Cyber Security Monitoring & Investigations - Security Threat Detection Analyst
| Posting date: | 09 September 2025 |
|---|---|
| Salary: | £44,447 to £46,547 per year |
| Additional salary information: | This post currently attracts a Recruitment and Retention Addition of £5,200. |
| Hours: | Full time |
| Closing date: | 22 September 2025 |
| Location: | Leeds |
| Company: | Government Recruitment Service |
| Job type: | Permanent |
| Job reference: | 422051/2 |
Summary
You will provide comprehensive analysis of security events and will operate as a second tier escalation point for the clearance of security alerts that have been triaged by others. This includes undertaking proactive analysis of activity captured in system logs, to quickly determine if systems have been compromised.
You will support the DWP Security Incident Response Team by providing detailed technical input to on-going investigations in relation to the mitigation, detection and response to potential cyber-attacks. You will provide support and technical guidance to Tier 1 analysts in the investigation of security alerts and will drive forward the continual improvement of monitoring systems and processes. You will have line management responsibility for a number of HEO analysts.
Working as a Security Threat Detection Analyst in the Cyber Security Monitoring and Investigations team, you will be part of an innovative and service-orientated team of analysts, focused on the detection and investigation of potential indicators of compromise and malicious activity on DWP systems and devices. Your main responsibilities will be to:
- Provide a second-tier escalation function for the resolution of security events that have been triaged by others, providing direction and guidance, and ensuring an effective response to alerts and risks as they are identified.
- Undertake comprehensive investigation of security alerts as well as proactive analysis of activity captured in system logs and security tools, to quickly determine if systems have been compromised.
- Support Intelligence Analysts and the Security Incident Response Team, by providing detailed technical input to on-going investigations, building on detailed log data, digital outputs, and threat intelligence in relation to the mitigation, detection and response to potential cyber-attacks.
- Effectively use the latest analytical SIEM tools including open-source intelligence to identify security compromises within large amounts of complex data.
- Use malware analysis tools (commercial and/or open source) to support analysis and decision making.
- Demonstrate strong knowledge of the latest security threats and indicators of compromise to ensure a robust response to new threats and attack vectors.
- Provide timely intervention to protect the DWP IT Estate through recommending and operating containment processes to isolate and prevent the spread of malware.
- Drive forward the development of monitoring systems and supporting processes and playbooks, ensuring systems are in place to review and continually improve existing capabilities.
- Ensure intelligence is effectively used to maintain the integrity of alerts and to ensure alerts continue to remain relevant and focused on the latest threats.
- Develop influential relationships with key stakeholders across the Department to support improvement activity thereby mitigating the risks from malicious activity.
- Demonstrate strong knowledge and understanding of the concepts of information security, and of current and emerging IT security, data protection and information risk principles and technologies.
- Support the transformation of the Department’s response to digital delivery and the security threats this presents; including operating new analytical tools to generate innovative security alerts.
- Support remedial activity as a result of identified weaknesses within the estate.
- Manage multiple priorities and respond flexibly to competing demands.
- Line management of Tier 1 analysts.
The Cyber Security Monitoring & Investigations team operates 24 hours a day, 7 days a week and as a result, post holders may be required to work outside of usual office hours as the work dictates.
Proud member of the Disability Confident employer scheme