6820 - Lead Offensive Security Operator
| Posting date: | 12 June 2025 |
|---|---|
| Salary: | £56,532 to £69,338 per year |
| Additional salary information: | The national salary range is £56,532 - £64,048, London salary range is £61,201 - £69,338. Your salary will be dependent on your base location. National: £56532 - £73450 (which may include an allowance of up to £16918). London: £61201 - £78225 (which may include an allowance of up to £17024) |
| Hours: | Full time |
| Closing date: | 30 June 2025 |
| Location: | UK |
| Remote working: | Hybrid - work remotely up to 3 days per week |
| Company: | Ministry of Justice |
| Job type: | Permanent |
| Job reference: | 6820 |
Summary
Lead Offensive Security Operator
Location: National*
Interviews: W/C 14th July (subject to change)
Grade: G7
(MoJ candidates who are on a specialist grade, will be able to retain this grade on lateral transfer)
Salary: National: £56532 - £73450 (which may include an allowance of up to £16918). London: £61201 - £78225 (which may include an allowance of up to £17024).
Working pattern: Full-time, part-time, flexible working, job share.
Contract Type: Permanent.
*We offer a hybrid working model, allowing for a balance between remote work and time spent in your local office. Office locations can be found ON THIS MAP
The Role
We’re recruiting for a Lead Offensive Security Operator here at Justice Digital, to be part of our warm and collaborative Digital Infrastructure and Security Operations Team (DISO) team. The team are responsible for the live services, delivery, product changes and developments for all networking, security, voice, video and hosting services across the MoJ estate.
This role aligns against Penetration Testing Principle from the Government Security Profession.
The Justice Digital team is made up of around 900 digital and technology specialists, located throughout the UK. Our vision is a digitally enabled end-to-end justice system which can adapt and respond to changing needs.
Justice Digital is responsible for all infrastructure, end user computing, onsite support and delivery of technology projects. It has responsibility for 95,000 devices and infrastructure across 900+ sites.
You will be part of a small team of cyber red teaming specialists who provide independent full-spectrum adversary emulation services to security stakeholders within the Ministry of Justice.
You will conduct safe, simulated cyber-attack simulations against our technology estates, acting as a real-world adversary might, to test our defences, highlight weaknesses and contribute cyber security expertise and insight in support of the department’s strategic security decision-making functions. You will be familiar with exploitation methodologies across a wide range of technologies, from classic enterprise technology stacks to modern digital services. You will have a well-developed ability to tactically assess and to execute a diversity of attack types, including chained attacks and evasion techniques, to achieve your desired goal.
To help picture your life at MoJ Justice Digital please take a look at our blog and our Digital and Technology strategy 2025
Key Responsibilities:
• Designing and executing threat intelligence-based full-spectrum cyber-attack simulations, including long-term campaign planning, persistence, and post-exploitation operations against the Ministry of Justice. Adopting a red team approach, discovering high-impact weaknesses across the organisation’s most important technology estates and business areas, and validating whether the overarching cyber security apparatus is working effectively.
• Communicating technical findings in clear risk and impact-focused terms to senior stakeholders, enabling effective understanding and support for strategic decision-making.
• Development and implementation of technology platforms, tools and methodologies to augment and to automate team offensive and analytical capability.
• Mentoring junior Red Team members to improve their skills and capabilities, along with wider knowledge transfer to other security and non-security teams to help build a culture of cyber security in the department.
If this feels like an exciting challenge, something you are enthusiastic about, and want to join our team please read on and apply!
Person Specification
Essential
Proven ability to plan and execute complex, multi-phase operations, including:
• Scenario-driven adversary simulation
• Threat intelligence analysis and assessment
• Exploitation of a wide range of technologies, including infrastructure, web application and cloud platforms.
• Post-exploitation, persistence and lateral movement, including tactical analysis of attack paths leading to high-value targets
• Conducting engagement activities in line with operational security best practice and within a range of threat actor capabilities and tradecraft
How to Apply
Candidates must submit a CV and statement of suitability (of no more than 750 words) via our applicant website Jobtrain, which describes how you meet the requirements set out in the Person Specification above. Applicants who do not submit both a CV and a separate statement of suitability will not be invited to attend an interview.
In Justice Digital, we recruit using a combination of the Government Security Profession and Success Profiles Frameworks. We will assess your Experience, Technical Skills and the following Behaviours during the assessment process:
• Making effective decisions
• Communicating and Influencing
• Delivering at pace
A diverse panel will review your application against the Person Specification above.
Successful candidates who meet the required standard will then be invited to a 1-hour panel interview held via video conference.
