Associate Cyber Detect and Respond Analyst
Location: National*
Closing Date: 3^rd March
Interviews: W/C 23^rd March (subject to change)
Grade: HEO
(MoJ candidates who are on a specialist grade, will be able to retain this grade on lateral transfer)
Salary: National: £35,335 - £37,847 (which may include an allowance of up to £1203). London: £40,014 – £42,859 (which may include an allowance of up to £474).
Working pattern: Full-time, part-time, flexible working, job share.
Contract Type: Permanent.

*We offer a hybrid working model, allowing for a balance between remote work and time spent in your local office. Office locations can be found ON THIS MAP

The Role

We’re recruiting for Associate Cyber Detect and Respond Analysts here at Justice Digital, to be part of our warm and collaborative SOC team.

This role aligns against Monitoring Associate from the Government Security Profession framework.

The purpose of this role is to proactively monitor, analyse, and respond to security logs, alerts, and incidents to detect and mitigate potential threats to the Ministry of Justice (MoJ). This role involves conducting thorough triage, initiating appropriate response actions within defined procedures, and escalating complex or high-risk security incidents to senior analysts. The analyst contributes to incident resolution efforts, supports continuous improvement of detection and response capabilities, and helps maintain the organisation’s security posture.

Operating with a degree of autonomy, this role bridges the gap between the junior detect analyst's duties and senior detect and response SOC analysts.

Key Responsibilities:

• Independently investigates cases involving cyber security incidents, suspected data breaches, intellectual property theft, insider threat investigations, fraud and abuse, asset misuse, and violations of MoJ / Civil Service Security Policy.
• Analyses device and application logs from a variety of sources (Endpoints, Cloud, Networks, etc.) to identify anomalies or evidence of compromise.
• Responsible for preserving electronically stored information (ESI) data from a variety of platforms and sources during, and after an investigation; including laptops, servers, and cloud services in a manner that follows industry best practices and maintains integrity.
• Contributes to the development and refinement of detailed procedures and plays an active role in analysing and responding to an escalating cyber security incident.
• Supports excellent working relationships with stakeholders, management, and infrastructure support teams across the MoJ.
• Line Management/People Management responsibilities.
• Understanding and interpreting the output from security monitoring systems.
• Remaining calm under pressure ensuring consistent and reliable performance during security incidents whilst providing support to Senior SOC analysts.
• Building strong working relationships through collaborating with other specialists, in a variety of roles across the MOJ and with external stake holders.
• Working methodically, helping to develop and follow defined processes, even when they are complex or detailed in nature.
• Maintain accurate and detailed records of actions taken, ensuring traceability and accountability in all activities.

If this feels like an exciting challenge, something you are enthusiastic about, and want to join our team please read on and apply!

Benefits

• Some offices may have a subsidised onsite Gym.

Person Specification

Essential criteria -

• Experience working in, or demonstrable understanding of, a cyber monitoring and incident response environment.
• Holds or is actively working towards relevant professional qualifications in Security Operations, Information Security (e.g., CompTIA CySA+, Security+, GSEC, SSCP) or equivalent learning.
• Strong understanding of cybersecurity principles, threat detection methodologies, digital forensics, and common attack vectors.
• Demonstrable experience in analysing security logs and alerts from diverse sources (e.g., endpoints, cloud, network infrastructure).
• Proven ability to conduct initial triage and incident response actions independently, escalating when appropriate.
• Excellent analytical and problem-solving skills, with a methodical and detail-oriented approach.
• Strong written and verbal communication skills, including the ability to document incidents clearly and concisely.
• Experience working under pressure during live incidents, maintaining composure and accuracy.
• Ability to collaborate effectively with internal teams and external stakeholders to support incident resolution and continuous improvement.

Willingness to be assessed against the requirements for SC clearance.

We welcome the unique contribution diverse applicants bring and do not discriminate based on culture, ethnicity, race, nationality or national origin, age, sex, gender identity or expression, religion or belief, disability status, sexual orientation, educational or social background or any other factor.

Our values are Purpose, Humanity Openness and Together. Find out more here about how we celebrate diversity and an inclusive culture in our workplace.

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan and the Civil Service D&I Strategy.

How to Apply

Candidates must submit a CV and a separate statement of suitability (of no more than 750 words), which describes how you meet the requirements set out in the Person Specification above. Candidates who do not submit both a CV and a separate statement of suitability will not be invited to attend an interview.

Application Guidance

Please access the following link for guidance on how to apply and how to complete a Personal Statement

Application Guidance

In Justice Digital, we recruit using a combination of the Government Digital and Data Profession Capability, Success Profiles and Government Security Profession Frameworks. We will assess your Experience.

A diverse panel will review your application against the Person Specification above.

Successful candidates who meet the required standard will then be invited to a 1-hour panel interview held via video conference.

Should we receive a high volume of applications, a pre-sift based on the following criteria will be conducted before the sift -

• Experience working in, or demonstrable understanding of, a cyber monitoring and incident response environment.
• Holds or is actively working towards relevant professional qualifications in Security Operations, Information Security (e.g., CompTIA CySA+, Security+, GSEC, SSCP) or equivalent learning.
• Strong understanding of cybersecurity principles, threat detection methodologies, digital forensics, and common attack vectors.

At the sift stage, candidates will be assessed on the following criteria -

• Experience working in, or demonstrable understanding of, a cyber monitoring and incident response environment.
• Holds or is actively working towards relevant professional qualifications in Security Operations, Information Security (e.g., CompTIA CySA+, Security+, GSEC, SSCP) or equivalent learning.
• Strong understanding of cybersecurity principles, threat detection methodologies, digital forensics, and common attack vectors.
• Experience working under pressure during live incidents, maintaining composure and accuracy.

At the interview stage, candidates will be assessed on all essential criteria.

We are currently recruiting for several positions within our Digital Infrastructure and Security Operations (DISO) team.
At the end of the campaign, applicants who meet the interview pass mark but are not offered one of the advertised roles may be considered for alternative, similar positions through our reserve list, should any become available.
Further details will be shared with candidates who meet the minimum requirements following the interview stage.

Should you be unsuccessful in the role that you have applied for but demonstrate the capability for a role at a lower level, we reserve the right to discuss this opportunity with you and offer you the position without needing a further application.

A reserve list may be held for up to 12 months, from which further appointments may be made.

Use of Artificial Intelligence

Artificial Intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance for more information on appropriate and inappropriate use.

Terms & Conditions

Please review our Terms and Conditions which set out how we recruit and provide further information related to the role and salary arrangements.

If you have any questions, please feel free to contact digitalanddatarecruitment@justice.gov.uk