Security Operations Centre Specialist

This role undertakes technical protective monitoring, monitoring of security events and performance of security tools, as well as investigating and handling (or assisting in handling) security events.

This role is responsible for undertaking all aspects of SOC activity, including hands-on monitoring of SIEM (security incident and event management) tools and other sources of alerts and of threat intelligence, maintaining the relationship with the vendors and suppliers of SOC products, including where relevant contract management responsibilities. You will work as part of our Cyber Security Services team monitoring, identifying and responding to security relevant events. We deliver significant and high-profile on-line services to the public, with cyber security being viewed as an essential activity in which the organisation continues to invest.

Your responsibilities will include, but aren’t limited to:

• Responsible for monitoring operational IT Security, producing regular management reports, undertaking trend analysis, tracking resource, evaluating the fitness for purpose and effectiveness of security processes.
• Manages incident and event management processes complying with SLAs.
• Interprets and contributes to the development of SOC playbooks, alarms and policies. Ongoing assurance of fitness for purpose of SOC playbooks, alarms and policies.
• Provides expert advice and recommendations regarding risk assessments and business impact analysis for defined information systems and managing the maintenance processes including quality review.

Great line management is important to us as an organisation, and we will equip and support line managers to develop the skills they need. We aim to empower line managers to create teams where people can flourish and deliver excellent outcomes for the public., There is an opportunity to work as part an on-call rota, (one week in seven) of which a non-pensionable allowance will be paid.

This role is suitable for hybrid working, which is a non-contractual arrangement where a combination of workplace and home-based working can be accommodated subject to business requirements.

The expectation at present is a minimum of 60% of your working time a month will be spent at either your designated workplace (one of the locations cited in the advert) or, when required for business reasons, in another office/work location. There may be occasions where you are required to attend above the minimum expectation.

If you have a question about hybrid working, part time/job share hours, flexible working, travelling for work, or require a reasonable adjustment, please contact the Vacancy Holder during the recruitment process to avoid possible disappointment later in the process should your working arrangements not be compatible with the requirements of the role (see below for contact details).

Security Check

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check. To allow for meaningful checks to be carried out, candidates will be required to have at least 5 years continuous residency in the UK. All applicants for this role must ensure that they meet this minimum residency requirement - if you do not, your application will be withdrawn.

Visa Sponsorship

Please note that we do not hold a UK Visa & Immigration (UKVI) Skilled Worker Licence sponsor and are unable to sponsor any individuals for Skilled Worker Sponsorship. Candidates must ensure they have the appropriate rights to work in the UK before application., * Evidence of completing SOC Analyst functions such as investigating security events and anomalous patterns of activity.

• Evidence of using a range of security tools.
• Evidence of using SIEM tool as an analyst and administrator.
• Evidence of Cyber Security experience. Keeping up to date with trends and challenges in the sector. *

The sift will take place week commencing 05/10/2026.

Should we receive a high volume of quality applications, we may invite a shortlist of the highest scoring candidates to interview. This means that some applications that meet the required standard could be placed ‘on hold’ after the sift and invited to interview if the vacant position(s) remain unfilled. You will be notified if your application is being put ‘on hold’ once the sift has been completed. Following interviews, any applicants remaining on hold will be notified by the panel of the next steps regarding their application.

Stage 2: Interview

At interview stage, you will be assessed against the following Success Profile elements:

Behaviours –

• Making Effective Decisions
• Seeing the Big Picture

Technical –

• Government Security Profession: Protective Security (Awareness)
• Government Security Profession: Information Risk Assessment and Risk Management (Practitioner)
• Government Security Profession: Threat Understanding (Practitioner)

The interviews will take place week commencing 12/10/2026., As a Disability Confident Leader employer, we are committed to ensuring that the recruitment process is fair, accessible and allows all candidates to perform at their best. If a person with a visible or non-visible disability is substantially disadvantaged, we have a duty to make reasonable changes to our processes., All external applicants and current employees of accredited non-departmental public bodies (NDPBs) will be required to undergo a Social Media Check. A Social Media Check is a review of your publicly available online activity, typically across platforms like LinkedIn, Facebook, X (formerly Twitter), Instagram, and others. The purpose is to identify any public posts or content that could raise concerns for employers, such as:

