Cyber Security Analyst

The Security Monitoring & Investigations Team (SMI) is part of the DWP Cyber Resilience Centre, and it plays a vital role in securing the DWP estate; ensuring that service delivery is not affected by potential malicious activity from either internal or external threat actors. The team operates in a dynamic environment at the forefront of the Departments cyber protection capability. This role is for a first line monitoring analyst who will have responsibility for the initial triage of security alerts generated from across the DWP estate.

Working as a Security Alert Analyst you will monitor systems to detect potential indicators of compromise. You will lead the first stage categorisation and investigation of security alerts generated by analytical tools and capabilities operating across DWP systems and networks. You will be responsible for interpreting reports and dashboards and, using your knowledge of security risks and latest cyber intelligence, will ensure an effective response to alerts. Where appropriate you will escalate potential incidents, collating and presenting all necessary information to others, to enable immediate and accurate investigations. You will use malware analysis tools as appropriate to support your decision-making. You will support the development of theoretical rules to test and deploy across large data sets and will continually review and refine those rules to ensure high quality outputs are maintained and supplied to operational stakeholders.

Successful candidates can expect to be involved in a range of activities including the following:

• Effectively use security tooling including Security Information and Event Management (SIEM) platforms and open-source intelligence, to identify security compromises within large amounts of complex data.
• Provide in-depth analysis of reports and dashboards and respond to alerts generated by the latest analytical tools and capabilities operating across machine data within DWP systems.
• Demonstrate knowledge of the latest security threats and indicators of compromise, to ensure an effective response to alerts as well as to new threats and attack vectors.
• Undertake proactive interrogation of activity captured in system logs and across large data sets to quickly determine if systems have been compromised.
• Use intelligence effectively to ensure appropriate response actions to security threats.
• Provide cyber security specific input to investigations through the application of technical knowledge and exploitation of cyber intelligence.
• Use malware analysis tools (commercial and/or open source) to support analysis and decision making.
• Work within the confines of relevant legislation as it applies to cyber security and digital forensics activities.
• Provide timely intervention to protect the DWP IT estate through initiating containment processes to isolate and prevent the spread of malware.
• Drive forward the development of monitoring systems and supporting processes and playbooks, ensuring systems are in place to review and continually improve existing capabilities.
• Demonstrate strong knowledge and understanding of the concepts of information security, and of current and emerging IT security, data protection and information risk principles and technologies.
• Ensure that all team activities comply with legal and internal requirements and that all evidence produced from investigations is suitable for use in disciplinary or legal actions.
• Ensure the Departments data is used safely, proportionately, and legally at all times.
• Support remedial activity as a result of identified weaknesses within the estate.
• Manage multiple priorities and respond flexibly to competing demands.

Essential criteria:

• Experience of working in a cyber security or IT based role or have completed, or be working towards completion of, a cyber focused qualification.
• Familiar with SIEM products and an understanding of their capabilities as monitoring tools and how they can be used to identify security or data compromises.
• Experience of working in an operationally focused delivery team, with the ability to manage multiple priorities and respond flexibly to competing demands and organise work accordingly.
• Demonstrable aptitude for analytical work including using data from a variety of sources and in different formats to draw conclusions.
• Good knowledge of cyber security threats and how to mitigate against them.

Desirable:

• Experience in handling and categorising security alerts.

Benefits:

Alongside your salary of £37,497, Department for Work and Pensions contributes £10,862 towards you being a member. DWP have a broad benefits package built around your work-life balance which includes:

• Working patterns to support work/life balance such as job sharing, term-time working, flexi-time and compressed hours.
• Generous annual leave at least 23 days on entry, increasing up to 30 days over time (prorata for part time employees), plus 9 days public and privilege leave.
• Support for financial wellbeing, including interest-free season ticket loans for travel, a cycle to work scheme and an employee discount scheme.
• Health and wellbeing support including our Employee Assistance Programme for specialist advice and counselling and the opportunity to join HASSRA a first-class programme of competitions, activities and benefits for its members (subscription payable monthly).
• Family friendly policies including enhanced maternity and shared parental leave pay after 1 years continuous service.
• Funded learning and development to support progress in your role and career. This includes industry recognised qualifications and accreditations, coaching, mentoring and talent development programmes.
• An inclusive and diverse environment with opportunities to join professional and interpersonal networks including Womens Network, National Race Network, National Disability Network (THRIVE) and many more.