Security Monitoring Technology & Infrastructure Capability Development Analyst
Department for Work and Pensions
- Department
- Department for Work and Pensions
- Location
- Blackpool
- Openings
- 3 posts
- Grade
- SEO
- Salary
- £45,225 to £47,362
- Closing
- 13 days left
- Profession
- Operational Delivery
- Contract
- Permanent
- Security clearance
- SC
- Working pattern
- Flexible working, Full-time, Job share, Part-time
Job summary
The DWP Cyber Resilience Centre (CRC) offers a uniquely challenging and fulfilling opportunity for people interested in making a genuine difference to society.
DWP is the UK’s biggest government department; few other organisations globally provide the same opportunity to apply next-generation digital technology on a massive scale to issues with touch the lives of so many. We support twenty million people every day to help them find work and save for their future. We provide financial assistance worth over £180 billion each year to ensure that the most vulnerable in society are protected. With 800 locations and around 100,000 colleagues, we’re bigger than most retail operations.
An exciting opportunity has arisen to join the CRC’s Capability Development Group – Operations and Tooling team, developing technical security operations capabilities. You will provide a vital role in securing the DWP IT and information estate ensuring that the CRC’s operational teams have the capability to Protect, Detect and Respond to anomalous, malicious, or fraudulent activity from internal and external threat actors.
This is an ideal role for candidates with a proven track record operating within a security monitoring environment who may wish to step away from operational routine and drive forward the development of the CRC’s security monitoring operations specialist toolset.
What they’re looking for
- This is a technical, hands-on role including the following responsibilities:
- Support CRC’s operational teams with the development and delivery of detection and respond capabilities across all DWP infrastructure environments.
- Collaborating with CRC’s Capability Development Group, operational teams and broader digital stakeholders, construct high fidelity monitoring, warning, and alerting capabilities; focussing on people, processes, technology, and data.
- Support the strategic development of CRC, Security & Data Protection, Digital and the broader department through the analysis of security data and the production of appropriate security insights.
- Collaborate with and coach Monitoring Operations Analysts in developing new skills to adopt and operate the latest security analytical tools, proficiently.
- Using recognised industry standards such as NIST and MITRE, continuously review and help improve existing capabilities to protect the integrity of our systems from both internal and external threat actors.
- You will apply your knowledge of the latest adversary tactics, techniques and procedures, indicators of compromise and detection capabilities to develop innovative response methods to new threats and attack vectors, helping operational monitoring teams keep pace with the ever-changing threat landscape
- You will be required to have a thorough understanding of relevant data sources available to operational monitoring teams and help drive visibility through the custodianship of relevant Data Dictionaries/Catalogues.
- Build upon your existing technical and monitoring operations skillset. Maintain a full understanding of Security Information & Event Management (SIEM) tools and associated data quality and logging principles, Orchestration & Automation tools and capabilities, Intrusion Detection Systems (IDS)/Intrusion Prevention Systems (IPS) and Endpoint Detection & Response (EDR) solutions.
- Identify and suggest training and learning pathways to ensure a consistent skill level across CRC’s operational teams.
- You will possess excellent communication skills. You will be confident in delivering presentations, drafting comprehensive reports and be able to explain technical content in simple terms.
- Present and explain complex technical information appropriately to non-technical and technical audiences and important stakeholders.
- Essential Criteria
- The following Essential Criteria will be used at sift; a strong candidate will be able to demonstrate the Essential Criteria listed below:
- Proven experience of working in a security monitoring operations team, or security monitoring operations capability development team (DevOps / SecDevOps), with the ability to manage multiple priorities and respond flexibly to competing demands organising work accordingly
- Proven experience using the latest Security Information & Event Management (SIEM) and other security monitoring tools to develop monitoring dashboards, detections, and alerts.
- Experience of explaining security events and technical concepts and implications to non-technical audiences and to important stakeholders.
- Proven ability to foster and develop influential relationships possessing excellent inter-personal skills to develop substantial credibility with key stakeholders across the Department and across HMG.
- Desirable Criteria
- Experience and understanding of a broad range of security monitoring and data analysis tools, associated operational techniques and procedures.
- Experience in coaching and developing staff to grow capability and ensure team members are equipped with the skills and knowledge to effectively undertake their job roles.
- Qualifications and Certifications
- It would be advantageous for candidates to have or be willing to work towards: (any of the following will be acceptable)
- Continuous processional security certifications showing intermediate to advance security knowledge (minimum of SANS 401, 501 or CompTIA Security +), or relevant experience that demonstrates networking understanding and key security principles.
- Certificates or evidential equivalent experience of Security Information & Event Management (SIEM) tools covering; Data Management, Searching & Reporting, Dashboard Development.
- Certificates or evidential equivalent experience of Security Orchestration, Automation, and Response (SOAR) solutions, Intrusion Detection Systems (IDS)/Intrusion Prevention Systems (IPS) solutions and Endpoint Detection & Response (EDR) solutions.
Behaviours you’ll be assessed on
This advert says the panel will score you against these behaviours at SEO level. Each one links to worked examples.
Job description
- Working as part of CRC’s CDG Operations and Tooling team, you will be part of a small team with the responsibility for driving forwards the development of Security Monitoring Operations capabilities, solutions and technical tools delivering an operational advantage to operational teams.
- You will ensure CRC are able to maximise the benefits of security monitoring capabilities through close collaboration with other teams and projects within and outside of CRC, and key external business partners.
- Working with your team leads, you will provide both technical and operational support, and guidance to the wider security teams; leading, managing and delivering all elements of development activities to ensure that capabilities are configured and operationalised effectively for day-to-day use within CRC.
