Security Operations Centre (SOC) Lead Analyst
National Crime Agency
Apply before 11:55 pm on Sunday 12th May 2024
Details
Reference number
Salary
Job grade
Contract type
Business area
Type of role
Information Technology
Policy
Security
Working pattern
Number of jobs available
Contents
Location
About the job
Job summary
The NCA has grown in size and complexity in recent years and it is vital that it maintains a security posture and capabilities to protect against existing, new and emerging threats.
The Integrated Protective Security Command (IPS) is responsible for securing the Agency to protect the public. The IPS mission statement is: "Delivering integrated protective security to build a resilient, high-trust Agency able to lead the UK’s fight to cut serious and organised crime."
IPS safeguards the NCA from the full range of security threats that target the Agency, our officers and our assets, to enable the organisation to achieve its operational objectives, both domestically and overseas, with flexibility, agility and integrity. Its officers provide specialist security services to the Agency 24 hours a day, 7 days a week, 365 days a year, to mitigate security risks.
Job description
We are currently looking to recruit Lead Security Operations Centre (SOC) Analysts within our integrated protective security command. The successful candidate will work from the Agency’s Birmingham office on a 24/7 shift pattern.
The Cyber Security Team leads the strategic response to cyber risks, cyber security function, oversees audit, building internal and external alliances with diverse stakeholders to deliver the NCA’s strategic objectives.
What will the successful Candidate be doing?
If successful, you will work within the newly created Tier 2, Cyber Security Operations Centre, supporting the SOC Manager to run all SOC services. Joining at this time offers the rare opportunity to help shape what the final SOC capability will look like.
You will be the Lead Analyst on shift, responsible for ensuring that activities related to the monitoring of the Agency’s cyber domain take place. Your team of analysts will be the Agency’s eyes and ears before, during and after a cyber incident. The Lead Analyst reports directly to the SOC Manager and is untimely accountable to the Head of Cyber Security.
**To be considered, you will need to successfully complete SC Enhanced clearance before commencing the role and achieve DV clearance within the first 12 months in post.**
Person specification
Key Responsibilities (responsibilities will include, but not be limited to):
- The day-to-day management of personnel and tasking within the cyber domain of the Security Operations Centre.
- Monitoring for events across multiple security technologies, including intruder detection systems (IDS), Intruder prevention systems (IPS), Firewalls, End Point Security Solutions and vulnerability management solutions.
- Liaise with trusted partners to provide accurate threat identification. Recommend suitable mitigation measures and report the situation to senior management.
- Content development and analytics. Taking threat intelligence and tuning the SOC services to best protect the Agency’s vulnerabilities.
- Leading engineering tasks in support of the continuous availability of SOC services.
- Ensure that SOC scheduled tasks, reported events and incidents are appropriately progressed.
- Assisting as required with Security, Risk, Compliance and Service reporting.
Please note the team operates a 24/7 shift pattern currently consisting of 8 hour shifts across earlies, lates and nights.
Qualifications
• Recognised higher education in an IT related area with preference for those held within Cyber security relevant to this role.
And/or
• Certifications from a recognized body in Digital Security e.g. GIAC, ISC2, ISACA, BCS, CompTIA
Please ensure the dates of any accreditations you are relying on, are entered on to the CV.
Should you progress to the assessment stage of the process, you will be required to provide a copy of the original certificate.
Failure to provide evidence at interview may result in your application not progressing to the next stage.
Behaviours
We'll assess you against these behaviours during the selection process:
- Making Effective Decisions
- Communicating and Influencing
Technical skills
We'll assess you against these technical skills during the selection process:
- Experience as a Senior Security Analyst leading a team using SIEM capabilities, vulnerability scanning.
- Experience of overseeing the SOC incident response.
- Experience of managing threats , Impact analysis and report writing.
- Experience of supporting/developing a team to effectively meet the SOC’ objectives/capability
Benefits
All officers in the NCA are members of the UK Civil Service. You will be eligible for:
- Civil Service pension scheme
- 26 days annual leave rising to 31 on completion of 5 years continuous service
- If qualifying criteria is met new joiners to the NCA from UK Police Forces or UKIC will have service with those employers taken into account for continuous service purposes for Annual Leave entitlement only, this will be up to a maximum of 31 days leave (including 1 privilege day).
