UK Ministry of Defence
Security Operations Centre Level 1 Analyst
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Hereford
Job Summary
The Defensive Cyber Analyst will work within a rapidly growing cyber security team who are responsible for designing, delivering and maintaining operational cybersecurity capabilities. You will be conducting proactive, risk-based, defensive monitoring of priority C4IS/networks identifying potential internal and external cyber threats/attacks.
The position involves a broad range of skills to monitor networks/systems, and the post holder must have the ability to analyse and investigate security events, communicate effectively with other team members and articulate clearly when raising escalating to senior team members and management.
Your main objective will be to proactively monitor and hunt through IT environments to detect and respond to information and cyber security threats utilising a range of technologies and processes to prevent, detect and manage cyber threats.
You will contribute to the effectiveness and maturity of the Security Operations Centre (SOC) by contributing to tooling, updating and creating new play books while remaining current with the trends in the wider security industry.
This position is advertised at 37 hours per week.
This is open to Sole UK Nationals Only.
Job Description
Day To Day Operations:
- Manage and maintain security of computer networks by monitoring situational awareness feeds to detect Cyber threats to users, and the wider MOD community.
- Conduct analysis of all alerts to determine the threat to computer networks, triaging by employing a methodical and coherent response and escalating in accordance with (iaw) Standard Operating Procedures (SOP’s).
- Create and maintain accurate case management records of all actions taken while analysing and closing incidents iaw SOPs.
- Monitor sensor feeds and heuristic detection tools, performing initial analysis to identify process and network events that may indicate a malicious cyber incident.
Incident Response & Management:
- Brief management regarding ongoing security incidents including status and actions to be taken.
- Raise and perform response actions of any incidents that arise during your response time, which may include liaison with external agencies or analysis using the tools available.
- Maintain all incident documentation using the various case management toolsets to maintain the single source of knowledge of the cyber defence task.
- Deliver briefings where required to support the defensive cyber monitoring task.
SOC Development:
- Develop new or improve Security Use Cases, ensure accurate supporting documentation is maintained and reports, rules, and alerts for SIEM tools developed in unison.
- Deliver operationally focused direction, guidance, and SME (subject matter expert) advice to junior security staff and non-security staff.
- Engage with various partners, including service providers within industry regarding the defensive monitoring.
Personal & Professional Development:
- Maintain knowledge of current cyber issues, vulnerabilities and exploits through research, technical reports, and briefs.
- Undertake continual knowledge development in line with NIST Work Role PR-CDA-001.
Other Duties as directed by SOC Team Lead and SOC Manager/Director.
Person specification
As a Defensive Cyber Analyst, you will work independently and as part of a team, you will be responsible for proactive monitoring and detection of security events. You will be responsible for analysing, investigating, and communicating cyber security incidents and risk. You will be an effective team player and bring your good understanding of computer networks (LAN/WAN, network protocols and OSI model) and knowledge of computer-based network attacks (MITRE ATT&CK, NIST CSF) to contribute to successfully defending organisational systems. You will be responsible for seeking opportunities to improve your own knowledge and sharing knowledge with others.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
The Ideal Candidate Will Have The Following Traits:
- A passion for cyber security and a keen interest in IT.
- Adopts a creative, yet methodical mind-set when investigating and responding to cyber threats.
- Persevering in the face of stressful circumstances to prioritise and meet deadlines.
- Superb attention to detail, good analytical and problem solving skills to assist in resolving Events of Interest and potential Indicators of Compromise.
- A continuous desire and willingness to learn and develop your current knowledge and skills.
- Good verbal and written communication skills, with particular ability to communicate technical information to non-technical collaborators.
Behaviours
We'll assess you against these behaviours during the selection process:
- Changing and Improving
- Working Together
- Developing Self and Others
- Making Effective Decisions
We only ask for evidence of these behaviours on your application form:
- Changing and Improving
- Working Together
- Developing Self and Others
Technical skills
We'll assess you against these technical skills during the selection process:
- SFIA – IT Infrastructure (ITOP) – Level 1
- SFIA – Network Support (NTAS) – Level 2
- SFIA – Incident management (USUP) – Level 3
- SFIA – Security operations (SCAD) Level 3
Benefits
Alongside your salary of £30,740, Ministry of Defence contributes £8,905 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).
- Full learning and development tailored to your role
- An environment with flexible working options
- A culture encouraging inclusion and diversity
- A Civil Service pension with an average employer contribution of 28.97%
- 25 days’ paid annual leave rising (one day per year) to 30 days after five years’ service
- Access to onsite gymnasium and cafe
This post does not offer any assistance with relocation allowances.
Important Notes
- External recruits who join the MOD who are new to the Civil Service will be subject to a six-month probation period.
- Expenses incurred for travel to interviews will not be reimbursed.
- Please Note: The Department is conducting a review of all pay related allowances which could impact on those allowances that the post currently being advertised attracts.
- Any move to MOD from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax-Free Childcare. Determine your eligibility at https://www.childcarechoices.gov.uk/.
- The Ministry of Defence is committed to providing a safe and healthy working environment for its staff which includes educating them on the benefits of not smoking, protecting them from the harmful effects of second-hand smoke and supporting those who want to give up smoking. Under the Smoke-Free Working Environment policy, Smoking and the use of all tobacco products (including combustible and chewing tobacco products) will not be permitted anywhere in the Defence working environment however some exemptions are in place, please refer to local guidance. The policy is Whole Force and includes all Defence personnel, contractors, visitors and other non-MOD personnel. All applicants seeking, considering, or accepting employment with the Ministry of Defence should be aware of this policy and that it is already in place at a number of Defence Establishments.
- MOD Recruitment Satisfaction Survey – We may contact you regarding your experience to help us improve our customer satisfaction. The survey is voluntary and anonymous. You may however be given the opportunity to provide additional information to help us improve our service which includes the collection of some personal data as defined by the United Kingdom General Data Protection Regulation (UK GDPR). The MOD Privacy Policy Notice sets out how we will use your personal data and your rights.
- Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Selection process details
This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.
Candidates will be required to provide a statement of suitability. (max 750 words)
At sift, Candidates will be assessed against their Statement of suitability and the following:
- Changing and Improving
- Working Together
- Developing Self and Others
All applications will go through sift and those successful will be invited to attend an interview.
Behaviours
At interview, Candidates will be assessed against the following:
- Working Together
- Developing Self and Others
- Making Effective Decisions
Technical Skills
- SFIA – IT Infrastructure (ITOP) – Level 1
- SFIA – Network Support (NTAS) – Level 2
- SFIA – Incident management (USUP) – Level 3
- SFIA – Security operations (SCAD) Level 3
SFIA 9 skills directory A–Z — English
During the interview process candidates' technical/cyber understanding will be assessed via questioning.
Immigration
As a result of the changes to the UK immigration rules which came into effect on 1 January 2021, the Ministry of Defence will only offer sponsorship for a skilled worker visa under the points-based system, where a role has been deemed to be business critical. The role currently being advertised has not been assessed as business critical and is therefore NOT open to applications from those who will require sponsorship under the points-based system. Should you apply for this role and be found to require sponsorship, your application will be rejected, and any provisional offer of employment withdrawn.
Diversity and Inclusion
The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.
There may be occasions where it is not practicable or appropriate to interview all DCS candidates that meet the minimum criteria for the job. For example, in certain recruitment situations such as a high volume of applications, seasonal demand, or peak periods, the employer may wish to limit the overall number of interviews offered to both DCS and
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills