Job Description

Job Type: Fixed Term Contract- 15 months

Location: This role could be based in either our Edinburgh, Telford or Birmingham offices with time spent working in the office and at home.

Flexible working: All of our roles are open to part-time, job-share and other types of flexibility. We will discuss what is important to you and balancing this with business requirements during the recruitment process. You can read more about Phoenix Flex here.

Closing Date: 20/01/2026

Salary and benefits: £55,000 - £65,000 plus 16% bonus up to 32%, private medical cover, 38 days annual leave, excellent pension, 12x salary life assurance, career breaks, income protection, 3x volunteering days and much more

Who are we?

We want to be the best place that any of our 6,600 colleagues have ever worked.

We’re Phoenix Group, we’re a long-term savings and retirement business. We offer a range of products across our market-leading brands, Standard Life, SunLife, Phoenix Life and ReAssure. Around 1 in 5 people in the UK has a pension with us. We’re a FTSE 100 organisation that is tackling key issues such as transitioning our portfolio to net zero by 2050, and we’re not done yet.

The role

The Phoenix Group are looking for passionate and creative people to join our Cyber Security team within the Security Operations Centre. The Security Operations Centre is the first line of defence, protecting the assets and critical services of the organisation. As a Senior Cyber Security Specialist, you will be responsible for proactive detection and response to threats liaising with stakeholders, internal SMEs and third parties.

In the role of Senior Cyber Security Specialist, you will lead proactive threat detection and response using advanced capabilities in Microsoft Sentinel and Microsoft Defender. Your responsibilities will include developing and tuning custom detection rules, leveraging KQL-based advanced hunting queries, and creating automation playbooks to strengthen our security posture.

Working within the broader Cyber Security function, you will also partner with tour Threat Intelligence team to develop and perform advanced Threat Hunting activities.

As part of the team, some of the key accountabilities:

Oversee continuous threat detection and response operations, ensuring the effective use of Microsoft Sentinel and Microsoft Defender platforms, while maintaining automation playbooks, detection logic, and detailed documentation.
Design, execute, and optimise advanced threat hunting activities using KQL queries and telemetry from hybrid environments to identify and mitigate sophisticated threats.
Develop and implement bespoke detection rules and analytics to strengthen proactive monitoring across on-premises and multi-cloud infrastructures.
Collaborate with Security Architecture teams to design and integrate new detection capabilities, ensuring alignment with emerging threats and organisational requirements.
Provide technical support to project teams, enabling the successful deployment of new security capabilities, including Sentinel analytics, Defender configurations, and automated workflows.
Manage continuous threat detection and response services, maintaining tooling, playbooks, and documentation.
Design and operate advanced threat hunts.
Support the development, implementation, and delivery of security services across on premise and multi-cloud environments.
Work with Security Architecture to develop and design new capabilities.

What are we looking for?

The Phoenix Group are looking for passionate and creative people to join our Cyber Security team within the Security Operations Centre. The Security Operations Centre is the first line of defence, protecting the assets and critical services of the Phoenix Group. As a Senior Cyber Security Technician, you will be responsible for proactive detection and response to threats liaising with stakeholders, internal SMEs and third parties. Additionally, you will work with SMEs to maintain and develop the group security platform.

Experience of in depth threat hunting
Extensive experience of Microsoft Sentinel and Microsoft Defender.
Experience of KQL
Ideally Microsoft SC200 certification

We want to hire the whole version of you.

We are committed to ensuring that everyone feels accepted and welcome applicants from all backgrounds. If your experience looks different from what we’ve advertised and you believe that you can bring value to the role, we’d love to hear from you.

If you require any adjustments to the recruitment process, please let us know so we can help you to be at your best.

We’re reviewing applications as they come in, so apply early to avoid missing out.

Find out more about #LifeAtPhoenix #LI-GJ1

Guide for Candidates: thephoenixgroup.pagetiger.com/guideforcandidates
Find or get answers from our colleagues: www.thephoenixgroup.com/careers/talk-to-us

Threat Hunter jobs

Cyber Security Senior Specialist - Threat Hunter