership to enhance OT cyber detection, monitoring and alerting capabilities, working closely with the CSOC, CSIRT, operational teams, engineering stakeholders and strategic suppliers to improve visibility of cyber risk across critical operational systems.

This role is based in Warwick for 2 days per week and can be combined with hybrid working from home.

Job Purpose

We're passionate about operating our network safely and providing highly reliable quality of supply for our customers. At the heart of achieving these outcomes is the effective monitoring, detection and response to cyber threats across our Operational Technology (OT) estate.

The role acts as the OT subject matter expert for monitoring and alerting activities, providing operational context, asset knowledge and engineering insight to help enterprise cyber security teams assess, prioritise and respond to security events affecting OT environments. Working across both OT and cyber security communities, the role will help shape detection capabilities, improve monitoring effectiveness and strengthen cyber resilience across the electricity transmission network.

The role will also support the development of OT monitoring strategy, detection engineering, security roadmaps and incident response readiness, ensuring monitoring solutions and longer‑term capability plans remain effective against evolving threats while supporting the safe and reliable operation of critical operational systems.

What You'll Do

• Lead the development and continuous improvement of OT cyber monitoring, detection, and alerting capabilities across operational environments.
• Develop and influence OT security strategies, roadmaps, and capability plans, aligning operational risks, threat intelligence, regulatory requirements, and engineering priorities.
• Provide expert OT cyber security guidance and risk-based recommendations to engineering, operational, cyber security, and supplier stakeholders.
• Act as the key liaison between OT operations and enterprise cyber security teams, ensuring OT‑specific risks and operational considerations are reflected in security processes.
• Apply specialist knowledge of OT monitoring technologies, industrial control systems, and cyber threat detection to improve visibility and resilience across critical assets.
• Drive the development of detection use cases, alert tuning, monitoring enhancements, reporting, and performance metrics to strengthen security assurance and effectiveness.
• Support cyber incident response and preparedness activities, providing OT expertise for investigations, recovery, exercises, and continuous improvement initiatives.
• Coach and mentor colleagues, promoting knowledge sharing and consistency across OT cyber security and engineering teams.
• Collaborate with industry partners and suppliers to enhance monitoring, detection, incident response, and long‑term cyber resilience capabilities.

About You

• Proven experience in cyber security operations, threat detection, and incident response within Operational Technology (OT), industrial control systems, or regulated Critical National Infrastructure (CNI) environments.
• Strong understanding of OT environments, incident response lifecycles, cyber threats, and the challenges of securing critical infrastructure.
• Experience investigating cyber security incidents and supporting response, recovery, and resilience activities in OT or industrial environments.
• Knowledge of security monitoring, intrusion detection, network monitoring, and OT security platforms such as Dragos or equivalent.
• Understanding of cyber threat frameworks and methodologies, including MITRE ATT&CK for ICS and industrial communication protocols.
• Ability to work independently, lead complex technical activities, manage ambiguity, and influence stakeholders across operational, engineering, and cyber security teams.
• Strong collaboration, stakeholder management, and supplier engagement skills, with experience working across multidisciplinary teams.
• Experience contributing to cyber security strategies, capability roadmaps, assurance activities, regulatory compliance, or continuous improvement initiatives is desirable.
• Experience within electricity transmission, distribution, utilities, or other Critical National Infrastructure sectors is highly desirable.
• Relevant cyber security or OT security certifications (e.g. CISSP, GCIH, GCIA, GICSP, Security+, ISA/IEC 62443, SANS ICS) are advantageous.

What You'll Get

A competitive salary between £61,000 – £77,000 dependent on capability

plus £3,000 Market Supplement

As well as your base salary, you will receive

• 26 days holiday, plus eight statutory days, an option to buy extra holiday days, and the option to holiday swap up to 3 bank holiday days
• An annual performance incentive
• A generous pension scheme, double matched up to 6% of your salary each month. For every £1 you contribute we’ll put in another £2, so if you put in 6%, we’ll add 12% giving a total of 18% to your pension pot
• Life insurance at 10 times basic salary
• Employer funding towards a portion of your Private Medical Insurance.
• You will also have access to a number of flexible benefits such as a share incentive plan, salary sacrifice car and technology schemes, support via employee assistance lines and matched charity giving to name a few.

More Information

The closing date for this vacancy is 8th September . However, we encourage candidates to submit their applications as early as possible and not to wait until the published closing date. National Grid’s recruitment periods can and may vary. We reserve the right to remove this advert or close it to further applications at any point during the recruitment process.

In NGET we are passionate about both operating our network safely and providing highly reliable quality of supply for our customers. At the heart of achieving these outcomes is the effective control and operation of our network.

To find out more about us, please follow the link below:

DE & I statement

At National Grid, we work towards the highest standards in everything we do, including how we support, value and develop our people. Our aim is to encourage and support employees to thrive and be the best they can be. We celebrate the difference people can bring into our organisation, and welcome and encourage applicants with diverse experiences and background, and offer flexible and tailored support, at home and in the office.

Our goal is to drive, develop and operate our business in a way that results in a more inclusive culture. All employment is decided on the basis of qualifications, the innovation from diverse teams & perspectives and business need. We are committed to building a workforce so we can represent the communities we serve and have a working environment in which each individual feels valued, respected, fairly treated, and able to reach their full potential.

Please note that in most cases, National Grid is unable to offer sponsorship for employment under the UK points-based immigration system. As such, applicants must have the legal right to work in the UK without requiring sponsorship now or in the future under the UK points-based immigration system. However, in exceptional circumstances where there is a clear and demonstrable need for specialist skills that cannot be sourced from the local labour market, National Grid may consider offering sponsorship. All applications are welcome from candidates who meet these requirements, regardless of race, nationality, or ethnic origin.

#J-18808-Ljbffr