Tier 1 Analyst

Job summary

The Home Office works to build a safe, fair and prosperous UK. We achieve this through our work on counter-terrorism, policing, crime, drugs policy, immigration and passports.

Home Office Digital designs, builds and develops services for the rest of the department and for government. Every year our systems support up to 3 million visa applications, checks on 100 million border crossings, up to 8 million passport applications and deliver 140 million police checks on people, vehicles and property.

This role places you at the centre of defending Home Office systems. As a Tier 1 Protective Monitoring Analyst, you will help detect threats, investigate alerts, and support incident responses across a live operational Security Operations Centre. It offers hands‑on experience with enterprise security tools, clear progression, and the chance to develop strong technical skills. You will contribute directly to safeguarding national services while learning from experienced cyber professionals.

Job description

Cyber Security at the Home Office is at the front end of protecting one of the largest government departments and safeguarding the critical digital infrastructure.

The role of Monitoring within the Home Office’s Cyber Security Operations Centre (CSOC) is to collect and analyse security event data arising from activity across the organisation, tune and improve rules generating security alerts, and follow up by investigating indicators of potentially malicious activity, escalating incidents or initiating responses.

As a Tier 1 Protective Monitoring Analyst, you will monitor, triage, and investigate security alerts across protective monitoring platforms. You will support the identification, analysis, and escalation of potential security incidents, working within a Security Operations Centre to help protect critical government systems. This role provides an entry point into hands-on cyber defence in a live operational environment.

Key responsibilities

• Monitor, triage, and investigate security alerts generated via detection platforms to identify potential security incidents.
• Analyse security event data to support incident investigation, reporting, and timely escalation in line with established procedures.
• Support data acquisition and evidence collection activities for internal security investigations, following defined processes and handling requirements.
• Support the continuous improvement of protective monitoring capabilities by assisting with the implementation of monitoring use cases, dashboards, and alerting aligned with policies and standards, and work with colleagues across government using specialist security monitoring tools, contributing to consistent SOC operational practices.
• Maintain accurate records of investigations, actions taken, and outcomes to support reporting, assurance, and audit needs.
• Continuously develop technical knowledge and operational skills, building an understanding of emerging threats, attacker techniques, and SOC best practice.

The successful candidate will need to be adaptable and willing to work flexibly across the wider team as required, performing additional duties reasonably expected within the scope of the grade.

Working Pattern

Due to the business requirements of this role, it is only available on a full-time basis with shift working.

Shift Working

The successful candidate will work as part of a 24/7 shift team. You must be able to attend all shift types, including early starts, late finishes, and overnight duties, some of which fall outside normal public transport hours.

Shifts run on a four‑on, four‑off rotation. Weekday day shifts (Monday to Friday, 07:00 to 19:00) are worked on site in Manchester. Night shifts (19:00 – 07:00) and weekend shifts are currently carried out remotely from home.

Every 16 weeks, you will move to regular hours (Monday to Friday, 9:00 to 17:00) for a four‑week period to support continuous improvement activity off shift, at a 60 per cent attendance requirement, before returning to the shift pattern.

Due to operational challenges, you may be required to work on different teams within the CSOC environment at short notice.

Person specification

Essential Criteria

• Able to follow documented processes consistently, applying each step during alert monitoring, triage, and escalation, and recognising when it is appropriate to seek guidance or support.
• Demonstrates a foundational understanding of common security alerts and basic indicators of compromise, with the ability to identify when activity may be unusual or suspicious and escalate appropriately.
• Observes and records information accurately and clearly, ensuring that key details are captured in a way that supports fair, efficient, and consistent investigations by colleagues in other teams or tiers.
• Shows a commitment to learning and development, including openness to feedback, willingness to ask questions when unsure, and proactive engagement in building technical and investigative skills over time.
• Provides clear, factual, and objective updates when escalating alerts, contributing to effective handovers between shifts or teams while maintaining professionalism and respect for colleagues.
• Able to manage workload responsibly, completing tasks within expected timeframes, maintaining attention during monitoring activities, and raising issues promptly where challenges, delays, or barriers arise.

Technical Skills

The skills listed below are reflective of the Home Office Government Digital and Data Profession Career Framework (based on the industry standard SFIA8 framework SFIA framework to understand what would be expected for each technical skill listed). Please see below for the relevant skills for your role:

Strategy and Architecture

Security and Privacy

Threat intelligence (THIN) – Level 2

Advice and Guidance

Specialist advice (TECH) – Level 3

Delivery and Operation

Service Management

Incident management (USUP) – Level 2

Service level management (SLMO) – Level 2

Security Services

Security operations (SCAD) – Level 2

Relationship and Engagement

Stakeholder Management

Stakeholder relationship management (RLMT) – Level 3

Behaviours

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions

Technical skills

We'll assess you against these technical skills during the selection process:

• Threat intelligence (THIN) – Level 2
• Specialist advice (TECH) – Level 3
• Incident management (USUP) – Level 2
• Service level management (SLMO) – Level 2
• Security operations (SCAD) – Level 2
• Stakeholder relationship management (RLMT) – Level 3

Benefits

In addition to your salary, a career with the Home Office offers a range of benefits, including:

• A Civil Service pension with an employer contribution of 28.97%.
• In-year reward scheme for one-off or sustained exceptional personal or team achievements.
• 25 days annual leave on appointment, rising with service to 30 days.
• Eight days of public holidays, plus one additional privilege day.
• This role currently attracts Annualised Hours Allowance (AHA) of37.75% of salary, which equates to an additional £14,503 per annum based on salary minimum. Further information can be found on our website.
• The advertised role is eligible for a Digital Capability Allowance. Successful candidates with exceptional skills and experience may apply for a Recruitment and Retention Allowance. ​
• The allowance values are set by the Home Office, subject to remaining in a qualifying role. This allowance is non-contractual, subject to an annual review and could be withdrawn at any time. ​
• For both new entrants and existing civil servants, the total compensation offer is a combination of base salary and, if applicable, a capability-based allowance.
• See more of our benefits on our careers website.

