Senior Response Manager - Home Office Cyber Security Operations Centre

Home Office Digital designs, builds and develops services for the rest of the department and for government. Every year our systems support up to 3 million visa applications, checks on 100 million border crossings, up to 8 million passport applications and deliver 140 million police checks on people, vehicles and property.

As a Senior Response Manager within the Home Office Cyber Security Operations Centre (CSOC) you will be expected to plan, implement and operate capabilities to detect, contain and remediate incidents, identify opportunities to improve detection, response and automation capabilities. You will also support organisational readiness through co-ordinating preparedness exercises and red team activity. The Response function also advises product and service owners on potential mitigations and supports the continuous improvement of security operations through monitoring, detection and standardisation of security practices.

You’ll be joining an expert team of cyber professionals, committed to reducing the exposure to cyber-attack of new and existing digital systems. You’ll be aided in your role by a diverse and supportive organisational culture, and a commitment to further your continuous development.

Where business needs allow, some roles may be suitable for a combination of office and home-based working. Where this is the case, employees will be expected to spend a minimum of 60% of their working time in the office. Applicants can raise any queries to the email address at the bottom of the advert.

Watch this short video to hear from members of Home Office Digital talking about the projects they work on and their experience of working here: Working for Home Office Digital., You will work with SOC teams and other business areas to improve incident handling, implement complex solutions for emerging threats, contribute to relevant standards and process improvements, and reduce operational effort and future risk., As a Senior Response Manager in either of these roles your main responsibilities will be to;

• Carry out security monitoring, detection and response activities in line with agreed standards, providing advice on mitigation, escalation and risk reduction.
• Identify, analyse and investigate indicators of malicious activity across networks, systems and applications, supporting effective threat detection and incident response.
• Triage security events and alerts, supporting investigations and recommending improvements to monitoring controls, detection coverage and overall security posture.
• Support incident response activities, including red teaming and threat hunting exercises, communicating investigation outcomes and contributing to lessons learned and post-incident reviews.
• Develop, review and continuously improve monitoring use cases, detection content and alert effectiveness across a range of security technologies.
• Define and enhance processes, tooling and security controls to identify emerging threats, strengthen detection capabilities and implement effective mitigation strategies.
• Drive service and process improvements by applying industry best practice, sound judgement and problem-solving skills to support efficient security operations and investigations.

Working Pattern

This role is available on a full-time basis with the option of compressed hours working. This role is also suitable for part-time working hours, with a minimum requirement to work 4 days/ 30 hours per week due to business requirements., Candidates reaching the required standard will then be invited to attend an interview. The interview will assess your Technical Skills (SFIA Framework) using technical-based questions. Prior to the interview, candidates will be provided with a technical scenario and asked to submit their response for review by the interview panel. The panel will assess the submission in advance, and candidates should be prepared to discuss their approach, rationale, and responses in more detail during the interview. Questions relating to the scenario will form part of the interview assessment. Further details of the scenario and timescales will be provided to you as part of your invitation to interview before your interview.

If you are invited to an interview, you will be required to bring a range of documentation for the purposes of establishing identity and to aid any pre-employment checks. Please see the attached list of Home Office acceptable ID documents.

Sift and Interview dates

The sift will commence from 14 August 2026.

Interviews are expected to take place from 1 September 2026. (Subject to the Panel’s operational requirements/priorities).

Interviews will be conducted remotely via MS Teams.

We will try to meet the dates set out in the advert. There may be occasions when these dates will change. You will be provided with sufficient notice of the confirmed dates., The allowance values are set by the Home Office, subject to remaining in a qualifying role. This allowance is non-contractual, subject to an annual review and could be withdrawn at any time.

For both new entrants and existing civil servants, the total compensation offer is a combination of base salary and, if applicable, a capability-based allowance. The pay ranges for this role are National: £49,850 - £52,850. New entrants to the Civil Service will start on the pay range minimum. For existing civil servants, our policies on level transfer and promotion will apply.

Reasonable Adjustments

If a person with disabilities is at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.

If you need a change to be made so that you can make your application, you should:

• Contact Government Recruitment Service via HOrecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.
• Complete the “Assistance Required” section in the “Additional Requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you are deaf, a language service professional.

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the ‘Contact point for applicants’ section.

Feedback Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a criminal record check. Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check .

