Job summary
As a Security Officer, you will rotate around the CSOC into 4 main areas: Protective Monitoring, Incident Management, Threat Intelligence and Threat Hunting. As part of Protective Monitoring, you will join the analyst pool team responsible for triaging cyber alerts ranging from identity & access alerts, networking alerts and XDR. Within Threat Hunting, you will conduct daily hunting investigations using prewritten queries across a range of multi-tenant hunting platforms, including but not limited to M365D XDR, Microsoft Sentinel and Splunk. The Threat Intelligence team perform the collection, aggregation, analysis and contextualisation of healthcare and security information to produce actionable cyber threat intelligence. The Incident Management team provide end-to-end management of cyber security incidents as well as making security control recommendation and are also involved with fielding several cyber security related queries from the public and NHS staff.
The post of Security Officer has been awarded a Recruitment and Retention Premia (RRP) in response to current labour market conditions. In recognition of this, the role attracts an additional monthly RRP payment equal to 10% per annum.
Please be aware that RRP is none contractual and subject to review
Main duties of the job
The main duties you would be involved with are as follows:
- Work within the Cyber Security Operations Centre (CSOC) with exposure to the Threat Intelligence, Threat Hunting, Protective Monitoring or Incident Management teams.
- Work as part of the Protective Monitoring team to investigate detections of potential Cyber Security incidents and to triage and raise incidents to organisations and NHS staffWork as part of the Theat Hunting team to investigate multi-tenant threat hunting platforms - M365 XDR, Microsoft Sentinel and Splunk and review automated threat hunt queries
- Work as part of the Threat Intelligence team to collect, aggregate and contextualise healthcare security information to produce cyber security intelligence
- Work as part of the Incident Management team to provide end-to-end management of incidents including the initial triage/analysis as well as to make effective security control recommendations
- Provide an initial analysis on security data to identify potential threats and formulate recommendations and actions to consider in order to remediate and respond.
- Support senior colleagues in assessing, planning, and advising stakeholders on security measures that will help protect NHS England from security breaches and attacks on its computer networks and systems.
- Keep up to date with the latest security and technology developments, including researching and evaluating emerging cyber security threats and ways to manage them.
About us
The NHS England board have set out the top-level purpose for the new organisation to lead the NHS in England to deliver high-quality services for all, which will inform the detailed design work and we will achieve this purpose by:
- Enabling local systems and providers to improve the health of their people and patients and reduce health inequalities.
- Making the NHS a great place to work, where our people can make a difference and achieve their potential.
- Working collaboratively to ensure our healthcare workforce has the right knowledge, skills, values and behaviours to deliver accessible, compassionate care
- Optimising the use of digital technology, research, and innovation
- Delivering value for money.
If you would like to know more or require further information, please visithttps://www.england.nhs.uk/.
Colleagues with a contractual office base are expected to spend, on average, at least 40% of their time working in-person.
Staff recruited from outside the NHS will usually be appointed at the bottom of the pay band.
Job description
Job responsibilities
Please see the attached Job Description and Person Specification for more information about the role and responsibilities. Please ensure your supporting statement includes demonstratable evidence and specific examples on how you meet the criteria for each of the key skills specified. This will be used in both the shortlisting and interview processes
Important: Please be aware there are residency requirements you need to meet:
All NHS England Cyber Security personnel must hold security clearance SC level as a minimum. To meet National Security Vetting requirements, you must have resided in the UK for a minimum of 3 out of the past 5 years for SC clearance. Candidates who were posted abroad for service with HM Government, Armed Forces or within a UK government role - will still be considered.
Please make sure you meet these requirements before applying for this role. You dont need to have SC already, however, failure to achieve the requirements for SC after offer, will result in the job offer being withdrawn.
If you like what you have read and think you have the skills and experience, we need then don't delay, apply today! We get lots of applications for our roles and so we sometimes have to close our posts early. Don't miss out!
Job description
Job responsibilities
Please see the attached Job Description and Person Specification for more information about the role and responsibilities. Please ensure your supporting statement includes demonstratable evidence and specific examples on how you meet the criteria for each of the key skills specified. This will be used in both the shortlisting and interview processes
Important: Please be aware there are residency requirements you need to meet:
All NHS England Cyber Security personnel must hold security clearance SC level as a minimum. To meet National Security Vetting requirements, you must have resided in the UK for a minimum of 3 out of the past 5 years for SC clearance. Candidates who were posted abroad for service with HM Government, Armed Forces or within a UK government role - will still be considered.
Please make sure you meet these requirements before applying for this role. You dont need to have SC already, however, failure to achieve the requirements for SC after offer, will result in the job offer being withdrawn.
If you like what you have read and think you have the skills and experience, we need then don't delay, apply today! We get lots of applications for our roles and so we sometimes have to close our posts early. Don't miss out!
Person Specification
Knowledge & Experience
Essential
- Knowledge of modules, processes and technologies of Information Security Operation Centre (ISOC); ability to detect, response and utilise related platform and applications to perform cyber security initiatives.
- Knowledge of concept, procedures and processes of Security Information and Event Management (SIEM); ability to utilise related applications to protect organisational networks from cyber risks.
- Knowledge of technologies and technology-based solutions dealing with information security issues; ability to apply these in protecting information security across the organisation.
Skills
Essential
- Knowledge of techniques, approaches and processes of digital threats; ability to detect, monitor, analyse and prevent digital threats
Desirable
- Knowledge of methods and processes to monitor, analyse and respond to network attacks, intrusions or any unauthorised actions; ability to use techniques and tools to perform network defence.
Qualifications
Essential
- Post-graduate level degree or equivalent level of experience (3 years' industry experience or apprenticeship in Cyber Security)
Person Specification
Knowledge & Experience
Essential
- Knowledge of modules, processes and technologies of Information Security Operation Centre (ISOC); ability to detect, response and utilise related platform and applications to perform cyber security initiatives.
- Knowledge of concept, procedures and processes of Security Information and Event Management (SIEM); ability to utilise related applications to protect organisational networks from cyber risks.
- Knowledge of technologies and technology-based solutions dealing with information security issues; ability to apply these in protecting information security across the organisation.
Skills
Essential
- Knowledge of techniques, approaches and processes of digital threats; ability to detect, monitor, analyse and prevent digital threats
Desirable
- Knowledge of methods and processes to monitor, analyse and respond to network attacks, intrusions or any unauthorised actions; ability to use techniques and tools to perform network defence.
Qualifications
Essential
- Post-graduate level degree or equivalent level of experience (3 years' industry experience or apprenticeship in Cyber Security)
Disclosure and Barring Service Check
This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.
