EOI - Cyber Monitoring Engineer and Analyst

Digital, Data and Technology (DDaT)

We are transforming DCMS to meet the needs of a modern, delivery-focused department working on some of government’s highest-priority agendas to drive growth, enrich lives and level-up society.

Our modernisation plans include investing in systems that are fit for purpose, reduce manual work and improve how colleagues across DCMS use technology, data and digital services. This includes developing a strong central digital capability for the department.

We also want to improve how we solve policy challenges by using user-centred design and working in multidisciplinary teams. This is an exciting time to join, as the team is shaping how digital, data and technology support delivery across DCMS.

Our mission is to digitally enable how DCMS delivers its priority outcomes and respond to the changing needs of the sectors and partners we work with. If you want to help shape that journey, this is a great time to join us.

This is a short-term role for a maximum of 1 year, which is available on both level transfer and temporary promotion.

We are seeking a Cyber Monitoring Engineer and Analyst. You will be at the forefront of safeguarding our digital assets and data. With a good understanding of the complexities of cyber security, you will be a key part of our cyber team, working with the team to monitor the ever-evolving threat landscape.

The role is critical in monitoring, detecting, analysing, and responding to security incidents and threats with precision. You awareness in security technologies and incident response procedures will be pivotal in protecting our critical systems and data.

Leveraging Azure cybersecurity tools, especially Azure Sentinel, you will ensure vigilant incident and event monitoring. Working will collaborate closely with a team to maintain and enhance our security posture.

The main aspects of the role will be

• Participate in security testing and monitoring.
• Manage security logs, identifying log sources, collect and store logs.
• Correlate and triage security incidents
• Cyber Incident response planning and preparation
• Cyber Incident detection, investigation and analysis
• Cyber Incident containment, eradication and recovery
• Cyber Incident post incident activity and reporting
• Development and implementation of Automation techniques