Corporal Rhys, Cyber Operator, Cyber & Specialist Operations Command
Our people are the lifeblood of CSOC – a dedicated force of 26,000 specialists stationed at over 130 sites worldwide. From cyber warriors and medics to intelligence analysts, special forces, educators, and Defence attachés, our specialists are ready to fight across all domains to protect the UK.
Find out how our specialist operators are across every UK operation, delivering the capabilities you don’t usually see—or those you can’t.
In the digital age, our strongest defence isn't technology. Here's how we're turning diverse talents into cyber specialists. Due to the sensitive nature of their work, we cannot share their picture or their full names.
Inside CSOC’s secure facility at Corsham, cyber specialists monitor data streams that protect Britain's defence networks. Working round the clock, these cyber defenders stop threats that could compromise national security – all without a shot being fired.
Meet Corporal Rhys, a former sports coach turned cyber warrior. Over the past thirteen years, he has developed his skills to become a guardian of critical systems, protecting Defence from sophisticated cyber-attacks. Rhys’ journey shows how the Armed Forces nurtures cyber expertise through targeted training and support.
From coaching to coding
Rhys didn't plan to become a cyber specialist; he sought a technical trade that would enhance his career prospects. With family connections to both IT and the armed forces, he recognised that technology skills would remain in demand throughout his career.
Beginning as an ICT Technician (now designated as a cyber space engineer), Rhys completed initial training at RAF Cosford before developing applications at RAF Leeming. His transition into cyber security began in earnest with his 2018 posting to CSOC's Security Operations Centre.
"It was a steep learning curve," Rhys recalls. "But I had a lot of training and hands-on experience. I worked as an analyst for two and a half years on shift. Cyber is an expanding field—I took the opportunity and ran with it."
His sports coaching background proved unexpectedly valuable: "It gave me transferable skills – working with peers, developing Junior Cyber Operators, coaching and mentoring, delivering speeches. These all transfer into cyber operations."
Defending Britain's networks
Each day, Rhys puts his training into practice as a "human firewall" – the first line of defence against cyber threats. His role involves monitoring and managing the sensor networks protecting Defence's primary systems. His responsibilities include writing and updating detection rules that identify malicious activity whilst maintaining operational effectiveness. When the Cyber Threat team receives intelligence from international partners including the US and NATO, Rhys and his colleagues implement rapid protective measures.
“We analyse the threat data, identify vulnerabilities, and deploy countermeasures to neutralise risks before they can cause harm," he explains. This proactive approach ensures Defence networks remain resilient against constantly evolving cyber threats.
Recent operational success demonstrates the practical impact of this approach. When a critical platform faced deployment delays due to security sensors blocking essential upgrades. "I had a small window to fix it," he shared, "I wrote a new rule that kept everything protected but allowed the upgrade." His quick thinking and technical skill not only ensured the platform's deployment but also saved significant costs.
Supply chain security represents another focus area, with Rhys studying threat patterns to anticipate and mitigate risks. "We've seen what happened in Ukraine - cyber breaches came before the war," he explains. "You can't win a conventional war without winning the information war."
Keeping talent in Defence
Four years ago, Defence restructured career pathways for cyber specialists, mapping skills across roles to ensure appropriate expertise reaches critical positions throughout all three services. "Anyone in Defence with two years in a cyber post can apply," Rhys explains. This initiative has attracted over 150 personnel, creating a specialist community with clear progression opportunities available to anyone with two years' cyber experience.
Training partnerships with organisations such as SANS (System Administration and Network Security) connect Defence personnel with leading industry professionals. Their curriculum covers vulnerability identification, intrusion detection, and incident response, whilst collaboration with companies including CISCO, Splunk, Elastic, and Palo Alto maintains alignment with industry standards.
"Cyber is a hugely broad subject," he says. "Specialism is key." Rather than creating generalists, the MOD develops experts in specific disciplines including network defence, threat intelligence and incident response. This focused approach matches industry best practice while meeting Defence's needs.
Skills beyond the screen
Recognising that cyber defence requires diverse capabilities, Rhys established a tabletop games club at Corsham. The initiative has brought together 20 people across military ranks, civil servants, and contractors for activities ranging from traditional board games to role-playing games and strategic wargaming.
"It's got tactical and risk-reward elements. Strategy and critical thinking. Skills that transfer and encourage lateral thinking." The club has raised over £12,000 for charity, including £2,500 for Scotty's Little Soldiers, showing how community activities support both skills development and good causes.
The future of cyber defence
In cyber warfare, different perspectives and experiences create strategic advantage. Rhys’ path from sports field to cyber frontline demonstrates how diverse backgrounds strengthen CSOC and Defence. His experience demonstrates that effective cyber defence benefits from varied perspectives combined with structured career development and quality training programmes.
As digital threats increase in sophistication and frequency, specialists like Rhys form Britain's primary defence against cyber warfare.
seen at 18:41, 4 September in Cyber & Specialist Operations Command.Email this to a friend.