Address
SalaryDetails
Reference number
Salary
Job grade
Contract type
Business area
Type of role
Information Technology
Operational Delivery
Security
Working pattern
Number of jobs available
Contents
Location
About the job
Benefits
Things you need to know
Apply and further information
Location
About the job
Job summary
The role of a Tier 1 Analyst is to collect and analyse security event data arising from activity across the organisation, tune and improve rules generating security alerts, and follow up by investigating indicators of potentially malicious activity, escalating incidents or initiating responses.
The first duty of the government is to keep citizens safe and the country secure. The Home Office has been at the front line of this effort since 1782. As such, we play a fundamental role in maintaining the security and economic prosperity of the UK.
The Home Office leads on immigration and passports, refugee protection, counter-terrorism, policing, fire services, and crime and drugs policy.
Digital Data and Technology (DDaT) enables the Home Office to keep the UK safe and secure. We design and build the services that help people apply for visas or passports; support policing and counter-terrorism operations; and protect the UK’s borders.
This is an exciting time to be at the Home Office. You’ll have a chance to shape the future and support our mission to deliver exceptional public services that work for everyone.
Our work is guided by these principles:
- We put user needs first
- We value delivery and outcomes over process
- We work in the open
Our flexible working policy ensures a healthy work-life balance. We also nurture talent and offer a broad range of learning and development opportunities that will help you flourish in your role.
We work hard to maintain a positive working culture and are committed to helping you fulfil your potential. We value diversity and provide an open, inclusive and supportive environment to help you do your best work.
You can keep up-to-date with our work on the Home Office DDaT blog.
Job description
Responsibilities
Your main day-to-day responsibilities will be:
- Assist the team to monitor, triage and investigate security alerts on protective monitoring platforms to identify security incidents and aid analysis of security event data to support the response, reporting or escalating where appropriate.
- Support the identification of new and emerging technologies, products, services, methods and techniques. Help to assess their relevance and the potential impacts (both threats and opportunities) upon business enablers, performance or sustainability. The communication of emerging technologies and their impact.
- Work with colleagues across government using specialist security tools. Work on increasing knowledge of common approaches and tooling to perform vulnerability assessment and to validate system configuration.
- Support implementation of the monitoring roadmap to enhance monitoring in line with requirements, policies and standards to govern all activities and outputs. Help team to understand how local protective security measures can be applied to reduce vulnerability exposure.
- Support design and development of automated monitoring processes, using a variety of the latest SIEM (Security Information and Event Management) and network analysis tools, techniques and procedures to detect malicious activity, help to ensure continuous improvement through dashboard monitoring or retrospective assessment.
- Assist in managing vulnerabilities and help to undertake remediation. Continuously seek to identify potential service and process improvements, working to increase your knowledge of industry best practices, good judgement and problem-solving skills to execute security operations and investigations.
Note: An employee may be required to carry out other duties within the scope of the grade and within the limits of their skill, competence and training.
Person specification
Essential Skills
You’ll have a demonstrable passion for Cyber Security with the following skills or some experience in:
Strategy and architecture:
- Security and privacy
- Threat intelligence (THIN) – Level 2
- Advice and guidance
- Specialist advice (TECH) – Level 3
Delivery and operation:
- Service management
- Incident management (USUP) – Level 2
- Service level management (SLMO) – Level 2
- Security Services
- Security operations (SCAD) – Level 2
Relationship and engagement:
- Stakeholder management
- Stakeholder relationship management (RLMT) – Level 3
The skills listed above are reflective of the Home Office DDaT Profession Skills and Competency Model (based on the industry standard SFIA framework).
Desirable Skills
Ideally you will also have the following skills or some experience in:
- Working in a ‘Security Operations Centre’ environment.
- Communicating in a verbal and written manner, and a good understanding of the use of different channels and formats for different audiences.
- Experience of producing high-quality outputs such as reports, process documentation and templates in a timely manner and in a language that is suitable for the intended audience.
Qualifications
- Candidates must hold or be prepared to undergo SC and NPPV3 clearance.
- One or more of the following qualifications would be preferred but are not essential: Blue Team Level 1, CompTIA Security+, SANS SEC401.
Behaviours
We'll assess you against these behaviours during the selection process:
- Delivering at Pace
- Changing and Improving
- Making Effective Decisions
We only ask for evidence of these behaviours on your application form:
- Delivering at Pace
Technical skills
We'll assess you against these technical skills during the selection process:
- Security Services - Security operations (SCAD) – Level 2 Strategy and architecture
- Advice and guidance - Specialist advice (TECH) – Level 3
Benefits
- An in-year performance bonus scheme.
- A Civil Service pension with employer contribution rates of between 26.6% and 30.3%, depending upon salary.
- 25 days annual leave on appointment, plus 8 days public holidays and 1 day for the King’s Birthday, rising further with service.
- Training and development opportunities tailored to your role.
- A culture encouraging inclusion and diversity.
- Season ticket loans and rental deposit loans.
- Cycle to work and payroll giving.
- Employee discounts - including a huge number of retailers, Microsoft Home Use programme and gym membership.
- A variety of staff recognition schemes including thank you vouchers.
- Health and wellbeing initiatives including monthly mindfulness sessions.
- Staff support networks.
- Maternity, adoption or shared parental leave of up to 26 weeks full pay followed by 13 weeks of statutory pay and a further 13 weeks unpaid.
- Maternity and adoption support leave (paternity leave) of 2 weeks full pay.
- Up to five days paid leave for volunteering.
- Study leave and support for studying for a qualification or other accredited development relevant to your role.