See our vetting charter . People working with government assets must complete baseline personnel security standard (opens in new window) checks., * UK nationals

• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

You will have a demonstrable passion for Cyber Security, Detection and Response with the following skills, knowledge or experience;

As a Senior Technical Detection Analyst

• Conducting investigations and working in a ‘Security Operations Centre’ environment, including the identification and analysis of potentially malicious activity.
• Developing, maintaining or improving SIEM monitoring and detection content, using threat intelligence and operational insights to improve detection coverage, accuracy and the identification of cyber threats.

As a Senior SOAR & DaC Analyst

• Conducting investigations and working in a ‘Security Operations Centre’ environment, supporting security operations and incident response activities.
• Designing, developing, testing maintaining and improving security automation workflows, response playbooks and integrations using SOAR platforms or comparable automation technologies, while applying DaC methodologies.

Additionally, for both roles, experience of;

• Communicating in a verbal and written manner, and a good understanding of the use of different channels and formats for different audiences
• Building strong partnerships with peers across an organisation and navigating the complex landscape of technologies, 3rd party suppliers, and other teams
• Managing a team in a technical environment

SFIA capability framework

Skills for the Information Age (SFIA) version 8 is the technical framework that sets the standard capability and development of all levels in the Home Office. This is a link to the capability framework: All skills A - Z English (sfia-online.org).

We use set SFIA technical skills to form our interview questions and we will assess you against these technical skills during the selection process.

The essential skills listed above are reflective of the Home Office Government Digital and Data Profession Career Framework (based on the industry standard SFIA framework). Use the SFIA Levels of responsibility to understand what would be expected for each technical skills listed below.

Delivery and Operation

• Service Management
• Incident management (USUP) – Level 3
• Problem management (PBMG) – Level 3
• Security Services
• Security operations (SCAD) – Level 3

People and skills

• People management
• Performance management (PEMT) – Level 3 (Generic Level 3 descriptor)
• Resourcing (RESC) – Level 3

Relationships and engagement

• Stakeholder management
• Stakeholder relationship management (RLMT) – Level 3 (Generic Level 3 descriptor)

Technical skills

We’ll assess you against these technical skills during the selection process:

• Incident management (USUP) – Level 3
• Problem management (PBMG) – Level 3
• Security operations (SCAD) – Level 3
• Performance management (PEMT) – Level 3
• Resourcing (RESC) – Level 3
• Stakeholder relationship management (RLMT) – Level 3, For meaningful security checks to be carried out, individuals need to have lived in the UK for a sufficient period of time. Learn more on our website. Security Checks - Home Office Careers.

Please note that this role requires Security Check (SC) clearance, which would normally need 5 years’ UK residency in the past 5 years.

However, in exceptional circumstances security clearance applications for candidates who have been present in the UK for at least 3 of the last 5 years may be considered. Failure to meet this residency requirement will result in your security clearance application being rejected., We are unable to sponsor any individuals via Skilled Worker Sponsorship / Tier 2 (General) work visas as we do not hold a UK Visa & Immigration (UKVI) Skilled Worker License.

Pulled from the full job description

• Annual leave
• Company pension, £49,850 New entrants to the Civil Service will start their role on the salary band minimum £49,850 for National roles.

You may also be eligible for an additional non-pensionable allowance, pending a Capability and Skills Assessment, with a value of up to £7,750. A Civil Service Pension with an employer contribution of 28.97% GBP, Alongside your salary of £49,850, Home Office contributes £14,441 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides .

Why work for us…

Find out more information at: Benefits - Home Office Careers, but some of the primary ones are:

• A Civil Service Pension with employer contribution rates of at least 28.97%.
• In-year reward scheme for one-off or sustained exceptional personal or team achievements.
• 25 days annual leave on appointment, rising with service.
• 8 days of public holidays, plus 1 additional privilege day.
• Where business needs allow, some roles may be suitable for a combination of office and home-based working. This is a non-contractual arrangement where all employees will be expected to spend a minimum of 60% of their working time in an office., If you feel that your application has not been treated in accordance with the Civil Service Recruitment Principles. and you wish to make a complaint, then contact the Government Recruitment Service via HOrecruitment.grs@cabinetoffice.gov.uk. If you are not satisfied with the response that you receive, then you can contact the Civil Service Commission.