Security Monitoring Technology & Infrastructure Capability Development Analyst

Job summary

The DWP Cyber Resilience Centre (CRC) offers a uniquely challenging and fulfilling opportunity for people interested in making a genuine difference to society.

DWP is the UK’s biggest government department; few other organisations globally provide the same opportunity to apply next-generation digital technology on a massive scale to issues with touch the lives of so many. We support twenty million people every day to help them find work and save for their future. We provide financial assistance worth over £180 billion each year to ensure that the most vulnerable in society are protected. With 800 locations and around 100,000 colleagues, we’re bigger than most retail operations.

An exciting opportunity has arisen to join the CRC’s Capability Development Group – Operations and Tooling team, developing technical security operations capabilities. You will provide a vital role in securing the DWP IT and information estate ensuring that the CRC’s operational teams have the capability to Protect, Detect and Respond to anomalous, malicious, or fraudulent activity from internal and external threat actors.

This is an ideal role for candidates with a proven track record operating within a security monitoring environment who may wish to step away from operational routine and drive forward the development of the CRC’s security monitoring operations specialist toolset.

Job description

• Working as part of CRC’s CDG Operations and Tooling team, you will be part of a small team with the responsibility for driving forwards the development of Security Monitoring Operations capabilities, solutions and technical tools delivering an operational advantage to operational teams.
• You will ensure CRC are able to maximise the benefits of security monitoring capabilities through close collaboration with other teams and projects within and outside of CRC, and key external business partners.
• Working with your team leads, you will provide both technical and operational support, and guidance to the wider security teams; leading, managing and delivering all elements of development activities to ensure that capabilities are configured and operationalised effectively for day-to-day use within CRC.

Person specification

This is a technical, hands-on role including the following responsibilities:

• Support CRC’s operational teams with the development and delivery of detection and respond capabilities across all DWP infrastructure environments.
• Collaborating with CRC’s Capability Development Group, operational teams and broader digital stakeholders, construct high fidelity monitoring, warning, and alerting capabilities; focussing on people, processes, technology, and data.
• Support the strategic development of CRC, Security & Data Protection, Digital and the broader department through the analysis of security data and the production of appropriate security insights.
• Collaborate with and coach Monitoring Operations Analysts in developing new skills to adopt and operate the latest security analytical tools, proficiently.
• Using recognised industry standards such as NIST and MITRE, continuously review and help improve existing capabilities to protect the integrity of our systems from both internal and external threat actors.
• You will apply your knowledge of the latest adversary tactics, techniques and procedures, indicators of compromise and detection capabilities to develop innovative response methods to new threats and attack vectors, helping operational monitoring teams keep pace with the ever-changing threat landscape
• You will be required to have a thorough understanding of relevant data sources available to operational monitoring teams and help drive visibility through the custodianship of relevant Data Dictionaries/Catalogues.
• Build upon your existing technical and monitoring operations skillset. Maintain a full understanding of Security Information & Event Management (SIEM) tools and associated data quality and logging principles, Orchestration & Automation tools and capabilities, Intrusion Detection Systems (IDS)/Intrusion Prevention Systems (IPS) and Endpoint Detection & Response (EDR) solutions.
• Identify and suggest training and learning pathways to ensure a consistent skill level across CRC’s operational teams.
• You will possess excellent communication skills. You will be confident in delivering presentations, drafting comprehensive reports and be able to explain technical content in simple terms.
• Present and explain complex technical information appropriately to non-technical and technical audiences and important stakeholders.

Essential Criteria

The following Essential Criteria will be used at sift; a strong candidate will be able to demonstrate the Essential Criteria listed below:

• Proven experience of working in a security monitoring operations team, or security monitoring operations capability development team (DevOps / SecDevOps), with the ability to manage multiple priorities and respond flexibly to competing demands organising work accordingly
• Proven experience using the latest Security Information & Event Management (SIEM) and other security monitoring tools to develop monitoring dashboards, detections, and alerts.
• Experience of explaining security events and technical concepts and implications to non-technical audiences and to important stakeholders.
• Proven ability to foster and develop influential relationships possessing excellent inter-personal skills to develop substantial credibility with key stakeholders across the Department and across HMG.

