Senior Response Manager - Senior SOAR & Detection-as-Code (DaC) Analyst - Home Office Cyber Security in Sheffield

Location: Peterborough; Salford; SheffieldSalary: 49,850 - 52,850 per yearEmployment: FlexibleCategory: Director Of ITPosted: Valid to: Employer: Home OfficeJob summaryHome Office Digital designs, builds and develops services for the rest of the department and for government. Every year our systems support up to 3 million visa applications, checks on 100 million border crossings, up to 8 million passport applications and deliver 140 million police checks on people, vehicles and property.As a Senior Response Manager within the Home Office Cyber Security Operations Centre (CSOC) you will be expected to plan, implement and operate capabilities to detect, contain and remediate incidents, identify opportunities to improve detection, response and automation capabilities. You will also support organisational readiness through co-ordinating preparedness exercises and red team activity. The Response function also advises product and service owners on potential mitigations and supports the continuous improvement of security operations through monitoring, detection and standardisation of security practices.You’ll be joining an expert team of cyber professionals, committed to reducing the exposure to cyber-attack of new and existing digital systems. You’ll be aided in your role by a diverse and supportive organisational culture, and a commitment to further your continuous development.Where business needs allow, some roles may be suitable for a combination of office and home-based working. Where this is the case, employees will be expected to spend a minimum of 60% of their working time in the office. Applicants can raise any queries to the email address at the bottom of the advert. Watch this short video to hear from members of Home Office Digital talking about the projects they work on and their experience of working here: Working for Home Office Digital.Job descriptionWe are seeking a Senior Response Manager to join the Cyber Security Operations Centre (CSOC) as a Senior SOAR & Detection-as-Code (DaC) Analyst. This role focuses on improving cyber detection, response and automation capabilities through security automation, response playbooks and Detection-as-Code practices. You will design, develop, test, maintain and improve security automation workflows, response playbooks and integrations using SOAR platforms or comparable automation technologies, while applying structured and repeatable DaC methodologies.You will work with SOC teams and other business areas to improve incident handling, implement complex solutions for emerging threats, contribute to relevant standards and process improvements, and reduce operational effort and future risk.As a Senior Response Manager your main responsibilities will be to;Carry out security monitoring, detection and response activities in line with agreed standards, providing advice on mitigation, escalation and risk reduction.Identify, analyse and investigate indicators of malicious activity across networks, systems and applications, supporting effective threat detection and incident response.Triage security events and alerts, supporting investigations and recommending improvements to monitoring controls, detection coverage and overall security posture.Support incident response activities, including red teaming and threat hunting exercises, communicating investigation outcomes and contributing to lessons learned and post-incident reviews.Develop, review and continuously improve monitoring use cases, detection content and alert effectiveness across a range of security technologies.Define and enhance processes, tooling and security controls to identify emerging threats, strengthen detection capabilities and implement effective mitigation strategies.Drive service and process improvements by applying industry best practice, sound judgement and problem-solving skills to support efficient security operations and investigations.Working PatternThis role is available on a full-time basis with the option of compressed hours working. This role is also suitable for part-time working hours, with a minimum requirement to work 4 days/ 30 hours per week due to business requirements. Person specificationEssential SkillsYou will have a demonstrable passion for Cyber Security, Detection and Responsewith the following skills, knowledge or experience; Conducting investigations and working in a ‘Security Operations Centre’ environment, supporting security operations and incident response activities.Designing, developing, testing maintaining and improving security automation workflows, response playbooks and integrations using SOAR platforms or comparable automation technologies, while applying DaC methodologies. Communicating in a verbal and written manner, and a good understanding of the use of different channels and formats for different audiences.Building strong partnerships with peers across an organisation and navigating the complex landscape of technologies, 3rd party suppliers, and other teams.Managing a team in a technical environment.SFIA capability frameworkSkills for the Information Age (SFIA) version 8 is the technical framework that sets the standard capability and development of all levels in the Home Office. This is a link to the capability framework: All skills A - Z English (sfia-online.org). We use set SFIA technical skills to form our interview questions and we will assess you against these technical skills during the selection process. The essential skills listed above are reflective of the Home Office Government Digital and Data Profession Career Framework (based on the industry standard SFIA framework). Use the SFIA Levels of responsibility to understand what would be expected for each technical skills listed below. Delivery and OperationService Management Incident management (USUP) – Level 3Problem management (PBMG) – Level 3Security Services Security operations (SCAD) – Level 3People and skillsPeople management Performance management (PEMT) – Level 3 (Generic Level 3 descriptor)Resourcing (RESC) – Level 3Relationships and engagementStakeholder management Stakeholder relationship management (RLMT) – Level 3 (Generic Level 3 descriptor)Technical skillsWe'll assess you against these technical skills during the selection process:Incident management (USUP) – Level 3Problem management (PBMG) – Level 3Security operations (SCAD) – Level 3Performance management (PEMT) – Level 3Resourcing (RESC) – Level 3Stakeholder relationship management (RLMT) – Level 3BenefitsAlongside your salary of 49,850, Home Office contributes 14,441 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).Why work for us...Find out more information at: Benefits - Home Office Careers, but some of the primary ones are: A Civil Service Pension with employer contribution rates of at least 28.97%. In-year reward scheme for one-off or sustained exceptional personal or team achievements. 25 days annual leave on appointment, rising with service. 8 days of public holidays, plus 1 additional privilege day. Where business needs allow, some roles may be suitable for a combination of office and home-based working. This is a non-contractual arrangement where all employees will be expected to spend a minimum of 60% of their working time in an office. Sign-up on our website to receive emails with information about careers at the Home Office. Things you need to knowArtificial intelligenceArtificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.Selection process detailsThis vacancy is using Success Profiles (opens in a new window), and will assess your Experience and Technical skills.As part of the application process, you will be asked to complete a CV and 1000-word personal statement: CV – include a brief employment history outlining for each role, the organisation, job title, dates in post, and key responsibilities and achievements. Any recent employment gaps should be explained. A second section should set out the skills and experience most relevant to this role, drawing on your career, training, and other relevant activities without repeating the employment history. Focus on the evidence that best demonstrates your capability to meet the role requirements. Personal statement - this should present a clear and coherent narrative explaining why you are applying, what you would bring to the role, and how your experience meets the essential criteria. Use well‑chosen examples to illustrate your impact, drawing on STAR‑style thinking where helpful, but ensure the statement reads as a single, flowing document rather than a set of isolated responses. To ensure you are assessed on merit alone, we ask you to anonymise your application. This means removing personal identifiers such as your name, age, and place of education. You do not need to remove your employment history, job titles, or any information about your work. Watch our three short videos on how to apply for our roles: Applying - Home Office Careers.Problems during the application processIf you experience problems accessing this advert, or you think you’ve made a mistake on an initial application, please contact , including the vacancy reference, at least two working days before the vacancy closes. Further information can be found on our website. Do not create or attempt to submit another application, online test or use a different Civil Service Jobs