Nationality requirements
This job is broadly open to the following groups:
- UK nationals
- nationals of the Republic of Ireland
- nationals of Commonwealth countries who have the right to work in the UK
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
- individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
- Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service
Further information on nationality requirements (opens in a new window)
Selection process
This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.
As part of the application process you will be asked to complete a CV and personal statement.
Candidates will be required to provide a CV covering work history, achievements in role and qualifications. Additionally, a Personal Statement is required, demonstrating how you meet the Essential/Desirable Criteria (listed in responsibilities section) for this role (maximum 750 words).
The sift panel will use the information relating to your employment history (your CV) and your personal statement of suitability to assess your experience, skills and knowledge.
When giving details of your employment history, you should include details of the work that you have been involved in, outcomes, and your role therein.
All applications will be assessed and sifted based on the personal specification in the advert, using the information you provide in your
completed application form.
Interview
Successful candidates will be invited to a face-to-face interview where candidates will be assessed on Behaviours, Technical Skills & Experience. We'll assess you against these Success Profiles at the interview stage:
Behaviours:
Working Together, Changing & Improving & Communicating and Influencing
Technical Skills:
Candidates will be asked to do a short (10-15 minutes) presentation on a specific topic. Further details will be provided to candidates invited to interview.
Sift and interview dates to be confirmed.
Individuals applying for security clearance should usually have been continuously resident in the UK for the following periods immediately before the clearance is launched:
Applicants are required to meet the UK residency requirements so that National Security Vetting (NSV) checks can be conducted. You must have resided continuously in the UK for Security Check (SC): at least 3 of the last 5 years, 2 of which must have been the immediately preceding years from the point of applying for this job.
For further information on National Security Vetting please visit the Demystifying Vetting website.
There may be a requirement for DV level clearance in the future with this role.
Further Information
At the Department for Work and Pensions (DWP) we value diversity and inclusion and actively encourage and welcome applications from everyone, including those that are underrepresented in our workforce.
Find out more about working for DWP on the DWP Careers Hub.
Reserve List
A reserve list may be held for a period of 6 months from which further appointments can be made.
If you are placed on a reserve list but we cannot immediately offer you a post, please note:
- If you are later offered the role you applied for, in a location you have expressed a preference for, and you decline the offer or are unable to take up the post within a reasonable timeframe you will be withdrawn from the campaign and removed from the reserve list, other than in exceptional circumstances (e.g. a contractual Part Time Working Pattern cannot be accommodated in the initial role offered or in cases of serious ill health).
- If DWP makes an offer of an alternative role or location to that which you originally applied for, and you decline that offer, you will be able to remain on the reserve list.
Disability Confident Scheme
If high application volumes are received, the benchmark for candidates to proceed to the next stage may be raised. In line with our commitment to the Disability Confident Scheme (DCS), we aim to advance all candidates applying under the DCS who meet the minimum standard. However, we may only progress those candidates who best meet the required standards.
Reasonable Adjustments
We consider visible and non-visible disabilities, neurodiversity or learning differences, chronic medical conditions, or mental ill health. Examples include dyslexia, epilepsy, autism, chronic fatigue, or schizophrenia.
If you need a change to be made so that you can make your application, you should contact the Government Recruitment Service via DWPRecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.
Complete the “Reasonable Adjustments” section in the “Additional requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.
If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.
Integrity, plagiarism and Civil Service Principles
The Civil Service values honesty and integrity and expects all candidates to abide by these principles.
Please ensure that all examples provided in your application are taken directly from your own experience and that you describe the examples in your own words.
Examples of plagiarism can include:
- Presenting the work, ideas and experience of others as your own
- Copying content or answers from an online or published source that is not your own
Disclosure and Barring Service and Internal Fraud Database Checks
To process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service or Disclosure Scotland on your behalf. However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.
For further information on the Disclosure Scotland confidential checking service telephone: the Disclosure Scotland Helpline on 0870 609 6006 and ask to speak to the operations manager in confidence, or email Info@disclosurescotland.co.uk
Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment. A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.
If successful and transferring from another Government Department, a criminal record check will be carried out.
Important
New entrants are expected to join on the minimum of the pay band.
Before applying for this vacancy, current employees of DWP should check whether a successful application would result in changes to their terms & conditions of employment, e.g. mobility, pay, allowances. If you are a current employee and are successful you must be able to be released from your current post within four weeks.
Those on protected TUPE/ COSoP terms and conditions applying on promotion or voluntary permanent level move will adopt DWP’s Terms and Conditions and this may have a different impact on pay and allowances. Please review this prior to acceptance of a role.
Civil Servants that would transfer into DWP from other government organisations, following successful application, will assume DWP's terms & conditions of employment current on the day they are posted, unless DWP has stated otherwise in writing. Accepting a post will be taken to mean acceptance of revised terms & conditions.
Civil Servants applying on promotion will usually be appointed to the salary minimum or within 10% of existing salary.
Any move to DWP from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may, however, be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at the Childcare Choices Website.
Feedback
Feedback will only be provided if you attend an interview or assessment.
Practise before you apply
Civil Service panels score every answer against the Success Profiles behaviours at SEO level. Practise STAR answers and get them marked against the same framework.
3 free questions · No card needed
Similar vacancies
- Commercial & Industry Facilities Management Project Delivery - Quantity Surveyor · Ministry of Defence · £46,040
- Senior Legal Officer (Ref: 24172) · HM Courts and Tribunals Service · £49,325+
- Navy Command - Security Capability Integrator · Ministry of Defence · £46,040
- Senior Investigator - Prisons and Probation Ombudsman (Ref: 24133) · Ministry of Justice · £49,325+
- Senior Programme Manager, Centre of Expertise · Westminster Foundation for Democracy · £47,600+