Head of Security Incident and Response

The Head of Security Incident and Response provides operational leadership of the Defra Group Security Incident Response Management (SIRM) capability, ensuring the organisation is prepared for, and able to respond effectively to, security incidents ranging from routine events to significant security incidents.

As the senior lead for security incident management, the role oversees incident response policy, governance and operational coordination, directs the response to complex and high-impact incidents, and provides authoritative advice and recommendations to senior stakeholders.

Operating across the Defra Group, the postholder ensures a consistent, risk-based approach to incident management, protecting organisational assets, maintaining stakeholder confidence, and supporting the resilience of critical services and business operations.

The role leads the Defra Group’s approach to security investigations, including unauthorised disclosure cases, ensuring robust governance, effective investigative oversight, and informed decision-making by senior stakeholders

Please note for this role you will require SC Clearance. To gain SC clearance all applicants are required to have been a UK resident for a minimum of 5 years. If this requirement is not met, the individual will not be able to progress their application further., * Define and maintain Security Incident Response Management playbooks for Defra group, providing clear policy, process, responsibilities, and governance for tackling security incidents across core Defra, agencies and ALBs.

• Coordinate across all parts of Defra group to draw on best practice, align Security Incident Response Management processes and integrate with group level approach.
• Lead on security incident response management relating to all levels of incidents, including dealing with complex and varied situations where no clear guidance is available, assimilating available information and making clearly reasoned recommendations to senior stakeholders.
• Responsible for performance of the Security Incident Response Management team including all decision-making associated work allocation and completion of all activities.
• Report on security incidents to security governance groups, including agreeing reporting processes and thresholds will all areas of the business, and overseeing analysis, identification of trends and root cause analysis.
• Coordinate and lead Security Incident Response exercises across physical, personnel, information and cyber security incidents.
• Lead on investigation of leaks and other security breaches on behalf of Defra group, conducting investigations in accordance with policy and in collaboration with Cabinet Office where appropriate., If successful and transferring from another Government Department a criminal record check may be carried out.

In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service on your behalf.

However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.

Internal Fraud Database Check

Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment.

A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.

Higher Security Clearance

All of these posts require the successful candidate to hold SC security clearance. Job offers to these posts are made on the basis of merit. Security vetting will only take place after the receipt of a job offer.

For further information on National Security Vetting please visit the Demystifying Vetting website.

Feedback Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a criminal record check. Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check .

See our vetting charter . People working with government assets must complete baseline personnel security standard (opens in new window) checks.

• Demonstrable experience of managing security incidents and providing advice across multiple security disciplines, including physical security, personnel security, information security, risk management, data protection and cyber security.
• Ability to build and maintain effective relationships across organisational boundaries, including with senior stakeholders, security teams, law enforcement partners and the wider UK security community.
• Strong analytical skills, with the ability to interpret complex information and provide clear, evidence-based advice and recommendations.
• Proven ability to think strategically, identify emerging risks and opportunities, and ensure delivery aligns with evolving business and security priorities.
• Experience of managing complex and diverse workloads, coordinating activity across multiple teams, and overseeing sensitive investigations and incident responses.
• Experience of leading teams and influencing outcomes in high-pressure environments where decisions often need to be made with incomplete information.
• Proven experience in protective, cyber and/or information security, together with a recognised professional qualification (e.g. CISMP, CSMP, CPP, CISM, BCI or equivalent), or evidence of working towards achieving such a qualification., * Making Effective Decisions
• Leadership
• Communicating and Influencing, As part of the pre-employment process for this post, successful candidate(s) will be able to agree a contractual workplace from those locations listed in this advert. The agreed contractual workplace is then the substantive and permanent place of work for the successful candidate(s).

Where the location is ‘National’ the successful appointee should discuss and agree an appropriate contractual location in line with both Defra’s location policy and site capacity, prior to proceeding with pre-employment processes.

The agreed amount of time spent at a workplace for this post will reflect the requirement for Civil Servants to spend at least 60% of their working time in an organisation workplace with the option to work the remaining time flexibly from home. Working time spent at a workplace may include time spent at other organisational locations including field-based operational locations, together with supplier, customer or partner locations. This is a non-contractual agreement which is consistent with common Civil Service expectations.

Travel costs to non-contractual workplaces will be subject to departmental travel and subsistence policies. Travel costs to contractual workplaces are the responsibility of the employee.

The successful candidate is required to carry out all their duties from a UK location, and cannot do so from an overseas location at any time., Please take note that Defra does not hold a UK Visa & Immigration (UKVI) Skilled Worker License sponsor and are unable to sponsor any individuals for Skilled Worker Sponsorship.

£56,375 - £69,105 Grade 7 National: £56,375 - £62,830 London: £62,000 - £69,105, plus industry leading pension and benefits. For details of our pay on appointment policy, please see below under the heading ‘Salary’. A Civil Service Pension with an employer contribution of 28.97% GBP, Alongside your salary of £56,375, Department for Environment, Food and Rural Affairs contributes £16,331 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides .

• Learning and development tailored to your role
• An environment with flexible working options
• A culture encouraging inclusion and diversity
• A Civil Service pension with an employer contribution of 28.97%, New entrants to the Civil Service are expected to start on the minimum of the pay band. The internal roles rules apply to existing Civil Servants, i.e. level transfers move on current salary or the pay range minimum, transfers on promotion move to new pay range minimum or receive 10% increase. Either case is determined by whichever is the highest.

Reasonable adjustment

If a person with disabilities is put at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.

Defra is the UK government department responsible for safeguarding our natural environment, supporting our world-leading food and farming industry, and sustaining a thriving rural economy. Our broad remit means we play a major role in people’s day-to-day life, from the food we eat, and the air we breathe, to the water we drink.

Digital, Data, Technology and Security (DDTS) is the trusted team for digital across the entire Defra Group.

We have around 1000 colleagues across DDTS and our ambition is to make it easier and faster than ever for people to interact with Defra. If you are ready to drive innovation and push boundaries, we want to hear from you. Join us and together we will create a great place for living, and a green and healthy future for all.