Yon can find more information at Benefits - Home Office Careers
Things you need to know
Selection process details
This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.
As part of the application process you will be asked to complete a CV, Statement of Suitability (Max Word Limit: 500) and Behaviour - Delivering at Pace' (Max Word Limit: 250).
Further details around what this will entail are listed on the application form.
The Statement of Suitability should concisely explain your motivation for applying to this role, and evidence how you meet the Essential Criteria listed on the Job Specification. It should be based around the three behaviours (Delivering at Pace, Making Effective Decisions, Changing and Improving) and why you are suitable for the role.
The sift will be based on the Statement of Suitability and the behaviour 'Delivering at Pace'.
The CV is for information purposes only and will not be marked.
In the event a high volume of applications are received, an initial sift will be held on the Lead Behaviour – Delivering at Pace. Candidates who pass the initial sift will be progressed to a full sift.
Candidates shortlisted will be invited to an interview which will be a blended approach Technical and Behaviour based questions on all listed behaviours.
Sift and Interview dates
The sift will commence from 2nd February 2024.
Interviews are expected to take place from 26th February 2024.
We will try to meet the dates set out in the advert. There may be occasions when these dates will change. You will be provided with sufficient notice of the confirmed dates.
Interviews will be carried out via MS Teams.
Candidates will be required to have access to:
- A laptop (personal or work) with a working webcam
- Good internet connection
- Microsoft Teams
Further information
Please read the essential skills for this position carefully. We will only consider those who meet the listed requirement.
If you have previously made an unsuccessful application for a role with the same essential skills and are not able to demonstrate how you have developed these skills since your last application please reconsider applying as your application is unlikely to be successful.
For meaningful checks to be carried out, individuals need to have lived in the UK for a sufficient period of time to enable appropriate checks to be carried out and produce a result which provides the required level of assurance. You should normally have been resident in the United Kingdom for the last 3 years if the role requires CTC clearance, 5 years for SC clearance and 10 years for DV. A lack of UK residency in itself is not necessarily a bar to a security clearance and applicants should contact the Vacancy Holder/Recruiting Manager listed in the advert for further advice.
This post is eligible for a DDaT Recruitment Retention Allowance. Successful candidate with exceptional skills and experience may apply for a Recruitment and Retention Allowance. This allowance is subject to an initial review within six months of taking up the post and thereafter an annual review in line with the departmental priorities and could be reduced or withdrawn at any time. This role attracts a salary uplift due to shift working.
We often have similar roles available at different grades. If a candidate is suitable for a similar role or a lower grade than they have applied for, we may offer the candidate that role without the need to go through a further selection process providing the role has the same behaviours and essential skills.
PLEASE NOTE: Due to time constraints we may not be able to offer alternative interview date(s). It is therefore expected that candidates who are successful at sift stage will make themselves available during the above time frame given.
Security
Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check.
People working with government assets must complete basic personnel security standard checks.
This is a shift-based role which involves working from 07:00-19:00 (Days) and 19:00-07:00 (Nights) on a 4 on / 4 off basis. Due to business requirements, this role is only available full-time.
This role attracts a 37.75% salary uplift on top of the base salary stated for Annualised Hours Working as analysts work as part of the 24/7 shift teams in the CSOC. This is a non-guaranteed uplift and will only be applied where Annualised Hours Working takes place.
Working Arrangements
Successful applicants will be expected to work from the Soapworks office should their day shift fall on a weekday, however this excludes bank holidays and weekends in which home working has been agreed. All night shifts (irrespective of day of the week) will also be worked from home.
Successful candidates will be able to obtain further information from their line manager.
A reserve list may be held for a period up to 12 months from which further appointment may be made.
Every day, Home Office civil servants do brilliant work to develop and deliver policies and services that affect the lives of people across the country and beyond. To do this effectively and fairly, the Home Office is committed to representing modern Britain in all its diversity, and creating a welcoming, inclusive workplace where all our people are able to bring their whole selves to work and perform at their best.
We are flexible, skilled, professional and diverse. We work to recruit and retain disabled staff and area Disability Confident Leader. We are proud to be one of the most ethnically diverse departments in the civil service. We are a Social Mobility Foundation top 75 employer.
New entrants are expected to join on the minimum of the pay band.
Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant's details held on the IFD will be refused employment.
For further information please see the attached notes for candidates which must be read before making an application.
Existing Civil Servants should note that some of the Home Office terms and conditions of employment have changed. It is the candidate’s responsibility to ensure they are aware of the Terms and Conditions they will adopt should they be successful in application and should refer to the notes for candidates for further details.
Transfer Terms: Voluntary.
If you are invited to an interview you will be required to bring a range of documentation for the purposes of establishing identity and to aid any pre-employment checks.
Please see the attached list of Home Office acceptable ID documents.
Any move to the Home Office from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at https://www.childcarechoices.gov.uk
Reasonable Adjustments
If a person with disabilities is at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.
If you need a change to be made so that you can make your application, you should:
- Contact Government Recruitment Service via HOrecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs
- Complete the “Assistance Required” section in the “Additional Requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you're deaf, a language service professional
If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the ‘Contact point for applicants’ section.
Feedback
Feedback will only be provided if you attend an interview or assessment.
Security
See our vetting charter (opens in a new window).
Nationality requirements
This job is broadly open to the following groups:
- UK nationals
- nationals of the Republic of Ireland
- nationals of Commonwealth countries who have the right to work in the UK
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
- individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
- Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service
Working for the Civil Service
We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
Apply and further information
Contact point for applicants
Job contact :
Recruitment team
