This role sits within the Threat Detection & Engineering sub-team of the Group Security Operations Centre (GSOC), under the Security & Resilience function. The role helps Nationwide rapidly identify malicious activity by creating and maintaining high-quality security detections across key security platforms and telemetry sources. The main purpose of the role is to turn security telemetry, threat intelligence, attack-simulation outcomes and operational requirements into detection content that SOC teams can act on. By improving visibility, reducing false positives and identifying suspicious activity earlier, the role contributes to reducing cyber risk and helps protect services that members rely on. We are happy to consider flexible working approaches to help you perform at your best. At Nationwide we offer hybrid working wherever possible. More rewarding relationships are supported through our hybrid approach, bringing colleagues together across our UK wide estate, whilst also supporting generous access to home working. We value our time in the office to solve problems, to learn, and to feel connected. For this job you'll be located at our nearest regional office or hub. There will be a need to regularly connect with colleagues for collaboration and in some locations you’ll be expected to spend at least two days a week, or if part time you'll spend 40% of your working time, in the office. If your application is successful, your hiring manager will provide further details on how this works. Nationwide is committed to the redeployment of our employees impacted by change, as such applications for redeployment candidates will be prioritised in this recruitment process. If you’re a colleague on long-term absence (for example, on parental leave) or a temporary worker, please use your personal email address to submit an application. RESPONSIBILITIES What you’ll be doing A typical day in this role involves looking at security data, identifying where malicious activity could be detected, and building or tuning rules so the right alerts are raised. You will spend time working in Microsoft Sentinel and Defender, writing KQL, reviewing detection logic and validating that detections work as expected. You will also support incident investigations by helping analysts understand what a detection is showing and whether monitoring coverage needs to improve. The role involves working closely with SOC, Incident Response, Threat Intelligence, Threat Hunting and Purple Team colleagues, while keeping documentation, triage guidance and engineering records clear and up to date. About you As a minimum requirement, you’ll have: • Practical cyber security experience in a SOC, Incident Response, Threat Hunting, Detection Engineering or Penetration Testing environment • Ability to write, test and peer-review KQL queries and detection logic in Microsoft Sentinel and/or Microsoft Defender • Experience analysing security telemetry to identify meaningful events, monitoring gaps and opportunities for new or improved detections • Experience onboarding, validating or troubleshooting security log sources and knowing when data quality is affecting detection capability • Working knowledge of Microsoft Defender technologies and common enterprise telemetry sources across endpoint, identity, cloud and network environments • Understanding of MITRE ATT&CK, common adversary behaviours and how attacker techniques can be translated into practical detection requirements • Ability to create clear documentation such as triage guides, knowledge articles, work instructions or detection records for operational use Our customer first behaviours put customers and members at the heart of how we work together. They are the set of behaviours that every colleague needs to display, in every role: • Feel what customers feel • We step into our customers’ shoes, using their feedback and insights to empathise with them and to understand their needs, so that every decision we make starts and finishes with our customers in mind • Say it straight • We are brave in speaking out and saying what we think – we’re honest and direct with good intent, openly sharing diverse perspectives to reach the best conclusions and using language everyone can understand • Push for better • We don’t settle for mediocrity, we challenge the status quo, taking responsibility for continuous improvement and personal development • Get it done • We prioritise what will have the greatest impact, we are decisive, and we take accountability for delivering brilliant customer outcomes You can strengthen your application by showing how our customer first behaviours resonate with you, and where you may have already demonstrated these. QUALIFICATIONS The extras you’ll get There are all sorts of employee benefits available at Nationwide, including: * 25 days holiday, pro rata • Private medical insurance • A highly competitive pension to help you build a strong foundation for retirement • Access to an annual performance-related bonus • Training and development to help you progress your career • A great selection of additional benefits through our salary sacrifice scheme • Life assurance to provide peace of mind for you and your loved ones in the event of your death • Wellhub – access to a range of free and paid options for health and wellness • Up to 2 days of paid volunteering a year Banking – but fairer, more rewarding, and for the good of society We forge our own path at Nationwide. As a mutual, we’re owned by our members - those customers who bank, save or have a mortgage with us. We challenge the financial sector status quo. We don’t see customers as the engine of our own profit. We share our profits with them and put their needs first. Always there when they need us. Supporting them and their lives. If you’re inspired by fairer finances, passionate about making a meaningful impact, and truly care about our customers, you’re one of us. At Nationwide, you are challenged to grow and rewarded for doing so. Valued. Recognised. Inspired to be your best. As a community, we want our working lives to count. As a team, we celebrate what we achieve. As a standard-setter, we work for the good of customers, communities, and broader society. We are purpose-driven. Uncompromisingly customer. Unstoppably Nationwide. What to do next If this role is for you, please click the ‘Apply Now’ button. You’ll need to attach your up-to-date CV and answer a few quick questions for us. We respond to everyone, so we will be in contact shortly after the closing date to let you know the outcome of your application. Keeping your data and personal information confidential is important to us. To find out more about how we use and process your data, please read our Privacy policy [https://nationwide-jobs.co.uk/privacy]. If you want to find out more about using AI in our recruitment process, please read more here [https://nationwide-jobs.co.uk/help-and-support]. Disability Confident We’re not just guided by data, we’re driven by the real experiences of our people. We’re a Disability Confident Level 3 Leader, the highest level. That’s why we’re constantly evolving our policies and practices to make sure everyone feels genuinely supported, valued, and empowered to champion inclusion. Whatever your needs, we’re here to support you. If you need any additional support throughout your application journey, email our team at Recruitment Support [Recruitment.Support@nationwide-jobs.co.uk]. Apply safely with Nationwide Recruitment scams can look convincing, so take a moment to check the role is listed on our official careers site and read our guidance on Don’t be conned by a job scam. [https://www.nationwide.co.uk/news-and-stories/job-scams/] The hiring manager for this role is Steven Noden, and the main recruitment contact is Anoop Gosai. Please note that should you be successful in securing this role, the job title on our internal systems will be Engineer – E2.

Threat Detection Engineer