Incident Response Lead
Summary
Senior security analyst leading incident response for the Cabinet Office Cyber Defence team: investigating security alerts, running forensic analysis of systems, network and cloud, coordinating containment/recovery, and mentoring and line-managing analysts. Core tooling includes EDR, SIEM (Splunk) and AWS, with SC clearance required.
- Job grade: Grade 7
- Contract type: Permanent
- Business area: CO - Digital
- Type of role: Information Technology
- Working pattern: Full-time
- Number of jobs available: 1
Location
Existing CO staff can work in their original contractual work location.
Existing Civil Servants working in all other departments can work in London, Manchester or Glasgow only.
About the job
Job summary
The Cyber Defence team delivers cyber threat intelligence, threat detection, incident response and vulnerability management capabilities for the Cabinet Office, and is responsible for defending both internal IT infrastructure and citizen-facing services. As a senior security analyst, you’ll take a leading role in building and delivering these core capabilities, focusing on incident response.
Important
This role requires SC (Security Check) which will be conducted by NSV (National Security vetting). You need to have been resident in the UK within the past five years in order to apply.
Here is a short video why this is required.
Job description
As a senior security analyst with responsibility for incident response, you will:
- Lead the investigation of security alerts to understand the nature and extent of possible cyber incidents
- Lead the forensic analysis of systems, files, network traffic and cloud environments
- Lead the technical response to cyber incidents by identifying and implementing (or coordinating the implementation of) containment, eradication and recovery actions
- Support the wider coordination of cyber incidents
- Review previous incidents to identify lessons and actions
- Identify and deliver opportunities for continual improvement of the incident response capability
- Work closely alongside other Cyber Defence functions, supporting the continual improvement of wider capabilities
- Develop and update internal plans, playbooks and knowledge base articles
- Act as an escalation point for, and provide coaching and mentoring to, security analysts
- Be responsible for leadership and line management of security analysts
Person specification
- Significant experience investigating and responding to cyber incidents
- Significant experience using security tools (e.g., EDR, SIEM) to support the investigation and response to cyber incidents
- Experience managing and coordinating the response to cyber incidents
- Experience coaching and mentoring junior staff
- An in-depth understanding of the tools, techniques and procedures used by threat actors
- Excellent analytical and problem solving skills
- Excellent verbal and written communication skills
- Experience with Splunk
- Experience working in an Agile environment
- Experience with cloud environments such as AWS
Desirable Skills
- Information risk assessment
- Risk management
Additional information:
Cabinet Office policy is that a minimum 60% of your working time should be spent at your principal workplace. For some roles, due to their nature and the business need, this may be up to 100%. Requirements to attend other locations for official business will also count towards this level of attendance.
Behaviours
We'll assess you against these behaviours during the selection process:
- Delivering at Pace
- Changing and Improving
- Making Effective Decisions
Technical skills
We'll assess you against these technical skills during the selection process:
- Incident management, investigation, and response
- Intrusion detection and analysis
- Information risk assessment and risk management
Benefits
- Learning and development tailored to your role.
- An environment with flexible working options.
- A culture encouraging inclusion and diversity.
- A Civil Service Pension which provides an attractive pension, benefits for dependants and employer contributions of 28.97%.
- A minimum of 25 days of paid annual leave, increasing by one day per year up to a maximum of 30.
Things you need to know
Artificial intelligence
Selection process details
Application process
As part of the application process, you will be asked to provide:
- A CV
- Provide answers to Civil Service behavioural questions (listed on this vacancy advertisement)
- Provide answers to technical skills (listed on this vacancy advertisement)
- Statement of suitability (Max: 750 words)
Further details around what this will entail are listed on the application form.
Please use your Statement of Suitability to explain how you consider your experience, professional skills, and leadership qualities provide evidence of your suitability for the G7 Incident Response Lead role. Please ensure your response provides clear, evidence-based examples that directly reference the essential criteria outlined in the person specification section of the job advert.
Should a large number of applications be received, an initial sift may be undertaken using the lead Behaviour, Delivering at Pace.
Candidates who pass the initial sift may be progressed to a full sift, or progressed straight to assessment/interview.
Selection process
As part of the selection process, you will be assessed on the following at interview;
- Civil Service behavioural questions (listed on this vacancy advertisement)
- Strengths
Expected timeline (subject to change)
Expected sift date – 30/11/2026
Expected interview date/s – 14/12/2026
Your interview will either be conducted face to face or by video. You will be notified of the location if you are selected for interview.
Further Information
A reserve list may be held for a period of 12 months from which further appointments can be made.
Any move to Cabinet Office from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax Free Childcare; for further information visit the Childcare Choices website.
If successful and transferring from another Government Department a criminal record check may be carried out.
In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service/Disclosure Scotland on your behalf.
However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.
For further information on the Disclosure Scotland confidential checking service telephone: the Disclosure Scotland Helpline on 0870 609 6006 and ask to speak to the operations manager in confidence, or email Info@disclosurescotland.co.uk
Please note that this role requires SC clearance, which would normally need 5 years’ UK residency in the past 5 years. This is not an absolute requirement, but supplementary checks may be needed where individuals have not lived in the UK for that period. This may mean your security clearance (and therefore your appointment) will take longer or, in some cases, not be possible.
For further information on National Security Vetting please visit the Demystifying Vetting website.
New entrants are expected to join on the minimum of the pay band.
Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment.
A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5-year period following a dismissal for carrying out internal fraud against government.
This role is full time only. Applicants who wish to work an alternative pattern are welcome to apply however your preferred working pattern may not be available and you should discuss this with the vacancy holder before applying.
Please note terms and conditions are attached. Please take time to read the document to determine how these may affect you.
If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.
Reasonable Adjustment
If a person with disabilities is put at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.
If you need a change to be made so that you can make your application, you should:
Contact Government Recruitment Service via cabinetofficerecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.
Complete the ‘Assistance required’ section in the ‘Additional requirements’ page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.
Feedback
Feedback will only be provided if you attend an interview or assessment.
Security
See our vetting charter (opens in a new window).
Nationality requirements
This job is broadly open to the following groups:
- UK nationals
- nationals of the Republic of Ireland
- nationals of Commonwealth countries who have the right to work in the UK
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
- individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
- Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service
Working for the Civil Service
We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
Diversity and Inclusion
Apply and further information
Contact point for applicants
Job contact :
- Name : CO Digital Recruitment Team
- Email : codigitalrecruitment@cabinetoffice.gov.uk
Recruitment team
- Email : cabinetofficerecruitment.grs@cabinetoffice.gov.uk
Further information
If you are not satisfied with the response you receive, then you can contact the Civil Service Commission at info@csc.gov.uk. For further information on the Recruitment Principles and bringing a complaint to the Civil Service Commission, please visit their website at: https://civilservicecommission.independent.gov.uk/.
Attachments
| Cabinet Office Employee Offer (2) Opens in new window (pdf, 302kB) |
| Cabinet Office Terms and Conditions - External 2025-02-20 (2) Opens in new window (docx, 94kB) |
Share this page
- Gmail