Should we receive a high volume of applications, a pre-sift based on the following criteria will be conducted before the sift –
• Proven ability to plan and execute complex, multi-phase operations.
Should you be unsuccessful in the role that you have applied for but demonstrate the capability for a role at a lower level, we reserve the right to discuss this opportunity with you and offer you the position without needing a further application.
A reserve list may be held for up to 12 months, from which further appointments may be made.
Location: National*
Interviews: W/C 14th July (subject to change)
Grade: G7
(MoJ candidates who are on a specialist grade, will be able to retain this grade on lateral transfer)
Salary: National: £56532 - £73450 (which may include an allowance of up to £16918). London: £61201 - £78225 (which may include an allowance of up to £17024).
Working pattern: Full-time, part-time, flexible working, job share.
Contract Type: Permanent.
*We offer a hybrid working model, allowing for a balance between remote work and time spent in your local office. Office locations can be found ON THIS MAP
The Role
We’re recruiting for a Lead Offensive Security Operator here at Justice Digital, to be part of our warm and collaborative Digital Infrastructure and Security Operations Team (DISO) team. The team are responsible for the live services, delivery, product changes and developments for all networking, security, voice, video and hosting services across the MoJ estate.
This role aligns against Penetration Testing Principle from the Government Security Profession.
The Justice Digital team is made up of around 900 digital and technology specialists, located throughout the UK. Our vision is a digitally enabled end-to-end justice system which can adapt and respond to changing needs.
Justice Digital is responsible for all infrastructure, end user computing, onsite support and delivery of technology projects. It has responsibility for 95,000 devices and infrastructure across 900+ sites.
You will be part of a small team of cyber red teaming specialists who provide independent full-spectrum adversary emulation services to security stakeholders within the Ministry of Justice.
You will conduct safe, simulated cyber-attack simulations against our technology estates, acting as a real-world adversary might, to test our defences, highlight weaknesses and contribute cyber security expertise and insight in support of the department’s strategic security decision-making functions. You will be familiar with exploitation methodologies across a wide range of technologies, from classic enterprise technology stacks to modern digital services. You will have a well-developed ability to tactically assess and to execute a diversity of attack types, including chained attacks and evasion techniques, to achieve your desired goal.
To help picture your life at MoJ Justice Digital please take a look at our blog and our Digital and Technology strategy 2025
Key Responsibilities:
• Designing and executing threat intelligence-based full-spectrum cyber-attack simulations, including long-term campaign planning, persistence, and post-exploitation operations against the Ministry of Justice. Adopting a red team approach, discovering high-impact weaknesses across the organisation’s most important technology estates and business areas, and validating whether the overarching cyber security apparatus is working effectively.
• Communicating technical findings in clear risk and impact-focused terms to senior stakeholders, enabling effective understanding and support for strategic decision-making.
• Development and implementation of technology platforms, tools and methodologies to augment and to automate team offensive and analytical capability.
• Mentoring junior Red Team members to improve their skills and capabilities, along with wider knowledge transfer to other security and non-security teams to help build a culture of cyber security in the department.
If this feels like an exciting challenge, something you are enthusiastic about, and want to join our team please read on and apply!
Person Specification
Essential
Proven ability to plan and execute complex, multi-phase operations, including:
• Scenario-driven adversary simulation
• Threat intelligence analysis and assessment
• Exploitation of a wide range of technologies, including infrastructure, web application and cloud platforms.
• Post-exploitation, persistence and lateral movement, including tactical analysis of attack paths leading to high-value targets
• Conducting engagement activities in line with operational security best practice and within a range of threat actor capabilities and tradecraft
How to Apply
Candidates must submit a CV and statement of suitability (of no more than 750 words) via our applicant website Jobtrain, which describes how you meet the requirements set out in the Person Specification above. Applicants who do not submit both a CV and a separate statement of suitability will not be invited to attend an interview.
In Justice Digital, we recruit using a combination of the Government Security Profession and Success Profiles Frameworks. We will assess your Experience, Technical Skills and the following Behaviours during the assessment process:
• Making effective decisions
• Communicating and Influencing
• Delivering at pace
A diverse panel will review your application against the Person Specification above.
Successful candidates who meet the required standard will then be invited to a 1-hour panel interview held via video conference.
Should we receive a high volume of applications, a pre-sift based on the following criteria will be conducted before the sift –
• Proven ability to plan and execute complex, multi-phase operations.
Should you be unsuccessful in the role that you have applied for but demonstrate the capability for a role at a lower level, we reserve the right to discuss this opportunity with you and offer you the position without needing a further application.
A reserve list may be held for up to 12 months, from which further appointments may be made.