Desirable Criteria

• Experience and understanding of a broad range of security monitoring and data analysis tools, associated operational techniques and procedures.
• Experience in coaching and developing staff to grow capability and ensure team members are equipped with the skills and knowledge to effectively undertake their job roles.

Qualifications and Certifications

It would be advantageous for candidates to have or be willing to work towards: (any of the following will be acceptable)

• Continuous processional security certifications showing intermediate to advance security knowledge (minimum of SANS 401, 501 or CompTIA Security +), or relevant experience that demonstrates networking understanding and key security principles.
• Certificates or evidential equivalent experience of Security Information & Event Management (SIEM) tools covering; Data Management, Searching & Reporting, Dashboard Development.
• Certificates or evidential equivalent experience of Security Orchestration, Automation, and Response (SOAR) solutions, Intrusion Detection Systems (IDS)/Intrusion Prevention Systems (IPS) solutions and Endpoint Detection & Response (EDR) solutions.

Behaviours

We'll assess you against these behaviours during the selection process:

• Changing and Improving
• Communicating and Influencing
• Working Together

Technical skills

We'll assess you against these technical skills during the selection process:

• Candidates will produce a 10-minute presentation followed by questions from the interviewing panel. The subject will be provided to those candidates successful at Sift and invited to interview.

Benefits

Alongside your salary of £45,225, Department for Work and Pensions contributes £13,101 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).

DWP have a broad benefits package built around your work-life balance which includes:

• Working patterns to support work/life balance such as job sharing, term-time working, flexi-time and compressed hours.
• Generous annual leave – at least 23 days on entry, increasing up to 30 days over time (pro–rata for part time employees), plus 9 days public and privilege leave.
• Support for financial wellbeing, including interest-free season ticket loans for travel, a cycle to work scheme and an employee discount scheme.
• Health and wellbeing support including our Employee Assistance Programme for specialist advice and counselling and the opportunity to join HASSRA a first-class programme of competitions, activities and benefits for its members (subscription payable monthly).
• Family friendly policies including enhanced maternity and shared parental leave pay after 1 year’s continuous service.
• Funded learning and development to support progress in your role and career. This includes industry recognised qualifications and accreditations, coaching, mentoring and talent development programmes.
• An inclusive and diverse environment with opportunities to join professional and interpersonal networks including Women’s Network, National Race Network, National Disability Network (THRIVE) and many more.

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

As part of the application process you will be asked to complete a CV and personal statement.

Candidates will be required to provide a CV covering work history, achievements in role and qualifications. Additionally, a Personal Statement is required, demonstrating how you meet the Essential/Desirable Criteria (listed in responsibilities section) for this role (maximum 750 words).

The sift panel will use the information relating to your employment history (your CV) and your personal statement of suitability to assess your experience, skills and knowledge.

When giving details of your employment history, you should include details of the work that you have been involved in, outcomes, and your role therein.

All applications will be assessed and sifted based on the personal specification in the advert, using the information you provide in your
completed application form.

Interview

Successful candidates will be invited to a face-to-face interview where candidates will be assessed on Behaviours, Technical Skills & Experience. We'll assess you against these Success Profiles at the interview stage:

Behaviours:

Working Together, Changing & Improving & Communicating and Influencing

Technical Skills:

Candidates will be asked to do a short (10-15 minutes) presentation on a specific topic. Further details will be provided to candidates invited to interview.

Sift and interview dates to be confirmed.

Individuals applying for security clearance should usually have been continuously resident in the UK for the following periods immediately before the clearance is launched:

Applicants are required to meet the UK residency requirements so that National Security Vetting (NSV) checks can be conducted. You must have resided continuously in the UK for Security Check (SC): at least 3 of the last 5 years, 2 of which must have been the immediately preceding years from the point of applying for this job.

For further information on National Security Vetting please visit the Demystifying Vetting website.

There may be a requirement for DV level clearance in the future with this role.

