Head of Protective Monitoring and Incident Response
| Posting date: | 10 October 2025 |
|---|---|
| Salary: | £73,900 per year, pro rata |
| Hours: | Full time |
| Closing date: | 23 October 2025 |
| Location: | Cardiff, Cardiff County |
| Remote working: | Hybrid - work remotely up to 2 days per week |
| Company: | Government Recruitment Service |
| Job type: | Permanent |
| Job reference: | 432508 |
Summary
As the Head of Protective Monitoring and Incident Response your main day-to-day responsibilities will include;
Developing strategies to detect and respond to cyber threats, aligned with business objectives, risk appetite, and continuity planning.
Creating, reviewing and updating cyber policies, standards and processes in line with regulatory and industry requirements, overseeing their implementation.
Managing the technical response to cyber security incidents, engaging with stakeholder across the CSOC and department to identify, contain and help recover from threats.
Managing the full incident response lifecycle, ensuring effective communication with cross-government stakeholders; leading post-incident reviews and implementing exercising strategies to maintain organisational resilience.
Determining and managing resources, including budget, personnel and technology; driving continuous improvement to address emerging threats and best practice.
Developing and reviewing strategic, operational and technical KPIs and KRIs to inform decision-making.
Leading the detect and response team, supporting professional development, and ensuring service readiness.
The successful candidate will be expected to work full-time (37 hours per week), in line with the requirements of the role.
Due to the 24/7 nature of the Cyber Security Operations Centre, this role will at times,
require some out of hours and on call availability.
Hybrid Working
Developing strategies to detect and respond to cyber threats, aligned with business objectives, risk appetite, and continuity planning.
Creating, reviewing and updating cyber policies, standards and processes in line with regulatory and industry requirements, overseeing their implementation.
Managing the technical response to cyber security incidents, engaging with stakeholder across the CSOC and department to identify, contain and help recover from threats.
Managing the full incident response lifecycle, ensuring effective communication with cross-government stakeholders; leading post-incident reviews and implementing exercising strategies to maintain organisational resilience.
Determining and managing resources, including budget, personnel and technology; driving continuous improvement to address emerging threats and best practice.
Developing and reviewing strategic, operational and technical KPIs and KRIs to inform decision-making.
Leading the detect and response team, supporting professional development, and ensuring service readiness.
The successful candidate will be expected to work full-time (37 hours per week), in line with the requirements of the role.
Due to the 24/7 nature of the Cyber Security Operations Centre, this role will at times,
require some out of hours and on call availability.
Hybrid Working
Proud member of the Disability Confident employer scheme
Disability Confident
About Disability Confident
A Disability Confident employer will generally offer an interview to any applicant that declares they have a disability and meets the minimum criteria for the job as defined by the employer. It is important to note that in certain recruitment situations such as high-volume, seasonal and high-peak times, the employer may wish to limit the overall numbers of interviews offered to both disabled people and non-disabled people. For more details please go to Disability Confident.