Incident Response Lead

The Cyber Defence team delivers cyber threat intelligence, threat detection, incident response and vulnerability management capabilities for the Cabinet Office, and is responsible for defending both internal IT infrastructure and citizen-facing services. As a senior security analyst, youll take a leading role in building and delivering these core capabilities, focusing on incident response.

Important

This role requires SC (Security Check) which will be conducted by NSV (National Security vetting). You need to have been resident in the UK within the past five years in order to apply.

Here is a short video why this is required.

As a senior security analyst with responsibility for incident response, you will:

• Lead the investigation of security alerts to understand the nature and extent of possible cyber incidents
• Lead the forensic analysis of systems, files, network traffic and cloud environments
• Lead the technical response to cyber incidents by identifying and implementing (or coordinating the implementation of) containment, eradication and recovery actions
• Support the wider coordination of cyber incidents
• Review previous incidents to identify lessons and actions
• Identify and deliver opportunities for continual improvement of the incident response capability
• Work closely alongside other Cyber Defence functions, supporting the continual improvement of wider capabilities
• Develop and update internal plans, playbooks and knowledge base articles
• Act as an escalation point for, and provide coaching and mentoring to, security analysts
• Be responsible for leadership and line management of security analysts

• Significant experience investigating and responding to cyber incidents
• Significant experience using security tools (e.g., EDR, SIEM) to support the investigation and response to cyber incidents
• Experience managing and coordinating the response to cyber incidents
• Experience coaching and mentoring junior staff
• An in-depth understanding of the tools, techniques and procedures used by threat actors
• Excellent analytical and problem solving skills
• Excellent verbal and written communication skills
• Experience with Splunk
• Experience working in an Agile environment
• Experience with cloud environments such as AWS

Desirable Skills

• Information risk assessment
• Risk management

Additional information:

Cabinet Office policy is that a minimum 60% of your working time should be spent at your principal workplace. For some roles, due to their nature and the business need, this may be up to 100%. Requirements to attend other locations for official business will also count towards this level of attendance.