• Hate speech or discriminatory behaviour
• Threats or acts of violence
• Illegal activity or substance misuse
• Sexually explicit material
• Extremist views or affiliations

Importantly, this check does not involve hacking into your accounts or accessing private messages. It only considers content you have chosen to make public. Employers use this kind of screening to help ensure their workplace remains safe, inclusive, and aligned with company values. It’s not about judging your personality or lifestyle - it’s about checking for potential red flags that might affect the role or company culture. If you have questions or concerns about the social media check, we would be happy to explain in more detail what’s being looked at and how your data is handled securely and fairly. Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a basic (or equivalent) criminal record check. Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check .

See our vetting charter . People working with government assets must complete baseline personnel security standard (opens in new window) checks., * UK nationals

• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

You will be a security professional with significant experience of cyber security. You will possess a broad knowledge of the issues and techniques associated with securing a variety of technologies. To be successful in this role you will need to have demonstrable experience of the range of activities of a security operations centre (SOC) including:

• Responding to alerts and handling incidents.
• Monitoring network traffic and user behaviour for potential malicious activity using a variety of tools.
• Investigating security events and anomalous patterns of activity.
• Practical experience of using LogRhythm or Sentinel, although experience of other SIEM (security incident and event management) tools will be considered., This vacancy is using Success Profiles , and will assess your Behaviours, Experience and Technical skills.

£39,163 The salary of £39,163 (basic salary £35,663) includes a non-pensionable Recruitment and Retention Allowance of £3,500 GBP, Passionate, reliable and always willing to push yourself and those around you, you’ll continue to seek improvement in your own role and challenge us too. Because we pride ourselves on how we approach your development. From training courses to specialist skills workshops and opportunities to grow your expertise, we thrive when you thrive. You can find out more about all of the above here alongside a full list of our benefits:

• Best in class learning and development tailored to your role
• An environment with flexible working options where we encourage a great work-life balance
• A culture encouraging inclusion and diversity with a range of staff communities to support all our colleagues
• Generous employer contribution of 28.9%, depending on chosen pension scheme
• Flexible working options where we encourage a great work-life balance.
• Digital communities with clear career frameworks
• On-site gym plus personal training available (membership applies)
• On-site nursery, restaurants and coffee bar
• 25 days holiday (plus bank holidays), increasing by 1 each year (up to 30) & 8 Bank Holidays plus an additional Privilege Day to mark the King’s birthday.
• 24-hour Employee Assistance Programme providing free confidential help and advice for staff.
• Free parking

Find out more about the benefits of working at DfT and its agencies .

The Security Operations Centre (SOC) is central to protecting DVLA’s critical digital services, ensuring the security and resilience of systems relied upon by millions of citizens every day. The SOC team provide various services such as technical protective monitoring, threat intelligence and hunting, incident response and forensics, working closely with internal stakeholders and specialist suppliers to identify, investigate and respond to cyber threats. Operating within a rapidly evolving threat landscape, the team plays a key role in safeguarding one of the UK’s largest public sector digital estates.

Joining our department comes with many benefits, including:

• Employer pension contribution of 28.97% of your salary. Read more about Civil Service Pensions here
• 25 days annual leave, increasing by 1 day each year of service (up to a maximum of 30 days annual leave), plus 8 bank holidays and a privilege day for the King’s birthday
• Flexible working options where we encourage a great work-life balance.

Read more in the Benefits section below!

Find out more about what it’s like working at DVLA - Driver and Vehicle Licensing Agency – Civil Service Careers, At DVLA, licensing is just the start. Every project you implement, touch and deliver has a ripple effect that’ll wash across the nation. Here the work you’re doing has the capacity to change the way 53 million people interact with our services. As we aim to keep our roads some of the safest in the world, our innovative, transformative digital-led services help optimise a nation of individuals and business every single day.

To see how our people are transforming our digital services, head over to our DVLA Digital Services Blog and, to understand more about the great opportunities and benefits of working at DVLA read our Inside DVLA blog.