> Markdown version of [/jobs/ext/2425850-head-of-security-incident-and-response](https://www.wearedevelopers.com/jobs/ext/2425850-head-of-security-incident-and-response). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Head of Security Incident and Response - **Company:** Department for Environment, Food & Rural Affairs (DEFRA) - **Location:** Newcastle upon Tyne, UK (Remote available) - **Experience:** Expert - **Salary:** £56,375.0 - £69,105.0 - **Contract:** Permanent contract - **Skills:** C++ (Programming Language), Cyber Security, Databases, Base Calling Interface, SC Clearance - **Published:** August 5, 2026 - **Apply:** https://uk.indeed.com/viewjob?jk=f88ed85ec16373a2 ## About the Role * Demonstrable experience of managing security incidents and providing advice across multiple security disciplines, including physical security, personnel security, information security, risk management, data protection and cyber security. * Ability to build and maintain effective relationships across organisational boundaries, including with senior stakeholders, security teams, law enforcement partners and the wider UK security community. * Strong analytical skills, with the ability to interpret complex information and provide clear, evidence-based advice and recommendations. * Proven ability to think strategically, identify emerging risks and opportunities, and ensure delivery aligns with evolving business and security priorities. * Experience of managing complex and diverse workloads, coordinating activity across multiple teams, and overseeing sensitive investigations and incident responses. * Experience of leading teams and influencing outcomes in high-pressure environments where decisions often need to be made with incomplete information. * Proven experience in protective, cyber and/or information security, together with a recognised professional qualification (e.g. CISMP, CSMP, CPP, CISM, BCI or equivalent), or evidence of working towards achieving such a qualification., * Making Effective Decisions * Leadership * Communicating and Influencing, As part of the pre-employment process for this post, successful candidate(s) will be able to agree a contractual workplace from those locations listed in this advert. The agreed contractual workplace is then the substantive and permanent place of work for the successful candidate(s). Where the location is ‘National’ the successful appointee should discuss and agree an appropriate contractual location in line with both Defra’s location policy and site capacity, prior to proceeding with pre-employment processes. The agreed amount of time spent at a workplace for this post will reflect the requirement for Civil Servants to spend at least 60% of their working time in an organisation workplace with the option to work the remaining time flexibly from home. Working time spent at a workplace may include time spent at other organisational locations including field-based operational locations, together with supplier, customer or partner locations. This is a non-contractual agreement which is consistent with common Civil Service expectations. Travel costs to non-contractual workplaces will be subject to departmental travel and subsistence policies. Travel costs to contractual workplaces are the responsibility of the employee. The successful candidate is required to carry out all their duties from a UK location, and cannot do so from an overseas location at any time., Please take note that Defra does not hold a UK Visa & Immigration (UKVI) Skilled Worker License sponsor and are unable to sponsor any individuals for Skilled Worker Sponsorship. ## Description The Head of Security Incident and Response provides operational leadership of the Defra Group Security Incident Response Management (SIRM) capability, ensuring the organisation is prepared for, and able to respond effectively to, security incidents ranging from routine events to significant security incidents. As the senior lead for security incident management, the role oversees incident response policy, governance and operational coordination, directs the response to complex and high-impact incidents, and provides authoritative advice and recommendations to senior stakeholders. Operating across the Defra Group, the postholder ensures a consistent, risk-based approach to incident management, protecting organisational assets, maintaining stakeholder confidence, and supporting the resilience of critical services and business operations. The role leads the Defra Group's approach to security investigations, including unauthorised disclosure cases, ensuring robust governance, effective investigative oversight, and informed decision-making by senior stakeholders Please note for this role you will require SC Clearance. To gain SC clearance all applicants are required to have been a UK resident for a minimum of 5 years. If this requirement is not met, the individual will not be able to progress their application further., * Define and maintain Security Incident Response Management playbooks for Defra group, providing clear policy, process, responsibilities, and governance for tackling security incidents across core Defra, agencies and ALBs. * Coordinate across all parts of Defra group to draw on best practice, align Security Incident Response Management processes and integrate with group level approach. * Lead on security incident response management relating to all levels of incidents, including dealing with complex and varied situations where no clear guidance is available, assimilating available information and making clearly reasoned recommendations to senior stakeholders. * Responsible for performance of the Security Incident Response Management team including all decision-making associated work allocation and completion of all activities. * Report on security incidents to security governance groups, including agreeing reporting processes and thresholds will all areas of the business, and overseeing analysis, identification of trends and root cause analysis. * Coordinate and lead Security Incident Response exercises across physical, personnel, information and cyber security incidents. * Lead on investigation of leaks and other security breaches on behalf of Defra group, conducting investigations in accordance with policy and in collaboration with Cabinet Office where appropriate., If successful and transferring from another Government Department a criminal record check may be carried out. In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service on your behalf. However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading. Internal Fraud Database Check Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment. A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government. Higher Security Clearance All of these posts require the successful candidate to hold SC security clearance. Job offers to these posts are made on the basis of merit. Security vetting will only take place after the receipt of a job offer. For further information on National Security Vetting please visit the Demystifying Vetting website. Feedback Feedback will only be provided if you attend an interview or assessment. Security Successful candidates must undergo a criminal record check. Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check . See our vetting charter . People working with government assets must complete baseline personnel security standard (opens in new window) checks. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Kubernetes and Microservices with Multi-Model Databases](https://www.wearedevelopers.com/videos/382-kubernetes-and-microservices-with-multi-model-databases) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Fault Tolerance and Consistency at Scale: Harnessing the Power of Distributed SQL Databases](https://www.wearedevelopers.com/videos/1146-fault-tolerance-and-consistency-at-scale-harnessing-the-power-of-distributed-sql-databases) ## Related Articles - [Guide for Expats Living in the UK](https://www.wearedevelopers.com/magazine/355-guide-for-expats-living-in-the-uk) - [UK Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/326-uk-business-culture-and-etiquette) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk) - [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)