Further Information​

At the Department for Work and Pensions (DWP) we value diversity and inclusion and actively encourage and welcome applications from everyone, including those that are underrepresented in our workforce.

Find out more about working for DWP on the DWP Careers Hub.

Reserve List

A reserve list may be held for a period of 6 months from which further appointments can be made.

If you are placed on a reserve list but we cannot immediately offer you a post, please note:

• If you are later offered the role you applied for, in a location you have expressed a preference for, and you decline the offer or are unable to take up the post within a reasonable timeframe you will be withdrawn from the campaign and removed from the reserve list, other than in exceptional circumstances (e.g. a contractual Part Time Working Pattern cannot be accommodated in the initial role offered or in cases of serious ill health).
• If DWP makes an offer of an alternative role or location to that which you originally applied for, and you decline that offer, you will be able to remain on the reserve list.

Disability Confident Scheme

If high application volumes are received, the benchmark for candidates to proceed to the next stage may be raised. In line with our commitment to the Disability Confident Scheme (DCS), we aim to advance all candidates applying under the DCS who meet the minimum standard. However, we may only progress those candidates who best meet the required standards.

Reasonable Adjustments

We consider visible and non-visible disabilities, neurodiversity or learning differences, chronic medical conditions, or mental ill health. Examples include dyslexia, epilepsy, autism, chronic fatigue, or schizophrenia.

If you need a change to be made so that you can make your application, you should contact the Government Recruitment Service via DWPRecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.

Complete the “Reasonable Adjustments” section in the “Additional requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.

Integrity, plagiarism and Civil Service Principles

The Civil Service values honesty and integrity and expects all candidates to abide by these principles.

Please ensure that all examples provided in your application are taken directly from your own experience and that you describe the examples in your own words.

Examples of plagiarism can include:

- Presenting the work, ideas and experience of others as your own

- Copying content or answers from an online or published source that is not your own

Disclosure and Barring Service and Internal Fraud Database Checks

To process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service or Disclosure Scotland on your behalf. However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.

For further information on the Disclosure Scotland confidential checking service telephone: the Disclosure Scotland Helpline on 0870 609 6006 and ask to speak to the operations manager in confidence, or email Info@disclosurescotland.co.uk

Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment. A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.

If successful and transferring from another Government Department, a criminal record check will be carried out.

Important

New entrants are expected to join on the minimum of the pay band.

Before applying for this vacancy, current employees of DWP should check whether a successful application would result in changes to their terms & conditions of employment, e.g. mobility, pay, allowances. If you are a current employee and are successful you must be able to be released from your current post within four weeks.

Those on protected TUPE/ COSoP terms and conditions applying on promotion or voluntary permanent level move will adopt DWP’s Terms and Conditions and this may have a different impact on pay and allowances. Please review this prior to acceptance of a role.

Civil Servants that would transfer into DWP from other government organisations, following successful application, will assume DWP's terms & conditions of employment current on the day they are posted, unless DWP has stated otherwise in writing. Accepting a post will be taken to mean acceptance of revised terms & conditions.

Civil Servants applying on promotion will usually be appointed to the salary minimum or within 10% of existing salary.

Any move to DWP from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may, however, be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at the Childcare Choices Website.

Feedback

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a basic (or equivalent) criminal record check.Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see theCivil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job contact :

• Name : Paul Rose
• Email : paul.rose1@dwp.gov.uk

Recruitment team

• Email : dwprecruitment.grs@cabinetoffice.gov.uk

Further information

Appointment to the Civil Service is governed by the Civil Service Commission’s Recruitment Principles. If you feel your application has not been treated in accordance with these principles and you wish to make a complaint, you should in the first instance contact DWP by email: HR.BUSINESSASSURANCE@DWP.GOV.UK.
If you are not satisfied with the response you receive from the Department, you can contact the Civil Service Commission. Click here to visit the Civil Service mmission.

Attachments

DWP Terms and Conditions January 2024 Opens in new window (docx, 17kB)Success-Profiles-Candidate-Overview Opens in new window (pdf, 635kB)