Senior Response Manager - Senior SOAR & Detection-as-Code (DaC) Analyst - Home Office Cyber Security Operations Centre

Home Office Digital designs, builds and develops services for the rest of the department and for government. Every year our systems support up to 3 million visa applications, checks on 100 million border crossings, up to 8 million passport applications and deliver 140 million police checks on people, vehicles and property.

As a Senior Response Manager within the Home Office Cyber Security Operations Centre (CSOC) you will be expected to plan, implement and operate capabilities to detect, contain and remediate incidents, identify opportunities to improve detection, response and automation capabilities. You will also support organisational readiness through co-ordinating preparedness exercises and red team activity. The Response function also advises product and service owners on potential mitigations and supports the continuous improvement of security operations through monitoring, detection and standardisation of security practices.

You’ll be joining an expert team of cyber professionals, committed to reducing the exposure to cyber-attack of new and existing digital systems. You’ll be aided in your role by a diverse and supportive organisational culture, and a commitment to further your continuous development.

Where business needs allow, some roles may be suitable for a combination of office and home-based working. Where this is the case, employees will be expected to spend a minimum of 60% of their working time in the office. Applicants can raise any queries to the email address at the bottom of the advert.

Watch this short video to hear from members of Home Office Digital talking about the projects they work on and their experience of working here: Working for Home Office Digital.

We are seeking a Senior Response Manager to join the Cyber Security Operations Centre (CSOC) as a Senior SOAR & Detection-as-Code (DaC) Analyst. This role focuses on improving cyber detection, response and automation capabilities through security automation, response playbooks and Detection-as-Code practices. You will design, develop, test, maintain and improve security automation workflows, response playbooks and integrations using SOAR platforms or comparable automation technologies, while applying structured and repeatable DaC methodologies.

You will work with SOC teams and other business areas to improve incident handling, implement complex solutions for emerging threats, contribute to relevant standards and process improvements, and reduce operational effort and future risk.

As a Senior Response Manager your main responsibilities will be to;

• Carry out security monitoring, detection and response activities in line with agreed standards, providing advice on mitigation, escalation and risk reduction.
• Identify, analyse and investigate indicators of malicious activity across networks, systems and applications, supporting effective threat detection and incident response.
• Triage security events and alerts, supporting investigations and recommending improvements to monitoring controls, detection coverage and overall security posture.
• Support incident response activities, including red teaming and threat hunting exercises, communicating investigation outcomes and contributing to lessons learned and post-incident reviews.
• Develop, review and continuously improve monitoring use cases, detection content and alert effectiveness across a range of security technologies.
• Define and enhance processes, tooling and security controls to identify emerging threats, strengthen detection capabilities and implement effective mitigation strategies.
• Drive service and process improvements by applying industry best practice, sound judgement and problem-solving skills to support efficient security operations and investigations.

Working Pattern

This role is available on a full-time basis with the option of compressed hours working. This role is also suitable for part-time working hours, with a minimum requirement to work 4 days/ 30 hours per week due to business requirements.

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

This vacancy is using Success Profiles (opens in a new window), and will assess your Experience and Technical skills.

As part of the application process, you will be asked to complete a CV and 1000-word personal statement:

• CV – include a brief employment history outlining for each role, the organisation, job title, dates in post, and key responsibilities and achievements. Any recent employment gaps should be explained. A second section should set out the skills and experience most relevant to this role, drawing on your career, training, and other relevant activities without repeating the employment history. Focus on the evidence that best demonstrates your capability to meet the role requirements.
• Personal statement - this should present a clear and coherent narrative explaining why you are applying, what you would bring to the role, and how your experience meets the essential criteria. Use well‑chosen examples to illustrate your impact, drawing on STAR‑style thinking where helpful, but ensure the statement reads as a single, flowing document rather than a set of isolated responses.

To ensure you are assessed on merit alone, we ask you to anonymise your application. This means removing personal identifiers such as your name, age, and place of education. You do not need to remove your employment history, job titles, or any information about your work.

Watch our three short videos on how to apply for our roles: Applying - Home Office Careers.

