Cyber Threat Intelligence Analyst

The Home Office works to build a safe, fair and prosperous UK. We achieve this through our work on counter-terrorism, policing, crime, drugs policy, immigration and passports.

Home Office Digital designs, builds and develops services for the rest of the department and for government. Every year our systems support up to 3 million visa applications, checks on 100 million border crossings, up to 8 million passport applications and deliver 140 million police checks on people, vehicles and property.

The Home Office Cyber Security Operations Centre (CSOC) operates 24/7/365 to safeguard the department from cyber threats. The CSOC’s Threat Intelligence team is a core function and is responsible for collecting, analysing, exploiting, and disseminating intelligence to stakeholders to inform decision making and mitigate risks.

As a Cyber Threat Intelligence Analyst, you’ll use your skills and expertise to assist in meeting emerging threats and implement complex solutions. Additionally, you’ll help in the development of the Home Office cyber risk response, focussing on process improvement. You will also support the response to security incidents, communicating with other organisational business areas to ensure an effective response and mitigate against future incidents., You will be joining an expert team of cyber professionals, committed to reducing the exposure to cyber-attack of new and existing digital systems. You’ll be aided in your role by a diverse and supportive organisational culture, and a commitment to further your continuous development.

The Cyber Threat Intelligence Analyst supports the development of intelligence requirements by capturing stakeholder needs to guide individual and team collection efforts to ensure the timely delivery of threat intelligence that supports CSOC detection and Home Office protective measures. This also includes disseminating intelligence across HMG and operational partners where appropriate., * Assisting in carrying out threat intelligence activities in line with team procedures and the organisation’s response policies and processes.

• Helping provide security advice and guidance on control implementation to inform mitigation strategies, escalating where appropriate.
• Helping to conduct intelligence and incident response exercises (e.g. red teaming, threat hunting, table tops and analytical exercises) by supporting design and implementation.
• Communicating investigation results, supporting improvement and development of responses to new threats. Assisting in post-incident review activities to improve monitoring, detection, and response.
• Supporting in identifying and classifying security threats to networks, systems and applications based on threat actor capabilities and motivations. Assisting stakeholders in the understanding of threats through a structured approach and the creation of relevant products.
• Continuously monitoring the cyber threat landscape to identify trends, emerging threats, and vulnerabilities, using appropriate tooling and processes.
• Supporting the triaging and prioritising of vulnerabilities using threat intelligence, supporting implementation of mitigating measures, assisting to provide standardised products on ways to improve control mechanisms and mitigate risk - including producing CVE advisories / enrichment products.
• Continuously seeking to identify service and process improvements increasing your knowledge of industry best practices, good judgment and problem-solving skills to execute security operations and investigations.

An employee may be required to carry out other duties within the scope of the grade and within the limits of their skill, competence and training.

Working Pattern

Where business needs allow, some roles may be suitable for a combination of office and home-based working. This is a non-contractual arrangement where all employees will be expected to spend a minimum of 60% of their working time in an office.

Due to the business requirements of this role, it is only available on a full-time basis. However, compressed hours are available.

Travel

Occasional travel may be required to other work locations within the UK according to business needs and may include overnight stays. All related costs will be reimbursed in line with Home Office policy., For guidance on the Technical skills, please refer to the SFIA Framework Skills directory A–Z — English

In addition, candidates will be asked to prepare a 10-minute presentation that will be delivered at interview. The presentation question/scenario will be provided to you with your interview invitation (should you be successful at sift). Slides will be accepted.

The presentation will be assessed against SFIA Framework and will be assessed against the Technical Skills: Threat Intelligence (THIN) – Level 2, Service Level Management (SLMO) – Level 2 and Security Operations (SCAD) – Level 2

For guidance and information on what to expect and how to prepare for an interview, you are encouraged to visit Civil Service Careers.

Problems during the application process

If you experience problems accessing this advert, or you think you’ve made a mistake on an initial application, please contact hocandidates.grs@cabinetoffice.gov.uk, including the vacancy reference, at least two working days before the vacancy closes. Further information can be found on our website.

Do not create or attempt to submit another application, online test or use a different Civil Service Jobs account to proceed as this would be in violation of the candidate declaration.

