Cyber Threat and Vulnerability Analyst

Job summary

The Department for Business, Innovation, Science and Trade (BIST) helps businesses invest, innovate, export and grow across the UK. The Digital, Data and Technology (DDaT) directorate helps to deliver this by designing, building and running the services, platforms and technology that businesses and colleagues rely on every day.

Our teams work on a wide range of services and technologies, including:

• digital services that help businesses access government support, guidance and opportunities

• data and AI products that support decision making and enable innovation

• internal tools and services that help colleagues work more effectively

• secure technology and platforms that support critical government services

• cyber security services that protect systems, data and users

By joining DDaT, you'll work on services used by businesses, colleagues and citizens across the UK. You'll be part of multidisciplinary teams focused on improving services, solving complex problems and delivering better outcomes for users.

We are committed to creating an inclusive and supportive workplace. In recognition of this, we were named Best Public Sector Employer at the Women in Tech Employer Awards 2025!

Job description

You will be helping to protect BIST and the wider UK government from cyber threats in a fast paced and exciting role. Reporting and acting as the main support to the Senior Cyber Threat and Vulnerability Analyst and Principle Cyber Threat and Vulnerability Manager. The Threat and Vulnerability Analyst will work with other members of the SOC and technical teams to execute operational threat and vulnerability management activities and help shape the development of BIST’s TVM program and capabilities. A healthy curiosity will be essential, to actively go out and discover items of potential interest to the team.

Main responsibilities

Your day-to-day role will involve the need to:

Threat Intelligence and assessment

• Conduct structured threat hunting and analysis to identify potential threats to BIST, using relevant threat intelligence sources and available security data to detect emerging threats, vulnerabilities and patterns of concern.
• Analyse and communicate relevant threat intelligence, providing actionable information to SOC colleagues and wider technical teams to support investigation, protective action and vulnerability prioritisation.

Penetration Testing

• Coordinate penetration testing, vulnerability assessments and security assurance activities across BIST systems, products and technologies, acting as a key cyber point of contact for service teams and testing providers throughout testing engagements.
• Review and assess penetration testing findings, supporting service teams in understanding vulnerabilities and associated risk, and track findings through the agreed remediation and risk-management process.
• Support the verification and closure of findings by reviewing remediation evidence and coordinating appropriate retesting or validation activity.

Vulnerability management

• Identify, analyse and assess vulnerabilities and security misconfigurations across BIST's platforms, applications and multi-cloud environments, applying BIST's risk-based approach to support effective prioritisation.
• Provide practical technical advice to service teams on vulnerability remediation and secure configuration improvements, escalating complex or significant issues where appropriate.
• Work collaboratively with service teams and other cyber colleagues to monitor vulnerabilities through the remediation lifecycle and provide clear visibility of outstanding security risk.
• Use vulnerability management and application security testing tools and data to investigate findings, identify trends and support the reduction of risk across BIST's technology estate.

Cyber Operations

• Contribute to the effectiveness of the operational TVM service through continuous improvement of processes, tooling and ways of working.
• Use operational metrics and insights to monitor remediation activities, contribute to continuous improvement initiatives and provide updates to stakeholders on progress, while maintaining knowledge of emerging vulnerabilities, BIST's Information Security Framework and industry best practice.

Person specification

It is essential that you have the following demonstrable skills:

• Experience working in an enterprise technology setting, preferably with experience working with or in Cyber Security (Lead Criteria)
• Understanding of Cyber threat landscape and threat actors’ techniques, tactics, and procedures
• Understanding of Vulnerability management principles
• Understanding of Threat hunting in a cloud-based environment including interpreting device and application logs from various sources in a cloud environment, and monitoring for emerging threat patterns and vulnerabilities
• Familiarity with industry frameworks and standards such as NCSC pen test guidance, OWASP, CVSS, NIST, ISO 27001 etc
• Excellent written and verbal communication skills, including the ability to relate technical information to a non-technical audience