- Training and development opportunities
- Special leave
- Flexible working and family friendly policies
- Cycle to work scheme
- Blue Light scheme
For further details on benefits please visit https://www.nationalcrimeagency.gov.uk/careers/benefits-and-support
Things you need to know
Selection process details
If you wish to apply for this vacancy, you must submit your application by 23:55 on Sunday 12th May 2024.
You will be asked to complete a CV as part of the application process. Your CV should set out your career history including training and qualifications, with key responsibilities and achievements. Please ensure that each entry of your career history also has a few sentences outlining a description and the key elements of that role, and that you provide reasons for any gaps within the last two years. Please ensure the dates of any accreditations you are relying on are entered onto the CV. Experience criteria can also be assessed from CV.
- CV - We will assess the following from your CV;
- Recognised higher education in an IT related area with preference for those held in Cyber security relevant for this role
And /or - Certifications from a recognized body in Digital Security e.g. GIAC, ISC2, ISACA, BCS, CompTIA
- 4x Technical / Experience criteria via a 250 word Statement of Suitability per criteria, as listed above.
For further application guidance please visit https://www.nationalcrimeagency.gov.uk/careers/applying-and-onboarding
Once submitted your application will be acknowledged by the Government Recruitment Service.
Please note depending on the volume of applications a Longlist at sift may be conducted on following criteria:
- Experience as a Senior Security Analyst leading a team using SIEM capabilities, vulnerability scanning.
Candidates must pass this criteria for their application to be progressed.
A panel will then assess your application to select those demonstrating the best fit for the role by considering the evidence you have provided against the criteria set out in the Entry Criteria section.
Failure to address any or all of these may affect your application.
Sift results are expected to be released w/c Monday 27th May 2024.
Interview Details
You will then be asked to attend an interview in order to have a more in-depth discussion of your previous experience and professional competence.
The interview will consist of 1 round, and you will be assessed on the 2x Behaviours and 4x Technical/Experience criteria listed above.
Interviews will take place throughout June 2024 - locations to be confirmed. Please be advised that the type of interview (eg. virtual/face-to-face) may be subject to change and successful candidates will be notified of this prior to attending. However the interview is conducted, the interview criteria will remain as detailed within this advert.
The above sift and interview dates are an indicative timeline.
Should you be successful at sift but cannot attend on the interview date(s) listed the recruitment team cannot guarantee an alternative date. Please contact the recruitment team.
Full details of the assessment process will be made available to shortlisted candidates.
Please ensure that all examples provided in your application are taken directly from your own experience and that you describe the examples in your own words. Any instances of plagiarism including copying of examples/answers from internet sources will result in a withdrawal of your application. Further action, including disciplinary action, may be considered in such cases involving internal candidates. Providing false or misleading information would be contrary to the core values of honesty and integrity expected of all Civil Servants.
Interview Outcome
Candidates will be alerted of the outcome of their interview via their CS Jobs Portal. We will be retaining a candidate pool of successful applicants to draw from as vacancies arise for up to 12 months.
If your application is successful and we are unable to offer you a post immediately, you will be invited to join our reserve list. If over the next 12 months we are able to offer you a position, we will contact you as soon as possible.
Once we make you an offer you will then go through our vetting and pre-employment checks processes.
All Appointments will be made in location merit order.
Multi-Location
Where more than one location is advertised, candidates will be appointed in merit order for each location. You will be asked to state your location preference on your application.
Please be aware that you can be posted to any location that you put in your preferences. If you would only like to be posted to one location, please confirm one location only. If you are posted to a location that you have requested and you do not accept that location, you may not be offered another role.
Please note, only advertised location can be offered. Notes populated in a free text box will not be taken into consideration.
Near Miss
If you are not found appointable at the advertised grade you may be offered the lower grade role if you are considered to meet the skills, experience and behaviours for the lower level. The benchmark for appointing to the lower grade is set at the start of each campaign. All offers will be made in merit.
If you are found appointable at the higher grade but there are no positions available you may be offered an appointment at the lower grade.