Reserve List

A reserve list may be held for a period of up to 12 months from which further appointments may be made. There is no guarantee that being held on a reserve list will lead to a job offer. Further information can be found on our website.

The behaviours and technical skills have been ranked in order of importance to enable us to differentiate between candidates with tied interview scores.

Candidates judged to be a near miss at interview may be offered a post at the grade below the one advertised without the need to go through a further selection process, providing the role has the same Success Profiles elements and essential skills. There is no guarantee that further such vacancies will arise.

Standards

All Civil Servants are expected to comply with the Civil Service Code, and its core values of integrity, honesty, objectivity and impartiality.

Additional Security Checks

As well as successfully obtaining UK Security Vetting clearance, candidates will be subject to a range of additional checks. The range of checks carried out will depend on whether you are a current Home Office employee, existing civil servant or an external new entrant as well as the role requirements. Further details are included in the Notes to Candidates.

Non-Police Personnel Vetting (NPPV)

You should currently hold, or be willing to obtain, Non-Police Personnel Vetting (NPPV) Level-3 vetting (including financial checks). This is essential for the role. For further information visit About the Police National Vetting Service , Warwickshire Police.

Formal offers of employment will not be made until successful candidates have obtained both NSV clearance and NPPV3 clearance.

For existing Civil Servants: Please note that failure to obtain NPPV3 Clearance may trigger a formal review of your National Security Vetting Clearance (NSV). Depending on the nature of the information identified, this could result in your NSV being revoked., If a person with disabilities is at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes., * UK nationals

• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

You’ll have a demonstrable passion for Cyber Security with the following skills, knowledge or some experience in:

• Awareness of cybersecurity principles, such as threat analysis, vulnerability research, intelligence analysis
• Communicating in a verbal and written manner, and a good understanding of the use of different channels and formats for different audiences
• Building strong partnerships with peers across the technology organisation

The essential skills listed above are reflective of the Home Office Government Digital and Data Profession Career Framework (based on the industry standard SFIA framework).The six technical skills for this role align to Cyber Threat Intelligence Analyst. Use the SFIA levels of responsibility to understand what would be expected for each technical skill listed. Please see below the relevant six technical skills for Cyber Threat Intelligence Analyst, * Service Management

• Service level management (SLMO) – Level 2
• Incident management (USUP) – Level 2
• Problem management (PBMG) – Level 3
• Security Services
• Security operations (SCAD) – Level 2

Relationships and Engagement

• Stakeholder Management

Stakeholder relationship management (RLMT) – Level 3 Generic Level 3 descriptor), * Threat Intelligence (THIN) – Level 2

• Service Level Management (SLMO) – Level 2
• Incident Management (USUP) – Level 2
• Problem Management (PBMG) – Level 3
• Security Operations (SCAD) – Level 2
• Stakeholder Relationship Management (RLMT) – Level 3, This vacancy is using Success Profiles , and will assess your Behaviours, Experience and Technical skills., Successful candidates must undergo a basic (or equivalent) criminal record check. Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check .

In addition to your salary, a career with the Home Office offers a range of benefits, including:

• A Civil Service pension with an employer contribution of 28.97%.
• In-year reward scheme for one-off or sustained exceptional personal or team achievements.
• 25 days annual leave on appointment, rising with service to 30 days.
• Eight days of public holidays, plus one additional privilege day.
• New entrants to the Civil Service will start their role on the salary band minimum £41,750 for National Roles. Recruitment and Retention Allowance (RRA): Up to £5000 is available for candidates who demonstrate exceptional skills and experience evidenced at interview stage. The advertised role is eligible for a Digital Capability Allowance. Successful candidates with exceptional skills and experience may apply for a Recruitment and Retention Allowance. The allowance values are set by the Home Office, subject to remaining in a qualifying role. This allowance is non-contractual, non-pensionable, subject to an annual review and could be withdrawn at any time. Please see the Home Office Digital Recruitment and Retention Allowance Careers page for more information. For both new entrants and existing civil servants, the total compensation offer is a combination of base salary and, if applicable, a capability-based allowance.
• Where business needs allow, some roles may be suitable for a combination of office and home-based working. This is a non-contractual arrangement where all employees will be expected to spend a minimum of 60% of their working time in an office.
• See more of our benefits on our careers website.