Internal Abuse Monitoring Analyst (Data Users)

Job summary

The role of the Internal Abuse Monitoring Analyst (Data Users) sits within the Internal Abuse Monitoring Team (IAM). The team plays a key role in identifying and escalating internal threats and security breaches involving analytical systems, triaging, and progressing potential cases of malicious activity ensuring that service delivery is not affected as a result of potential malicious activity from internal threat actors.
The Internal Abuse Monitoring Team plays a vital role in securing DWP systems and services including Universal Credit and other DWP Benefits and data systems, and ensuring the Department fulfils its responsibilities for the secure, appropriate and proportionate use of citizen data as dictated by legislation.

Job description

You will work as part of an innovative and service-orientated team of analysts, focused on the detection and investigation of inappropriate or malicious activity across a range of departmental data systems, providing comprehensive analysis of assurance alerts as well as proactive analysis of activity captured in system logs to quickly determine if behaviour/activity detected warrants closer investigation and whether data may have been accessed or used inappropriately.

The Internal Abuse Monitoring Analyst (Data Users) collaborates with stakeholders across the Cyber Resilience Centre and wider security community to ensure an effective response to alerts and risks as they are identified, responding to developing fraud threats and security breaches against the Departments IT systems, triaging and progressing potential cases of malicious activity, using analytical tools and root-cause analysis techniques to do so.

The Internal Abuse Monitoring Analyst (Data Users) reports to the Senior Internal Abuse Monitoring Analyst (Data Users). The Internal Abuse Monitoring Team operates within DWPs Cyber Resilience Centre (CRC) and forms part of the Personnel Security and Insider Threat Monitoring Group (PSITMG).

Responsibilities

As an Internal Abuse Monitoring Analyst (Data Users) you will:

• Protect Departmental systems by Identifying vulnerabilities in back-end data system environments, and safeguard citizens’ data from internal threats, highlighting potential malicious activity by users.
• Use a range of data and system access to triage and respond to alerts that identify anomalies indicating internal abuse across the DWP estate, by staff with access to systems, data, and in some cases highly skilled staff with access to analytical tools as well as large data and intelligence sets.
• Interrogate activity captured in system logs to determine if data has been compromised.
• Develop positive working relationships with a range of key security stakeholders to ensure the timely and appropriate escalation of any potential abuse.
• Work collaboratively with project teams and developers regarding monitoring requirements as new data system capabilities are developed and introduced.
• Demonstrate adaptability, creativity, and professionalism at all times, and feed into the continuous improvement of the Team’s work.
• Have an understanding of personal data protection, the Department’s responsibility to protect the citizen data it holds, and ensure data held by CRC is stored and used appropriately and legally.

Due to the geographically dispersed nature of this team, this role will require occasional travel and overnight stays.

Person specification

Essential Criteria:

1. (LEAD) Experience of monitoring user activity across diverse systems with the ability to identify anomalous behaviour patterns and potential evasion techniques to determine whether activity is legitimate or warrants further investigation.
2. Experience of utilising analytical tools, responding to alerts, performing searches, and interpreting dashboards.
3. Knowledge and understanding of data handling and control mechanisms that are needed to ensure compliance with legal requirements to keep citizen data safe.
4. Confidence in personal decision-making, capable of working independently and without direct supervision; using initiative and responding flexibly to competing demands and priorities.

Essential Security Criteria

Please note that the role that you are applying requires National Security Vetting (NSV) to the level –Security Check (SC). You can find more information at United Kingdom Security Vetting: Applicant - GOV.UK (www.gov.uk) . If you are successful in your application, you will need to attain SC clearance before you can take up post. This is mandatory and is in addition to completion of Baseline Personnel Security Standard (BPSS).

The purpose of the NSV process is to provide a level of assurance about an individual’s trustworthiness, integrity and reliability, and other factors that increase their vulnerability to corruption or risk of committing a security breach. It involves the investigation of an individual’s background and circumstances to achieve this aim.

For meaningful checks to be carried out, you will need to have lived in the UK for a sufficient period of time to enable appropriate checks to be carried out and produce a result which provides the required level of assurance. Applicants are required to meet the UK residency requirements so that National Security Vetting (NSV) checks can be conducted. Depending on the level of NSV required, you must have resided continuously in the UK for at least 3 of the last 5 years, 2 of which must have been the immediately preceding years from the point of applying for this job.

