Lead Security Analyst

Senior Executive Officer

Your responsibilities as a Principal Security Analyst will be:

• Incident Response and Management – lead and participate in complex incident investigations, utilising advanced techniques to identify the root cause, scope, and impact of security incidents.

• Analyse and interpret security data from multiple sources, including logs, network traffic, and endpoint data, to identify emerging threats and attack patterns.

• Threat Hunting and Analysis – proactively hunt for advanced threats and vulnerabilities within the environment using various threat intelligence sources and security tools.

• Azure Sentinel Expertise: You will configure, manage, and fine-tune Microsoft Azure Sentinel. Additionally, you’ll design and implement custom log queries and alerts within Azure Sentinel to enhance threat detection and incident response capabilities.

• Collaboration and Communication – communicate effectively with external vendors, technical and non-technical stakeholders, translating complex technical concepts into understandable terms.

• Participate in the development and enhancement of SOC processes, workflows, and procedures to improve incident response efficiency and effectiveness.

Essential Criteria

• A track record of leading on Cyber incidents and working within a team to remediate threats to the department and an ability to support junior members of the team.

• Effective verbal and written communication skills, including the ability to lead on meetings with external vendors, technical and non-technical stakeholders, translating complex technical concepts into understandable terms.

• Experience using a Security Incident Event Management (SIEM) and security tooling in a Security Operations Centre (SOC) demonstrating improvements in processes, workflows, and incident response leading to greater efficiency and effectiveness.

• Experience working in an enterprise technology setting, with a focus on Cyber Security.

• Demonstrable experience using a query language to work with large sets of data, preferably Kusto Query Language.

Desirable Criteria

• Experience working with Cloud platforms (AWS, Azure).

• Relevant security-based certifications.

• Documentation of incident, investigation, findings adhering to incident response procedures.

It is unusual that all candidates will meet all the desirable criteria. If your skills and experience look slightly different from what we have identified and you think you can bring value to the role and the team, we strongly encourage you to apply. We'd love to hear from you!

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

As part of the application process you will be asked to complete a CV and personal statement.

Further details around what this will entail are listed on the application form.

Please use your personal statement (in no more than 500 words) to outline how your experience aligns with the essential and desirable criteria mentioned in the job advertisement, and what you can bring to the role.

Applications will be sifted on CV and Personal Statement.

In the event of a large number of applicants, applications will be sifted on the personal statement.

Candidates who pass the initial sift may be progressed to a full sift, or progressed straight to assessment/interview.

The interview will consist of behaviour and technical questions.

Interviewees will be asked to deliver a presentation; further details will be provided nearer the time.

Sift and interview dates

Expected Timeline subject to change

Sift dates: w/c 09/12/2024

Interview dates: w/c 16/12/2024

Interview Location: MS Teams.

Candidates are asked to note the above timetable, exercising flexibility through the recruitment and selection process.

Further Information

For further information on National Security Vetting please visit the following page https://www.gov.uk/government/publications/demystifying-vetting

Reasonable Adjustment

We are proud to be a disability confident leader and we welcome applications from disabled candidates and candidates with long-term conditions.

Information about the Disability Confident Scheme (DCS) and some examples of adjustments that we offer to disabled candidates and candidates with long-term health conditions during our recruitment process can be found in our DESNZ Candidate Guidance. A DESNZ Plain Text Version of the guidance is also available.

We encourage candidates to discuss their adjustment needs by emailing the job contact which can be found under the contact point for applicants section.

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.

If successful and transferring from another Government Department a criminal record check may be carried out.

New entrants are expected to join on the minimum of the pay band.

A location based reserve list of successful candidates will be kept for 12 months. Should another role become available within that period you may be offered this position.

Please note terms and conditions are attached. Please take time to read the document to determine how these may affect you.

Any move to the Department for Energy, Security and Net Zero from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility https://www.childcarechoices.gov.uk

DESNZ does not normally offer full home working (i.e. working at home); but we do offer a variety of flexible working options (including occasionally working from home).

DESNZ cannot offer Visa sponsorship to candidates through this campaign.

DESNZ holds a Visa sponsorship licence but this can only be used for certain roles and this campaign does not qualify.

In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service /Disclosure Scotland on your behalf.

However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.

For further information on the Disclosure Scotland confidential checking service telephone: the Disclosure Scotland Helpline on 0870 609 6006 and ask to speak to the operations manager in confidence, or email Info@disclosurescotland.co.uk

Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment.

A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.

Feedback

Feedback will only be provided if you attend an interview or assessment.

Successful candidates must undergo a criminal record check.

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).

People working with government assets must complete baseline personnel security standard (opens in new window) checks.

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).

The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Appointment to the Civil Service is governed by the Civil Service Commission’s Recruitment Principles. If you feel that your application has not been treated in accordance with the recruitment principles, and wish to make a complaint, then you should contact in the first instance DESNZrecruitment.grs@cabinetoffice.gov.uk. If you are not satisfied with the response that you receive, then you can contact the Civil Service Commission. For further information on bringing a complaint to the Civil Service Commission please visit their web pages: Click here to visit Civil Service Commission/Complaints