Incident Response Analyst

As an Incident Response Analyst, you will act as a key point of contact within the FPC Incident Response Team. You will assess, triage and analyse identity led fraud incidents, supporting effective response activities and helping to minimise the impact on business operations. Working collaboratively with colleagues and stakeholders, you will review existing weak processes, identify opportunities for improvement, and contribute to the development of effective incident response procedures and mitigations. Your work will support the timely restoration of services and the continuous improvement of fraud incident management across the FPC.

Person specification

• Act as an FPC subject matter contributor for fraud incident management, working with colleagues and stakeholders to ensure effective incident response arrangements are in place and standards are adhered to.
• Analyse and resolve detected fraud incidents, contributing to lessons learned activities and identifying opportunities for continuous improvement.
• Support the day-to-day activities of the incident response team, reviewing incidents and contributing to response efforts, helping to prioritise and coordinate activities across the end-to-end fraud incident response cycle.
• Contribute to the development of incident management capability across the FPC, working with SO Incident Response Analysts to promote best practice and consistent application of standards.
• Support FPC SOs and G7s in producing reports and presentations for a variety of stakeholders, communicating technical information in an accessible and meaningful way.
• Experience in developing, delivering and improving IT operations within a complex environment, particularly in incident management.
• Support the capture, dissemination and maintenance of incident information within the incident register, ensuring records, processes and documentation remain accurate and up to date.
• Provide regular updates on incidents and response activities to the G7 Incident Response Lead.
• Contribute to the development and improvement of incident response plans, processes and capabilities, supporting effective information sharing across teams.
• Work collaboratively with HMRC stakeholders, including incident response teams, to escalate findings and support the mitigation of fraud risks.
• Review incidents, provide guidance to colleagues where appropriate, and support the development of FPC processes, standards and templates.
• Maintain awareness of the current threat landscape, emerging fraud risks and developing industry practices.
• Knowledge of fraud detection techniques, including behavioural analysis and anomaly detection and investigation and OSINT (Open Source Intelligence) methods.
• Support the effectiveness and efficiency of FPC Incident Response Services through the identification of opportunities to improve processes, controls and ways of working.
• Share knowledge and experience with colleagues across the FPC, helping to build confidence, capability and understanding of fraud incident management., We’ll assess you against these technical skills during the selection process:
• Incident Response
• Monitoring

• To have, or be willing to achieve CISMP
• Knowledge of fraud detection techniques, including behavioural analysis and anomaly detection and investigation and OSINT (Open Source Intelligence) methods.
• Data analysis skills and experience with large data sets, with proficiency scripting complex queries in analysis environments.
• Solid technical understanding of web and API services (e.g. cookies, IP addresses, authentication processes) and threats to those services from cybercrime actors and tools.
• Experience using Security Information and Event Management (SIEM) platforms, preferably in a security operations setting.

• A sound understanding of Identity, Verification and Authentication principles Desirable Criteria

• A degree in Data Analysis, Data Science, Information Security, Cyber Security, or other Cyber qualifications eg SANS, or at least previous experience in a relevant cyber role.
• Active use of at least one of the following: Python, SQL, KQL, SPL, * A 1000-word personal statement, describing how your skills and experience would make you suitable for the role, and how you meet the Essential Criteria and Person Specification.
• A 250-word example for the Technical Skills: Incident Response & Monitoring click apply for full job details

Alongside your salary of £37,682, HM Revenue and Customs contributes £10,916 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).

HMRC operates both Flexible and Hybrid Working policies, allowing you to balance your work and personal commitments. We welcome applications from those who need to work a more flexible arrangement and will agree to requests where possible, considering our operational and customer service needs.

We offer a generous leave allowance, starting at 25 days and increasing by a day for every year of qualifying service up to a maximum of 30 days.

• Pension - We make contributions to our colleagues’ Alpha pension equal to at least 28.97% of their salary.
• Family friendly policies.
• Personal support.
• Coaching and development.

To find out more about HMRC benefits and find out what it’s really like to work for HMRC hear from our insiders or visit Thinking of joining the Civil Service

Discover a career in your hands at HMRC. Whether you’re seeking purpose, growth, or a workplace that gives you a true sense of belonging, hear from some of our employees as they share their story about what it’s really like to work at HMRC.

Visit our YouTube channel to watch the full series and come and discover your potential.

Our team is rapidly growing as we invest in new technologies and capabilities, and we are in search of enthusiastic individuals who can help us in achieving our mission. We are continually improving the service we give to our customers and, in line with this, we are creating a new response and management team within the HMRC Fraud Prevention Centre.

The Fraud Prevention Centre (FPC) is a strategic capability within HMRC Security, designed to safeguard customers and the organisation against identity-related fraud and emerging threats. Its mission is built on three interconnected pillars: Protection, Detection, and Response, all underpinned by advanced threat intelligence and customer support. The Centre operates across multiple functional areas, including Proactive Protection, Customer Support & Response, and Strategy & Advisory, to deliver a holistic approach to fraud prevention.