The application process will ask for personal details about you, your address history, previous relationships, your parents, your employment history, your financial circumstances, and details of any pending, spent or unspent convictions. This list is not exhaustive. Please view the Vetting explained - GOV.UK (www.gov.uk) for more information.

If you require any further information, please contact the vacancy holder – the details are on the jobs portal through which you made your application.

If you are successful in your application, we recommend that you familiarise yourself with the NSV process and advise that you collate as much information as you can prior to starting your Vetting application.

Behaviours

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions
• Communicating and Influencing
• Working Together

Technical skills

We'll assess you against these technical skills during the selection process:

• Secure Operations Management - awareness
• Intrusion Detection and Analysis – awareness
• Cyber Security Operations – awareness

Benefits

Alongside your salary of £38,772, Department for Work and Pensions contributes £11,232 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.

DWP have a broad benefits package built around your work-life balance which includes:

• Working patterns to support work/life balance such as job sharing, term-time working, flexi-time and compressed hours.
• Generous annual leave – at least 23 days on entry, increasing up to 30 days over time (pro–rata for part time employees), plus 9 days public and privilege leave.
• Support for financial wellbeing, including interest-free season ticket loans for travel, a cycle to work scheme and an employee discount scheme.
• Health and wellbeing support including our Employee Assistance Programme for specialist advice and counselling and the opportunity to join HASSRA a first-class programme of competitions, activities and benefits for its members (subscription payable monthly).
• Family friendly policies including enhanced maternity and shared parental leave pay after 1 year’s continuous service.
• Funded learning and development to support progress in your role and career. This includes industry recognised qualifications and accreditations, coaching, mentoring and talent development programmes.
• An inclusive and diverse environment with opportunities to join professional and interpersonal networks including Women’s Network, National Race Network, National Disability Network (THRIVE) and many more.

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

**Please note the closing date for your full application is 23:55 on 14th April 2026**

Stage 1 – Short Stage Application Form

Please complete the first stage short application form, which includes your personal details, eligibility to apply and any reasonable adjustments required.

Stage 2 – Written Application and Sift

As part of the application process you will be asked to complete a CV and a 1000 word Personal Statement. All applications will be assessed and sifted based on the essential criteria in the advert, using the information you provide in your completed application form. Further details around what this will entail are listed on the application form.

An initial sift will take place against the first (lead) criteria in the essential criteria list:

• Experience of monitoring user activity across diverse systems with the ability to identify anomalous behaviour patterns and potential evasion techniques to determine whether activity is legitimate or warrants further investigation.

Only those candidates who meet the standard for that criteria will proceed to the next stage, where the remaining criteria will be scored using the information you provide in your completed application form.

The sift panel will use the information relating to your employment history (your CV) and your personal statement of suitability to assess your experience, skills and knowledge. When giving details of your employment history, you should therefore include details of the work and projects that you have been involved in, and your role therein.

Applications must include:

• A completed Personal Details application form.
• A curriculum vitae with education, professional qualifications and full employment history, giving details of key achievements relevant to the skills and experience outlined in this job description.
• A personal statement of suitability clearly demonstrating how you meet the essential criteria as detailed in the responsibilities section of the job advert in no more than 1000 words.

If high application volumes are received, the benchmark for candidates to proceed to the next stage may be raised. In line with our commitment to the Disability Confident Scheme (DCS), we aim to advance all candidates applying under the DCS who meet the minimum standard. However, we may only progress those candidates who best meet the required standards.

**Please note the closing date for your full application is 23:55 on 14/04/2026**

The sift is scheduled to be held from 15/04/2026 to 01/05/2026. These dates may be subject to change.

Stage 3 - Interview

If you pass the written application sift with the required score you will be invited to a blended interview and will receive an electronic notification to your Civil Service Jobs account.

The interviews will be conducted face to face. Where possible the interviews will take place at the locations listed in the Candidate Pack (slide 2), however candidates may be expected to travel to an alternative location as required.

