Security Operations Centre Level 1 Analyst

Job summary

The Defensive Cyber Analyst will work within a rapidly growing cyber security team who are responsible for designing, delivering and maintaining operational cybersecurity capabilities. You will be conducting pro-active, risk based, defensive monitoring of priority C4IS/networks identifying potential internal and external cyber threats/attacks.

The position involves a broad range of skills to monitor networks/systems, and the post holder must have the ability to analyse and investigate security events, communicate effectively with other team members and articulate clearly when raising escalating to senior team members and management.

Your main objective will be to proactively monitor and hunt through IT environments to detect and respond to information and cyber security threats utilising a range of technologies and processes to prevent, detect and manage cyber threats.

You will contribute to the effectiveness and maturity of the Security Operations Centre (SOC) by contributing to tooling, updating and creating new play books while remaining current with the trends in the wider security industry.

This position is advertised at 37 hours per week.

This is open to Sole UK Nationals Only.

Additional security checks will be required for this role.

Job description

Day to Day Operations:

1. Manage and maintain security of computer networks by monitoring situational awareness feeds to detect Cyber threats to users, and the wider MOD community.
2. Conduct analysis of all alerts to determine the threat to computer networks, triaging by employing a methodical and coherent response and escalating in accordance with (iaw) Standard Operating Procedures (SOP’s)
3. Create and maintain accurate case management records of all actions taken while analysing and closing incidents iaw SOPs.
4. Monitor sensor feeds and heuristic detection tools, performing initial analysis to identify process and network events that may indicate a malicious cyber incident.

Incident Response & Management:

1. Brief management regarding ongoing security incidents including status and actions to be taken.
2. Raise and perform response actions of any incidents that arise during your response time, which may include liaison with external agencies or analysis using the tools available.
3. Maintain all incident documentation using the various case management toolsets to maintain the single source of knowledge of the cyber defence task.
4. Deliver briefings where required to support the defensive cyber monitoring task.

SOC Development:

1. Develop new or improve Security Use Cases, ensure accurate supporting documentation is maintained and reports, rules, and alerts for SIEM tools developed in unison.
2. Deliver operationally focused direction, guidance, and SME (subject matter expert) advice to junior security staff and non-security staff.
3. Engage with various partners, including service providers within industry regarding the defensive monitoring.

Personal & Professional Development:

1. Maintain knowledge of current cyber issues, vulnerabilities and exploits through research, technical reports, and briefs.
2. Undertake continual knowledge development in line with NIST Work Role PR-CDA-001

Other Duties as directed by SOC Team Lead and SOC Manager/Director.

Person specification

As a Defensive Cyber Analyst, you will work independently and as part of a team, you will be responsible for proactive monitoring and detection of security events. You will be responsible for analysing, investigating, and communicating cyber security incidents and risk. You will be an effective team player and bring your good understanding of computer networks (LAN/WAN, network protocols and OSI model) and knowledge of computer-based network attacks (MITRE ATT&CK, NIST CSF) to contribute to successfully defending organisational systems. You will be responsible for seeking opportunities to improve your own knowledge and sharing knowledge with others.

The ideal candidate will have the following traits:

• A passion for cyber security and a keen interest in IT
• Adopts a creative, yet methodical mind-set when investigating and responding to cyber threats
• Persevering in the face of stressful circumstances to prioritise and meet deadlines.
• Superb attention to detail, good analytical and problem solving skills to assist in resolving Events of Interest and potential Indicators of Compromise
• A continuous desire and willingness to learn and develop your current knowledge and skills
• Good verbal and written communication skills, with particular ability to communicate technical information to non-technical collaborators.

Behaviours

We'll assess you against these behaviours during the selection process:

• Changing and Improving
• Working Together
• Developing Self and Others
• Making Effective Decisions

We only ask for evidence of these behaviours on your application form:

• Changing and Improving
• Working Together
• Developing Self and Others

Technical skills

We'll assess you against these technical skills during the selection process:

• •SFIA – IT Infrastructure (ITOP) – Level 1
• •SFIA – Network Support (NTAS) – Level 2
• •SFIA – Incident management (USUP) – Level 3
• •SFIA – Security operations (SCAD) Level 3

Benefits

Alongside your salary of £30,740, Ministry of Defence contributes £8,905 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).

• Full learning and development tailored to your role
• An environment with flexible working options
• A culture encouraging inclusion and diversity
• A Civil Service pension with an average employer contribution of 28.97%
• 25 days’ paid annual leave rising (one day per year) to 30 days after five years’ service
• Access to onsite gymnasium and cafe

This post does not offer any assistance with relocation allowances.

External recruits who join the MOD who are new to the Civil Service will be subject to a six-month probation period.

Please Note: Expenses incurred for travel to interviews will not be reimbursed.

Please be advised that the Department is conducting a review of all pay related allowances which could impact on those allowances that the post currently being advertised attracts.

Any move to MOD from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax-Free Childcare. Determine your eligibility at https://www.childcarechoices.gov.uk/.

The Ministry of Defence is committed to providing a safe and healthy working environment for its staff which includes educating them on the benefits of not smoking, protecting them from the harmful effects of second-hand smoke and supporting those who want to give up smoking. Under the Smoke-Free Working Environment policy, Smoking and the use of all tobacco products (including combustible and chewing tobacco products) will not be permitted anywhere in the Defence