Sign-up on our website to receive emails with information about careers at the Home Office

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

This gives us the best possible chance of finding the right person for the job, drives up performance and improves diversity and inclusivity.

We will endeavour to conduct the selection process in line with the dates indicated below, but cannot guarantee that these will not, where necessary, be revised.

1. Application – by 19th February 2026

As part of the application process, you will be asked to complete:

• CV
• Personal Statement (maximum 500 words).
• Evidence of the Behaviour Making Effective Decisions (maximum of 250 words per Behaviour).

Your CV should consist of your career history and skills/experience, including any key achievements in each role. Your CV will be scored against the experience required for the role as noted within the essential criteria.

The Personal Statement should be aligned to and demonstrate how you meet the skills and experience set out in the essential criteria, detailed in the job description.

For guidance and information on how to construct your application (CV, Personal Statement and Behaviours), you are encouraged to visit Civil Service Careers website.

2. Sift – week commencing 23rd February 2026

The sift will be held on the Personal Statement, CV and the Behaviour Making Effective Decisions.

Should a high volume of applications be received, an initial sift will be conducted on the Personal Statement and the CV. Candidates who pass the initial sift will then be progressed to a full sift that will consist of all the remaining elements submitted (Behaviour Making Effective Decisions). Candidates who fail to meet the minimum pass score for the initial sift will not have their remaining submitted elements scored and will only receive a sift score for that assessed at the initial sift.

3. Interview – week commencing 23rd March 2026

If you are successful at sift stage, you will be invited to an interview that will be Behaviours (as listed in the job advert) and Technical Skills based questions.

In addition, candidates will be asked to prepare a presentation that will be delivered at interview. The presentation question/scenario will be disclosed closer to the interviews.

The presentation will be assessed against SFIA8 Framework SFIA framework and will be assessed against the Technical Skills as listed in the job advertisement.

The interview will take place on MS Teams.

For guidance on the Technical skills, please refer to the SFIA8 Framework SFIA framework.

For guidance and information on what to expect and how to prepare for an interview, you are encouraged to visit Civil Service Careers.

Further Information

In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service on your behalf. However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct.

If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.

Problems during the application process

If you experience problems accessing this advert, or you think you’ve made a mistake on an initial application, please contact hocandidates.grs@cabinetoffice.gov.uk, including the vacancy reference, at least two working days before the vacancy closes. Further information can be found on our website.

Do not create or attempt to submit another application, online test or use a different Civil Service Jobs account to proceed as this would be in violation of the candidate declaration.

Reserve List

A reserve list may be held for a period of up to 12 months from which further appointments may be made. There is no guarantee that being held on a reserve list will lead to a job offer. Further information can be found on our website.

Candidates judged to be a near miss at interview may be offered a post at the grade below the one advertised without the need to go through a further selection process, providing the role has the same Success Profiles elements and essential skills. There is no guarantee that further such vacancies will arise.

Standards

All Civil Servants are expected to comply with the Civil Service Code, and its core values of integrity, honesty, objectivity and impartiality.

Additional Security Checks

As well as successfully obtaining UK Security Vetting clearance, candidates will be subject to a range of additional checks. The range of checks carried out will depend on whether you are a current Home Office employee, existing civil servant or an external new entrant as well as the role requirements. The level of Criminal Record Check required for this role is Basic.Further details are included in the Notes to Candidates.

Non-Police Personnel Vetting (NPPV)

You should currently hold, or be willing to obtain, Non-Police Personnel Vetting (NPPV) Level-3 vetting (including financial checks). This is essential for the role. For further information visit About the Police National Vetting Service , Warwickshire Police.

Formal offers of employment will not be made until successful candidates have obtained both NSV clearance and NPPV3 clearance.

For existing Civil Servants: Please note that failure to obtain NPPV3 Clearance may trigger a formal review of your National Security Vetting Clearance (NSV). Depending on the nature of the information identified, this could result in your NSV being revoked.

Reasonable Adjustments

If a person with disabilities is at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.

If you need a change to be made so that you can make your application, you should:

• Contact Government Recruitment Service via HOrecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs

• Complete the “Assistance Required” section in the “Additional Requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you're deaf, a language service professional

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the ‘Contact point for applicants’ section.

Feedback

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a criminal record check.Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see theCivil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job contact :

• Name : Home Office Resourcing Centre
• Email : HORCCampaignTeamHSGPSGandMBG@homeoffice.gov.uk

Recruitment team

• Email : HOrecruitment.grs@cabinetoffice.gov.uk

Further information

If you feel that your application has not been treated in accordance with the Civil Service recruitment principles and you wish to make a complaint, then contact the Government Recruitment Service via HOrecruitment.grs@cabinetoffice.gov.uk. If you are not satisfied with the response that you receive, then you can contact the Civil Service Commission.

Attachments

candidate_information_v16_January_2026 Opens in new window (pdf, 429kB)2025-11-17 Pre-employment Checking - Document Requirements (V17) Opens in new window (pdf, 231kB)