Cyber Security Monitoring and Investigations - Threat Detection Analyst

Working as a Threat Detection Analyst in the Cyber Security Monitoring and Investigations team, you will be part of an innovative and service-orientated team of analysts, focused on the detection and investigation of potential indicators of compromise or malicious activity on DWP systems and devices. Your main responsibilities will be to:

• Provide a second-tier escalation function for the resolution of security events that have been triaged by others, providing direction and guidance, and ensuring an effective response to alerts and risks as they are identified.
• Undertake comprehensive investigation of security alerts as well as proactive analysis of activity captured in system logs and security tools, to quickly determine if systems have been compromised.
• Support Intelligence Analysts and the Security Incident Response Team, by providing detailed technical input to on-going investigations, building on detailed log data, digital outputs, and threat intelligence in relation to the mitigation, detection and response to potential cyber-attacks.
• Effectively use the latest analytical SIEM tools including open-source intelligence to identify security compromises within large amounts of complex data.
• Use digital forensic and malware analysis tools (commercial and/or open source) to support analysis and decision making.
• Demonstrate strong knowledge of the latest security threats and indicators of compromise to ensure a robust response to new threats and attack vectors.
• Provide timely intervention to protect the DWP IT Estate through recommending and operating containment processes to isolate and prevent the spread of malware.

• Drive forward the development of monitoring systems and supporting processes and playbooks, ensuring systems are in place to review and continually improve existing capabilities.

• Ensure intelligence is effectively used to maintain the integrity of alerts and to ensure alerts continue to remain relevant and focused on the latest threats.

• Develop influential relationships with key stakeholders across the Department to support improvement activity thereby mitigating the risks from malicious activity.

• Demonstrate strong knowledge and understanding of the concepts of information security, and of current and emerging IT security, data protection and information risk principles and technologies.

• Support the transformation of the Department’s response to digital delivery and the security threats this presents; including operating new analytical tools to generate innovative security alerts.

• Support remedial activity as a result of identified weaknesses within the estate.
• Manage multiple priorities and respond flexibly to competing demands.

The Cyber Security Monitoring & Investigations team operates 24 hours a day, 7 days a week and as a result, post holders may be required to work outside of usual office hours as investigations dictate. Travel to different sites with occasional overnight stays may also be required.

A strong candidate will be able to demonstrate the following ESSENTIAL CRITERIA:

• Experience of performing in-depth analysis of cyber security alerts to quickly determine if systems have been compromised.
• Skilled in using a variety of the latest SIEM/network analysis tools and of proactively interrogating large data sets of structured and unstructured data, to identify malicious activity or anomalous behaviour.
• Comprehensive knowledge of tactics or techniques an adversary could use to bypass or evade security controls, and an understanding of how to mitigate such activities so that they could be detected.
• Experience of providing technical input into security investigations and of analysing and extracting relevant information in relation to the detection and response to potential cyber-attacks.

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions
• Working Together
• Communicating and Influencing
• Changing and Improving

We'll assess you against these technical skills during the selection process:

• Intrusion detection and analysis
• Incident management, incident investigation and response

• Learning and development tailored to your role
• An environment with flexible working options
• A culture encouraging inclusion and diversity
• A Civil Service pension with an average employer contribution of 28.97%

At DWP we are committed to creating a great place to work for all our colleagues; an inclusive and respectful environment that reflects the diversity of the society we serve.

We want to maximise the potential of everyone who chooses to work for us, and we offer a range of flexible working patterns and support to make a fulfilling career at DWP accessible to you.
Diverse perspectives and experiences are critical to our success, and we welcome applications from all people from all backgrounds with the experience and skills needed to perform this role.

As one of the largest government departments, almost every individual in the UK is a direct customer of DWP at some point in their lives. DWP’s mission is to improve people’s quality of life, both now and in the future. We do that by focussing on delivering excellent services that make a difference to millions of people. We trust and empower our people to deliver these services to customers every day, including the most vulnerable in society.

We seek to be an exemplar of the modern Civil Service, and to build on our achievements for the benefit of those we serve. When we are at our best, we care, we deliver, we adapt, we work together and we value everyone, and we seek to ensure that these values guide the way we serve our country, our communities, and our fellow citizens.

DWP is looking to fill 2 roles in Finance directorate. These are key roles, and we are looking for people who will help us deliver Cyber Security Monitoring & Investigations.

We welcome applications from candidates who can demonstrate the essential criteria listed in the ‘Person Specification’ part of this form.

Hybrid working

This job role may be suitable for hybrid working, which is where an employee works part of the week in their DWP office and part of the week from home.

This is a voluntary, non-contractual arrangement and your office will be your contractual place of work. The number of days that anyone will be able to work at home will be determined primarily by business need, but personal circumstances and other relevant circumstances will also be taken into account.

If you are successful, any opportunities for hybrid working, including whether a hybrid working arrangement is suitable for you, will be discussed with you prior to you taking up your post.

Job contact :

Recruitment team