Hybrid Working
Here at the NCA we have a hybrid working arrangement in place enabling officers to work a proportion of their role remotely. Eligibility and the degree of home working will vary depending on the requirements of the role. Further details can be discussed at offer stage.
Reasonable Adjustment
We are committed to ensuring our recruitment process is inclusive and accessible to all. As part of our application process you will be prompted to provide details of any reasonable adjustment to our recruitment process that you may need. If you have a disability or long-term condition (a physical or mental impairment that has a substantial and long term effect on your ability to carry out normal day-to-day activities, we have a duty to make reasonable changes to our processes.
If you need a change to be made so that you can make your application, you should: Contact Government Recruitment Service via ncarecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs. Complete the ‘Assistance required’ section in the ‘Additional requirements’ page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.
Inclusion and Accessibility
We are proud to be an inclusive, equal opportunities employer. As a Disability Confident Leader we are committed to ensuring that all candidates are treated fairly throughout the recruitment process. For details of the available group please visit https://www.nationalcrimeagency.gov.uk/careers/benefits-and-support
In order to monitor the effectiveness of the National Crime Agency’s Diversity & Inclusion strategy, the NCA require certain personal details about you on submission of your application. Please note that this will be treated in confidence and will not impact your application. You will be asked to complete an E-consent survey asking for permission to share this data with the NCA to be used for statistical/monitoring purposes only, refusal of consent to share the information will not impact your application.
If you are experiencing accessibility problems with any attachments on this advert, please contact ncarecruitment.grs@cabinetoffice.gov.uk
Additional Information
- The NCA is a 24/7 organisation, and working patterns must support business requirements. Some roles may require you to respond at short notice or outside of core hours.
- Individuals will be required to undertake and pass a substance misuse test as part of pre-employment checks.
- Successful candidates may be required to undertake a medical. If required, the medical will take place in either London or Warrington. Unfortunately, travel costs will not be reimbursed.
- If you are an internal candidate who has passed interview but is undergoing an internal investigation or have a written warning in place preventing a post move you may not be able to be posted until this investigation is concluded or restriction lifted. You will remain on the reserve list for a max of 12 months.
VETTING REQUIREMENTS SC
All security clearances require you to provide evidence of your UK footprint where you have been physically present in the UK.
The requirement for SC clearance is to have been present in the UK for at least 3 of the last 5 years.
Failure to meet the residency requirements will result in your security clearance application being rejected.
If you require SC clearance you will need to provide evidence of the below requirements.
Checks will be made against:
- Departmental or company records (personnel files, staff reports, sick leave reports and security records)
- UK criminal records covering both spent and unspent criminal records
- Your credit and financial history with a credit reference agency
- Security Services records
VETTING REQUIREMENTS - DV
All security clearances require you to provide evidence of your UK footprint where you have been physically present in the UK.
The requirement for DV is to have been present in the UK for at least 7 of the last 10 years.
Failure to meet the residency requirements will result in your security clearance application being rejected.
If you require DV clearance you will need to provide evidence of the below requirements.
Checks will be made against:
- successful completion of the BPSS
- UK criminal record and identity checks
- credit reference checks
- relevant personnel and medical checks (if required)
For further information on National Security Vetting please visit the following page https://www.gov.uk/government/publications/demystifying-vetting
We encourage all candidates to visit the NCA careers page for further information please visit https://www.nationalcrimeagency.gov.uk/careers
If you have any specific queries about the role that are not covered by the candidate pack, please contact:
ncarecruitment.grs@cabinetoffice.gov.uk
Feedback will only be provided if you attend an interview or assessment.
Security
Medical
Nationality requirements
Working for the Civil Service
We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
Apply and further information
Contact point for applicants
Job contact :
- Name : NCA Recruitment Team - GRS
- Email : ncarecruitment.grs@cabinetoffice.gov.uk
Recruitment team
- Email : ncarecruitment.grs@cabinetoffice.gov.uk
Further information
If you are not satisfied with the response you receive from the Department, you can contact the Civil Service Commission: https://civilservicecommission.independent.gov.uk/recruitment/recruitment-complaints/
