CSIRT Engineers (18 month fixed-term contract)

Location: Hybrid – Hub-based (Bristol, Glasgow, or London) + Work from Home Contract & Salary: 18-Month FTC | Senior: £56,000 – £75,000 | Staff: £80,000 – £100,000 | + Up to 15% Discretionary Bonus + 9% Flex Pay 3-Word Snapshot: Adaptability | Passionate | Integrity Visa Sponsorship: Unfortunately, we are unable to offer sponsorship for this role. Why this role matters: At OVO, our mission is simple but huge: solve the climate crisis through Plan Zero . As a CSIRT Engineer in our Cyber Defence Operations team, you will act as a hands-on cybersecurity specialist ensuring the resilience and security of OVO’s digital estate. By expertly managing the full lifecycle of security threats—from proactive defence hardening to rapid incident response—you will protect the technology platform that underpins all our climate initiatives and enables millions of customers to transition to net-zero carbon living. What you’ll be doing: Reporting directly to the Delivery & Growth Lead , you'll work at the front line of our Security Operations Centre (SOC) to safeguard OVO's critical infrastructure: Front-Line Incident Response: Handle day-to-day security incidents, leading the swift containment, eradication, and post-incident recovery for critical security alerts. Detection Engineering: Develop and implement security monitoring and detection logic (e.g., SIEM rules) to reduce time from compromise to detection (MTTD). Proactive Security & Hardening: Conduct and support offensive security exercises, including penetration tests and red teaming, to continuously assess and harden OVO's environment. Operational Efficiency: Collaborate across the team to refine detection rules, automate workflows, and optimise ticket response for a lean, effective operation. Leadership & Mentorship: Guide and mentor analyst colleagues, directly contributing to the team’s collective growth and technical capabilities. What you’ll bring to the table: You don’t need to tick every single box to apply – if you have the core toolkit and a passion for problem-solving, we want to hear from you! The Essentials: Deep SOC & Incident Response Expertise: Proven track record of navigating high-pressure environments, managing the full lifecycle of security alerts, and leading containment and recovery with speed and technical precision. Offensive Security Mindset: Experience in Penetration Testing or Red Teaming to anticipate adversary tactics and proactively harden defences. Operational Efficiency & Automation: Ability to refine detection logic, automate workflows, and streamline response processes. Technical Leadership & Mentorship: Track record of mentoring peers and collaborating across teams to elevate technical capabilities. Additional requirements for the Staff Level role: Incident Ownership: Strong technical experience and confidence to independently lead complex incident responses from start to finish. Drive & Initiative: Proactive approach to improving processes, procedures, and playbooks to suit a fast-scaling organisation. Nice to have (but not essential): Hands-on experience with tools such as Google Chronicle, Crowdstrike, Jira, Sublime, or Tines . Where & how you’ll work: We believe in flexibility that works. You’ll be assigned to your closest hub office ( Bristol, Glasgow, or London ). We expect hub-based team members in the office at least once a week for collaborative days and in-person OVO Connection events, combined with flexible work-from-home options. What’s in it for you? We reward impact. On top of your core salary ( Senior: £56k–£75k | Staff: £80k–£100k depending on experience), you’ll get: 15% On-Target Bonus: Discretionary, tied to our collective Plan Zero mission performance. 9% Flex Pay: An extra 9% on top of your salary (4% auto-enrolled into pension, 5% yours to take as cash, put into pension, or spend on flex benefits). Time Off: 34 days of holiday (including bank holidays). Green & Home Perks: Up to £400 towards OVO Energy plans, plus discounts on solar…