Existing CO staff can work in their original contractual work location. Existing Civil Servants working in all other departments can work in London, Glasgow and Bristol only. External candidates can work in London, Glasgow and Bristol only.
Job summary
The Cabinet Office supports the Prime Minister and ensures the effective running of government. It is also the corporate headquarters for government, in partnership with HM Treasury, and takes the lead in certain critical policy areas.
We are the Cabinet Office’s cyber security team, and our mission is to secure the department against cyber threats. We protect our nationwide internal IT infrastructure, and high-profile citizen-facing digital services such as GOV.UK
This role is within Cyber Defence, which delivers cyber threat intelligence, threat detection, incident response and vulnerability management capabilities for the Cabinet Office, and is responsible for protecting and securing internal IT infrastructure and citizen-facing services.
As a data security analyst, you’ll focus on the investigation and response to data security incidents, and will:
- triage and investigate data security alerts (including from our email, productivity, network, and endpoint tools)
- use a variety of techniques to analyse systems, network traffic and cloud environments and understand the nature and extent of possible data security incidents
- support the response to data security incidents by identifying and implementing (or supporting the implementation of) containment, eradication and recovery actions
- support the response to data security incidents by engaging and collaborating with Data Protection, Security, and wider Corporate Services functions
- support the coordination of data security incidents
- contribute to post-incident reviews to identify lessons and actions
- identify opportunities for, and support the delivery of, continual improvements to the data security capability
- work closely alongside other Cyber Defence functions, supporting the continual improvement of wider capabilities
- contribute to internal plans, playbooks and knowledge base articles
- act as an escalation point for, and provide coaching and mentoring to, associate security analysts
Incidents can and do arise on a 24/7 basis. The team operates an out-of-hours on call rota, which you will be expected to join.
Person specification
As a data security analyst, you’ll focus on the investigation and response to data security incidents, and will:
- Continuous monitoring of security alerts and incidents.
- Creation and tuning of detections for data loss prevention
- Collaborating with the incident response team to mitigate threats.
- Reporting on security risks and trends to senior management.
- Ensuring compliance with data protection regulations.
1. Technical Proficiency in Cybersecurity Tools:
Demonstrated experience with security information and event management (SIEM) tools and other cybersecurity software for monitoring and analysing security events. Splunk experience preferred.
2. Incident Response Expertise:
Experience in handling security incidents, including detection, investigation, containment, and remediation, with an ability to operate effectively under pressure.
3. Knowledge of Threat Intelligence and Vulnerabilities:
Knowledge of current cyber threats, attack vectors, and vulnerability management practices (in particular relating to data loss) as well as experience in applying this knowledge to protect the organisation.
4. Collaboration and Analytical Thinking Skills:
Strong analytical skills to identify patterns, anomalies, and potential threats from complex datasets, and the ability to devise effective solutions to security challenges.
5. Communication and Collaboration Abilities:
Excellent verbal and written communication skills, with experience in preparing reports and documentation, and the capability to collaborate effectively with cross functional teams and stakeholders.
Additional information
Cabinet Office policy is that a minimum 60% of your working time should be spent at your principal workplace. For some roles, due to their nature and the business need, this may be up to 100%. Requirements to attend other locations for official business will also count towards this level of attendance.
Behaviours
We'll assess you against these behaviours during the selection process:
- Changing and Improving
- Making Effective Decisions
- Working Together
- Delivering at Pace
Technical skills
We'll assess you against these technical skills during the selection process:
- Threat Understanding
- Incident Management, Incident Investigation and Response
- Intrusion Detection and Analysis
- Information Risk Assessment and Risk Management.
- Protective Security.
- Threat Intelligence and Threat Assessment.
- Applied Security Capability.
We only ask for evidence of these technical skills on your application form:
- Threat Understanding
- Threat Intelligence and Threat Assessment.
- Applied Security Capability.
Benefits
Alongside your salary of £43,760, Cabinet Office contributes £12,677 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.
- Learning and development tailored to your role.
- An environment with flexible working options.
- A culture encouraging inclusion and diversity.
- A Civil Service Pension which provides an attractive pension, benefits for dependants and employer contributions of 28.97%.