It is desirable that you have:

• Experience working with cloud environments such as AWS and/or Azure
• A relevant cyber security qualification or equivalent professional experience, for example SANS, CompTIA, EC-Council or a relevant degree

Behaviours

We'll assess you against these behaviours during the selection process:

• Working Together
• Delivering at Pace

Technical skills

We'll assess you against these technical skills during the selection process:

• Penetration Testing
• Threat Understanding
• Threat Intelligence and Threat Assessment
• Cyber Security Operations

Benefits

If you join us, you will get:

• Learning and development tailored to your role
• A flexible, hybrid working environment with options like condensed hours
• A culture encouraging inclusion and diversity
• A Civil Service pension with an average employer contribution of 28.97%
• Annual leave starting at 25 days rising to 30 days with service
• Three paid volunteering days a year
• An employee benefits programme including cycle to work

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

How to apply

As part of the application process you will be asked to upload a two-page CV and complete a 750-word personal statement outlining how you meet the essential skills and experience listed above. You can use bullet points and subheadings if you prefer.

Sift will be from week commencing 26th October 2026

Interviews will be from week commencing 2nd November 2026

Please note these dates are indicative and may be subject to change.

If there is a high volume of applications, we will sift looking at the lead criteria 'Experience working in an enterprise technology setting, preferably with experience working with or in Cyber Security'only. You may then be progressed to full sift or straight to interview.

How we interview

At the interview stage for this role, you will be asked to demonstrate relevant Technical Skills and Behaviours from the Success Profiles framework. These are role specific and in line with the Government Cyber Profession roles and skills , Government Cyber Profession.

You will also be asked to deliver a presentation and will be informed on the topic following the sift.

How we offer

Offers will be made in merit order based on location preferences. If you pass the bar at interview but are not the highest scoring you will be held on a 12-month reserve list in case a role becomes available. If you are judged a near miss at interview, you may be offered a post at the grade below the one you applied for.

This role requires SC clearance. BIST's requirement for SC clearance is to have been present in the UK for at least 3 of the last 5 years. Failure to meet this requirement will result in your application being rejected and your offer will be withdrawn.

Checks will also be made against:

• departmental or company records (personnel files, staff reports, sick leave reports and security records)
• UK criminal records covering both spent and unspent criminal records
• your credit and financial history with a credit reference agency
• security services record
• location details

More about us

This role can only be worked from within the UK, not overseas. If you are based in London, you will receive London weighting. BIST employees work in a hybrid pattern, spending 2-3 days a week (pro rata) in the office on average. Travel to your primary office location will not be paid for by BIST, but costs for travel to an office which is not your main location will be covered.

You can find out more about our office locations, how we calculate salaries, our diversity statement and reasonable adjustments, the Recruitment Principles, the Civil Service code and our complaints procedure in the candidate pack attached to this advert.

Find out more about life at BIST, our benefits and meet the team by watching our video or reading our blog!

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a basic (or equivalent) criminal record check.Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see theCivil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.The Civil Service welcomes applications from people who have recently left prison or have an unspent conviction. Read more about prison leaver recruitment (opens in new window).Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job contact :

• Name : DDaT Recruitment
• Email : Ddat.recruitment@businessandtrade.gov.uk

Recruitment team

• Email : Ddat.recruitment@businessandtrade.gov.uk

Further information

Our recruitment process is underpinned by the principle of appointment on the basis of fair and open competition and appointment on merit, as outlined in the Civil Service Commissioners’ Recruitment Principles. If you feel your application has not been treated in accordance with these principles and you wish to make a complaint, you should in the first instance contact DBT by email at Resourcing@trade.gov.uk. If you are not satisfied with the response you receive, you can contact the Civil Service Commission, which regulates all Civil Service recruitment. For further information on bringing a complaint to the Civil Service Commission please visit their web pages: Civil Service Commission Complaints

Attachments

DDaT Candidate Pack (BIST) Opens in new window (pdf, 569kB)