Problems during the application process

If you experience problems accessing this advert, or you think you’ve made a mistake on an initial application, please contact hocandidates.grs@cabinetoffice.gov.uk, including the vacancy reference, at least two working days before the vacancy closes. Further information can be found on our website.

Do not create or attempt to submit another application, online test or use a different Civil Service Jobs account to proceed as this would be in violation of the candidate declaration.

Sift Stage

The sift will be held on the CV and Personal Statement. Please read the essential skills for this position carefully. We will only consider those who meet the listed requirements.

In the event of a high number of applications received, the sift will be held on the Personal Statement only.

Interview Stage

Candidates invited to interview will take part in a two-stage assessment process, which will assess your Technical Skills (SFIA Framework).

Prior to the first interview, candidates will be provided with a technical scenario and asked to submit a written response for review by the interview panel. The panel will assess submissions in advance, and candidates should be prepared to discuss their approach, decision-making, rationale, and proposed solutions in more detail during the interview. Questions relating to the technical scenario will form part of the first-stage assessment.

Full details of the scenario, submission requirements, and timescales will be provided as part of the interview invitation.

Candidates who are successful at the first-stage assessment will be invited to attend a second interview, where they will be assessed against the remaining requirements of the role.

If you are invited to an interview, you will be required to bring a range of documentation for the purposes of establishing identity and to aid any pre-employment checks. Please see the attached list of Home Office acceptable ID documents.

Sift and Interview dates

The sift will commence from 3 November 2026.

Interviews are expected to take place from 16 November 2026. (Subject to the Panel’s operational requirements/priorities).

Interviews will be conducted remotely via MS Teams.

We will try to meet the dates set out in the advert. There may be occasions when these dates will change. You will be provided with sufficient notice of the confirmed dates.

Further information

In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service on your behalf. However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct.

If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.

Reserve List

A reserve list of successful candidates will be kept for 12 months. Should another role become available within that period you may be offered this position.

Reserve lists may be held for each location. Candidates will be appointed in merit order by location where this applies.

Similar Roles

Job offers to this post are made based on merit. We often have similar roles available at different grades. If a candidate is suitable for a similar role or a lower grade than they have applied for, we may offer the candidate that role without the need to go through a further selection process providing the role has the same competencies and essential skills.

UK residency and security requirements

For meaningful security checks to be carried out, individuals need to have lived in the UK for a sufficient period of time. Learn more on our website. Security Checks - Home Office Careers.

Please note that this role requires Security Check (SC) clearance. To be eligible, candidates must have lived in the UK continuously for the last 5 years. Failure to meet this residency requirement will result in your security clearance application being rejected.

Candidates must also hold or be prepared to undergo Non-Police Personnel Vetting Level 3 (NPPV3).

For further information on National Security Vetting please visit the following page Demystifying Vetting - GOV.UK.

Visa Sponsorship

We are unable to sponsor any individuals via Skilled Worker Sponsorship / Tier 2 (General) work visas as we do not hold a UK Visa & Immigration (UKVI) Skilled Worker License.

Capability allowance

The advertised role is part of the Home Office Government Digital and Data Profession. This role has access to a digital capability-based allowance. Applicants who are successful at interview will be invited to complete a Capability and Skills Assessment post-interview. Any allowance awarded will be based on the assessment of your capability against the six skills advertised for this role.​ Please see the Home Office Pay Framework Allowance Careers page for more information. ​

The allowance values are set by the Home Office, subject to remaining in a qualifying role. This allowance is non-contractual, subject to an annual review and could be withdrawn at any time.​

For both new entrants and existing civil servants, the total compensation offer is a combination of base salary and, if applicable, a capability-based allowance. The pay ranges for this role are National: £49,850 - £52,850. New entrants to the Civil Service will start on the pay range minimum. For existing civil servants, our policies on level transfer and promotion will apply.

Reasonable Adjustments

If a person with disabilities is at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.

If you need a change to be made so that you can make your application, you should:

• Contact Government Recruitment Service via HOrecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs
• Complete the “Assistance Required” section in the “Additional Requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you're deaf, a language service professional

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the ‘Contact point for applicants’ section.

Feedback

Feedback will only be provided if you attend an interview or assessment.