- A minimum of 25 days of paid annual leave, increasing by one day per year up to a maximum of 30.
Artificial intelligence
Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience.
Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action.
Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.
Selection process details
This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.
Application process
As part of the application process, you will be asked to provide:
1. A CV; 2. Examples of the behaviours listed in the advert; 3. Examples of technical skills listed in the advert.
Further details around what this will entail are listed on the application form.
Selection process
Stage 1 - Sift
An initial sift of applications will be carried out to create a shortlist. This will be based on the evidence from CV, and the behaviour and technical skills examples, provided on your application
Should a large number of applications be received, an initial sift may be undertaken using the lead Behaviour, Changing and Improving. Candidates who pass the initial sift may be progressed to a full sift, or progressed straight to assessment/interview.
Stage 2 - Interview
During the panel interview we'll assess you on behaviour and technical skill based questions.
Expected timeline (subject to change) Expected sift date – week commencing 29/06/2026 Expected interview date/s – to be confirmed Interview location - Your interview will either be conducted face to face or by video. You will be notified of the location if you are selected for interview.
Reasonable Adjustments
If a person with disabilities is put at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.
If you need a change to be made so that you can make your application, you should:
Contact Government Recruitment Service via [email protected] as soon as possible before the closing date to discuss your needs.
Complete the ‘Assistance required’ section in the ‘Additional requirements’ page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.
Further information
If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'contact point for applicants' section. Please note that this role requires SC clearance, which would normally need 5 UK residency in the past 5. This is not an absolute requirement, but supplementary checks may be needed where individuals have not lived in the UK for that period.
This may mean your security clearance (and therefore your appointment) will take longer or, in some cases, not be possible. Please note terms and conditions are attached. Please take time to read the document to determine how these may affect you. Any move to Cabinet Office from another employer will mean you can no longer access childcare vouchers.
This includes moves between government departments. You may however be eligible for other government schemes, including Tax Free Childcare; for further information visit the Childcare Choices website. A reserve list will be held for a period of 12 months, from which further appointments can be made.
If successful and transferring from another Government Department a criminal record check may be carried out.
In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service/Disclosure Scotland on your behalf.
However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing [email protected] stating the job reference number in the subject heading.
For further information on the Disclosure Scotland confidential checking service telephone: the Disclosure Scotland Helpline on 0870 609 6006 and ask to speak to the operations manager in confidence, or email [email protected].
For further information on National Security Vetting please visit the Demystifying Vetting website.
New entrants are expected to join on the minimum of the pay band.
Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences.
This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment.
A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.
This role is full time only. Applicants who wish to work an alternative pattern are welcome to apply however your preferred working pattern may not be available and you should discuss this with the vacancy holder before applying.
Feedback
Feedback will only be provided if you attend an interview or assessment.
Security
Successful candidates must undergo a criminal record check.
Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window). See our vetting charter (opens in a new window).
People working with government assets must complete baseline personnel security standard (opens in new window) checks.
Nationality requirements
This job is broadly open to the following groups:
- UK nationals
- nationals of the Republic of Ireland
- nationals of Commonwealth countries who have the right to work in the UK
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
- individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
- Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service
Further information on nationality requirements (opens in a new window).
Working for the Civil Service
The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants. We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.
The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.
Diversity and Inclusion
The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).
Apply and further information
This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.
The Civil Service welcomes applications from people who have recently left prison or have an unspent conviction. Read more about prison leaver recruitment (opens in new window).
Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.
Contact point for applicants
Job contact
Recruitment team
Further information
Appointment to the Civil Service is governed by the Civil Service Commission’s Recruitment Principles. If you feel that your application has not been treated in accordance with the Recruitment Principles, and wish to make a complaint, then in the first instance you should contact Government Recruitment Service by email at : [email protected].
If you are not satisfied with the response you receive, then you can contact the Civil Service Commission at [email protected].
For further information on the Recruitment Principles and bringing a complaint to the Civil Service Commission, please visit their website at: https://civilservicecommission.independent.gov.uk/.
Attachments
Cabinet Office Employee Offer - Opens in new window (pdf, 344kB)
Cabinet Office Terms and Conditions - External - Opens in new window (pdf, 82kB)