If you require any reasonable adjustments to attend a face-to-face interview, please ensure you state those on your application form when asked to do so.

Interviews are scheduled to take place from 18/05/2026, please note that this date is only indicative at this stage and could be subject to change. Interviews will be scheduled Monday to Friday, between 09:00 to 17:00.

Communications will be electronic and/or by SMS/telephone therefore it is important that you check your Civil Service Jobs account regularly, as well as your spam/junk email folder. Telephone calls may show as a withheld number, it is important that you answer so that your interview can be confirmed. If you wish to opt out of SMS messages, please email this address, including the vacancy reference and your candidate ID CFCD.RECRUITMENTINBOX@DWP.GOV.UK. As part of our commitment to improving the candidate experience, you may be contacted during the recruitment process

Preparing for the Interview

The interview will take approximately 30 to 40 minutes and will consist of a brief presentation plus technical and behavioural questions. You will be provided with a pack prior to your interview detailing the requirements of the presentation.

Behaviours

You will be assessed against the Civil Service Behaviours listed at level 3. An example of a behavioural question would be “How did you lead by example to inspire and motivate your teams?”.

It may help to use one or more examples of a piece of work you have completed or a situation you have been in and use the WHO or STAR model to explain:

• WHO - What it was? How you approached the work/situation? What the Outcomes were, what did you achieve? or
• STAR - What was the ituation? What were the Tasks? What Action did you take? What were the Results of your actions?

Technical skills

We'll assess you against these technical skills during the selection process:

• Secure Operations Management - awareness
• Intrusion Detection and Analysis – awareness
• Cyber Security Operations – awareness

If you do not have work-based examples then please give examples from school/college, clubs, volunteering or other activities you have been involved in.

If you withdraw your application at any stage, it will not be progressed further.

Stage 4 – Offer

Once all interviews have been completed, you will be notified of the outcome by email. Offers will be made in strict merit order to the highest scoring candidate first. The successful candidates will be notified of a start date following successful pre-employment and security checks, which is likely to be during October 2026.

Important information

Visa Sponsorship

For these vacancies, we strongly recommend that applicants consult with an immigration specialist or qualified advisor to assess their eligibility for Visa Sponsorship before deciding to apply. Please note that while we consider sponsorship requests in accordance with current DWP guidance and Home Office policy, sponsorship cannot be guaranteed.

Candidate pack

It is important that you take time to read the candidate pack which can be found at the bottom of this job advert. This provides further information about the role and working in DWP.

Location

Please see slide 2 in the candidate pack for list of possible locations. You should only apply for suitable posts where you can travel to and from your home office location daily within a reasonable time. Please be aware that this role can only be worked in the UK and not overseas. Relocation costs will not be reimbursed. Make sure the location works for you before applying!

Hybrid working​

This role may be suitable for hybrid working, which is where an employee works part of the week in their DWP office and part of the week from home. This is a voluntary, non-contractual arrangement and your office will be your contractual place of work. If a hybrid working arrangement is suitable for the role and for you, you will normally be required to spend a minimum of 60% of your contracted working hours from your DWP office. If you have a disability, caring responsibilities, or other circumstances that may affect your ability to meet the minimum office attendance requirement, please discuss this with us using the contact details in this advert. Hybrid working will not commence until any training and consolidation period has been successfully completed.

Working pattern​

Part-time, part-year, term-time compressed hours and job-sharing working patterns within working hours will be considered but must meet business needs. We will do our best to let people with existing part time contracts retain their contracted hours provided they are in line with current business needs. Please note that successful candidates with agreed alternative working patterns may be required to work full time for specific periods to complete all training and consolidation.

​​Hours of work ​

The full-time working week in DWP is 37 hours. You may be required to work at any time between the hours of: ​

• 7:45am and 8:00pm on any day between Monday to Friday, and​
• 8:45am to 5:00pm on Saturday.​

Managers will agree working patterns with successful applicants within these business hours and review these as appropriate. You will be given advance notice of your personal schedule.

