Back to search

Cyber Incident Operations Manager

Civil Service

Job Description

Job summary

Discover a career in your hands at HMRC. Whether you're seeking purpose, growth, or a workplace that gives you a true sense of belonging, hear from some of our employees as they share their story about what its really like to work at HMRC.

Visit our YouTube channel (opens in a new window to watch the full series and come and discover your potential.

Cyber Security provides vital protection for digital assets that provide essential services to the public. This role is essential for the investigation and review of our systems and data to identify security weaknesses, provide recommendations to improve our security posture and to drive delivery of those improvements.

This outcome of the role is to methodically identify and reduce threats to the HMRC estate using the technical countermeasures we have available. Ensuring our cyber security controls are effective and fit for purpose with accurate configuration and security posture. As well as continuously identifying new technical controls to answer risks.

Job description

Youll work in our Incident Management Team, an exciting and fast paced group responsible for monitoring and responding to Cyber threats. You will lead a team of 6 specialists, providing support and guidance on technical issues whilst remaining cool under pressure.

You will have a strong technical background in cybersecurity, a proven track record of managing incident response teams, excellent vendor stakeholder management skills and possess exceptional leadership, communication, and problem-solving skills.

We would like to hear from applicants with the following cyber security operations skills:

  • Triaging and investigating security alerts from multiple systems.
  • Managing the response to cybersecurity incidents and related investigations, following the incident response lifecycle, to a timely and effective resolution.
  • Developing alerts and use cases against very large data sets over some of the latest technology.
  • Malware Analysis: ability to perform static and dynamic malware analysis to understand the nature of malware.
  • Establish and maintain incident response processes, procedures, and documentation, ensuring they align with industry best practices.
  • Serve as a subject matter expert on cyber security frameworks, including NIST, MITRE ATT&CK, and the Cyber Kill Chain.
  • Computer Forensic Analysis: a background using a variety of forensic analysis tools in incident response investigations to determine the extent and scope of compromise.
  • Person specification

    You will be curious and inquisitive by nature, a person who enjoys getting to the root cause of issues, especially around threats to our network.

    You are a team player who enjoys working collaboratively with colleagues across teams and business areas, including suppliers.

    You will have proven analytical skills, using data and information in various formats. You will have good report writing and presentation skills.

    Essential Criteria

    • Knowledge of threat landscape, their TTPs and IoCs.
  • A good understanding of operating systems including Windows and Unix and Network principles.
  • A good understanding of Cloud Architecture and components.
  • Experience of working in a SOC as part of an incident response function.
  • You will hold at least one of the qualifications or experience of one of the following listed in the Qualifications section.
  • Desirable Criteria

    • EDR and other Microsoft monitoring systems
  • Mitre/NIST Frameworks
  • Good Understanding of Threat Hunting TTPs
  • Transitional Sites Information

    If your location preference is for the following site, its important to note that this is not long-term site for HMRC and we will require you to move to a new building in the future, subject to our location strategy and the applicable employee policies at that time.

    For more information on where you might be working, review this information on our locations (opens in a new window)

    This site is:

    • Telford Plaza, Telford - moving to Parkside Court, Telford

    You will be given more information about what this means at the job offer stage.

    Leeds Locations

    Moves Adjustment Payment will be available for this role, provided the successful applicant is a current HMRC colleague in Bradford and meets the eligibility requirements outlined in the HMRCs Moves Adjustment Payment guidance.

    Yodel are hiring now

    Working at Yodel, they promise to support you, develop you and give you all the tools you need to do a great job. They have a range of opportunities across the UK now - why not see if Yodel have the perfect role for you?

    See Yodel jobs

    Good luck with your application