Incident Response Principal Analyst

Location: National (London: 10 South Colonnade, E14 4PU). Closing date: 28 May 2026. Grade: 7. Contract type: Permanent. Working pattern – full‑time, part‑time or flexible. Number of vacancies: 2. Only current Justice Digital, Data and Science staff or national candidates will be considered for the London location. All applicants must pass a Security Check clearance.

The Role

We are recruiting two Principal Analysts – Detect and Respond – to join the Security Operations Centre (SOC). The role requires leading and mentoring a SOC team and providing leadership and direction to the incident response function.

Key Responsibilities

• Lead SOC incident response.
• Lead and mentor Security Analysts to support effective incident management.
• Oversee the investigation and escalation of security incidents according to established procedures.
• Represent the SOC on Major Incident Bridge Calls, directing SOC effort as required.
• Identify and drive implementation of necessary adjustments to MOJ cyber incident response strategies and processes.
• Drive development and maintenance of SOC playbooks and procedures for efficient incident response.
• Identify and use metrics to analyse trends and generate security reports, and identify risks and areas for improvement.
• Support fostering a collaborative and high‑performing team environment, providing coaching and development opportunities for junior team members.
• Develop goals and performance metrics for incident response in line with business needs.

Person Specification

Essential

• Proven experience leading and mentoring a security analyst team.
• Proven experience managing cyber security incidents.
• Substantial experience in a Security Operations Centre (SOC) environment.
• Strong understanding of security best practices, frameworks (MITRE ATT&CK, etc.) and incident response methodologies.
• Excellent analytical, problem‑solving and decision‑making skills.
• Effective communication and collaboration skills.
• Ability to work effectively under pressure and manage multiple tasks simultaneously.
• Strong understanding of security risk and how it is applied to incident management.
• Willingness to be assessed against the requirements for SC clearance.

EEO Statement

We welcome the unique contribution diverse applicants bring and do not discriminate based on culture, ethnicity, race, nationality or national origin, age, sex, gender identity or expression, religion or belief, disability status, sexual orientation, educational or social background or any other factor.

Benefits

• A generous employer pension contribution of 28.97% through the Civil Service Pension Scheme.
• 25 days of annual leave (increasing to 30 days after 5 years of service), plus 8 bank holidays and a privilege day for the King's birthday.
• Flexible working arrangements including hybrid working, part‑time or compressed hours.
• Employees are allocated 10% of their working time for personal and professional development.
• A £1,000 per person learning budget, with access to conferences, seminars, professional accreditation, vocational programmes and e‑learning platforms.
• Compassionate maternity, adoption, and shared parental leave policies, up to 26 weeks leave at full pay, 13 weeks with partial pay, and 13 weeks further leave.
• Maternity and paternity leave at full pay for 2 weeks.

Salary Information

Base salary for this role is from National: £58,511–£73,450, which may include an allowance up to £14,939. London: £63,343–£78,225, which may include an allowance up to £14,882. New entrants to the Civil Service joining the MoJ are expected to start at the minimum of the pay band. Existing Civil Servants moving on a level transfer will retain their current base salary or move to the minimum of the pay band for the role, whichever is higher. Existing Civil Servants who are promoted will either move to the bottom of the new grade's pay band or receive a 10% uplift, whichever provides the greater increase. Candidates may also be eligible for a non‑pensionable Government Digital & Data Allowance of up to £14,882 per year (London) or £14,939 (National). This allowance is temporary, reviewed annually and may be retained, amended or withdrawn.