Learning and Development

DWP takes development seriously. Our aim is for our colleagues in these roles to be appropriately skilled and qualified – as determined by the business. To support this aim you may be required to undertake a work-based qualification, which may be in the form of an apprenticeship, which will support you in further developing your professional knowledge and skills for this role and your future career development. The qualification can be undertaken in work time, you agree to take this job on the basis that you may be required to undertake a work-based qualification; a candidate’s failure to participate fully in the professional programme, once appointed, may be a breach of their employment contract. Important - If you hold a level 3 qualification (2 A levels or equivalent) then please bring your certificates with you to the interview if you have them.

Diversity and Inclusion

At the Department for Work and Pensions (DWP) we value diversity and inclusion and actively encourage and welcome applications from everyone, including those that are underrepresented in our workforce.

Find out more about working for DWP on the DWP Careers Hub.

Reserve List

A reserve list may be held for a period of 12 months from which further appointments can be made.

If you are placed on a reserve list but we cannot immediately offer you a post, please note:

• If you are later offered the role you applied for, in a location you have expressed a preference for, and you decline the offer or are unable to take up post within a reasonable timeframe you will be withdrawn from the campaign and removed from the reserve list, other than in exceptional circumstances (e.g. a contractual part time working pattern cannot be accommodated in the initial role offered or in the case of serious ill health).
• If we make an offer of an alternative role or location to that which you originally applied for, and you decline that offer, you will be able to remain on the reserve list.

Disability Confident Scheme

If high application volumes are received, the benchmark for candidates to proceed to the next stage may be raised. In line with our commitment to the Disability Confident Scheme (DCS), we aim to advance all candidates applying under the DCS who meet the minimum standard. However, we may only progress those candidates who best meet the required standards.

Reasonable Adjustments

We consider visible and non-visible disabilities, neurodiversity or learning differences, chronic medical conditions, or mental ill health. Examples include dyslexia, epilepsy, autism, chronic fatigue, or schizophrenia.

If you need a change to be made so that you can make your application, you should contact the Government Recruitment Service via DWPRecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.

Complete the “Reasonable Adjustments” section in the “Additional requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.

Integrity, Plagiarism and Civil Service Principles

The Civil Service values honesty and integrity and expects all candidates to abide by these principles. Please ensure that all examples provided in your application are taken directly from your own experience and that you describe the examples in your own words.

Examples of plagiarism can include:

• Presenting the work, ideas and experience of others as your own.
• Copying content or answers from an online or published source that is not your own.

Disclosure and Barring Service and Internal Fraud Database Checks

To process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service on your behalf. However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.

Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment. A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5-year period following a dismissal for carrying out internal fraud against government.

If successful and transferring from another Government Department a criminal record check will be carried out.

For further information on National Security Vetting please visit the Demystifying Vetting website.

Salary

New entrants are expected to join on the minimum of the pay band.

Before applying for this vacancy, current employees of DWP should check whether a successful application would result in changes to their terms & conditions of employment, e.g. mobility, pay, allowances. If you are a current employee and are successful you must be able to be released from your current post within four weeks.

Those on protected TUPE/ COSoP terms and conditions applying on promotion or voluntary permanent level move will adopt DWP’s Terms and Conditions and this may have a different impact on pay and allowances. Please review this prior to acceptance of a role.

Civil Servants that would transfer into DWP from other government organisations, following successful application, will assume DWP's terms & conditions of employment current on the day they are posted, unless DWP has stated otherwise in writing. Accepting a post will be taken to mean acceptance of revised terms & conditions.

Civil Servants applying on promotion will usually be appointed to the salary minimum or within 10% of existing salary.

Any move to DWP from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may, however, be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at the Childcare Choices Website.

Feedback

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a criminal record check.Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see theCivil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.The Civil Service welcomes applications from people who have recently left prison or have an unspent conviction. Read more about prison leaver recruitment (opens in new window).Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job contact :

• Name : CFCD RECRUITMENT TEAM
• Email : CFCD.RECRUITMENTINBOX@DWP.GOV.UK

Recruitment team

• Email : dwprecruitment.grs@cabinetoffice.gov.uk

Further information

Appointment to the Civil Service is governed by the Civil Service Commission’s Recruitment Principles. If you feel your application has not been treated in accordance with these principles and you wish to make a complaint, you should in the first instance contact DWP by email: HR.BUSINESSASSURANCE@DWP.GOV.UK.
If you are not satisfied with th