About the job

Job summary

Do you want to push yourself, and develop your career?

Have you got a good awareness of modern malware execution methods?

Are you experienced in troubleshooting methodologies?

If you’ve answered yes to these then a career within our Cyber Security team will be the right place for you!  

The Customer Experience & Bridge Operations Centre (CE&BO) comprises of a number of teams focused around monitoring the customer experience for the HMRC IT network including security and incident management. The Security Analyst will work a rotational 12 hour shift pattern, providing 24/7, 365 day Security monitoring and support capability for the CE&BO.

As a Security Analyst some of your responsibilities include:

• Continual real-time monitoring of the HMRC’s Security Platforms.
• Taking ownership of CST’s cases and following CST tickets to full resolution state – in line with CST procedures as well as flagging relevant information to meet CE&BO’s needs.
• React and respond to CE&BO’s trending analysis raised by CE&BO colleagues to identify and eliminate any security issues assisting with findings where possible.
• Listen to CE&BO’s bridge phone conversations and report to overall CST when incidents develop within the CE&BO.
• In an event of a Major Incident take ownership and be first point of contact, creating a knowledge bridge between CE&BO and CST as a whole – CE&BO will have prepared an HPI environment in which various concerned stakeholders and service owners are involved. If this concerns issues associated with CST you are responsible for:
• Provide initial assessment of the situation and collaborate with CE&BO’s team as well as CST in relation to the incident and creation of a CST ticket.
• Attend live calls and provide assistance and collaboration.
• Provide background material if available – and ensure (where sensitive information is identified), seek approval from CST management before disclosure.
• Capture timeline throughout the incident lifespan.
• Real-time updates and application of skillset without delay is essential.
• Ensure the prompt analysis of anomaly detection tools to help identify security breaches, cyber-attacks.
• Triage events and raise incidents tickets for the incident response team to investigate.

See what it’s like to work at HMRC: find out more about us or ask our colleagues a question. Questions relating to an individual application must be emailed as detailed later in this advert.

Job description

Shift Pattern

You will perform your contracted hours on an annualised hours basis, working fixed shift patterns over a 4-week rostering period consisting of days, nights, weekends, and public holidays.

The total number of hours worked over the 4-week rostering period is 148 hours. This is not inclusive of breaks which are unpaid.

If the rostered shift falls on a Bank Holiday, colleagues are expected to work this.

Typically, in 2 out of the 4 weeks, there is a requirement to work 52.75 hours per week, and in the other 2 weeks, a requirement to work 21.25 hours per week. This is subject to change in accordance with business needs.

Current (typical) shift patterns are as follows: 

Week 1

Monday 6:45am – 7pm.
Tuesday, Friday, Saturday, Sunday 7am – 7pm.

Week 2

Wednesday 6:45am – 7pm.
Thursday 7am to 7pm.

Week 3

Monday 6:45pm – 7am.
Tuesday, Friday, Saturday, Sunday 7pm – 7am.

Week 4

Wednesday 6:45pm – 7am.
Thursday 7pm – 7am.

We have 2 positions available in Telford, and 1 in Newcastle.

Travel and overnight stays are rare, but generally are connected to training courses or visiting our other site.

Person specification

Essential Criteria: 

• Excellent troubleshooting methodologies and root cause analysis skills.
• Awareness and enthusiastic in cyber security developments, current trends, analysis and technically equipped with basic scripting skills.
• A good understanding of modern malware - execution methods, persistence, detection, C2 methods, delivery mechanisms and entry points.
• Understanding of the systems and high-level architecture which underpin corporate IT systems and the techniques deployed to compromise these assets.
• Understanding of network protocols - TCP/IP.

Desirable:

• Previous exposure to SIEM platforms.
• Experience of using a variety of analytical tools and methods to identify security compromises within large and complex data sets.
• Demonstrable understanding of digital forensics, skills, techniques and tools to perform forensics and root cause analysis on enterprise IT systems.
• Certifications Preferred: GSEC, GCED, GCIH, CCNA Security or BSc in Cyber Security/computing related field.
• Proven analytical and investigative skills.
• Effective reporting, presentation skills with the ability to communicate technical issues to non-technical audience and explain the impact of vulnerabilities or threats in business focused language.

Benefits

Alongside your salary of £28,341, HM Revenue and Customs contributes £7,652 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.

Things you need to know

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Strengths, Experience and Technical skills.

To apply for this role, please submit your CV including your Qualifications, career history, and any skills and experience you have that are relevant to this role. 

You will also need to submit a Personal Statement, outlining in no more than 250 words how you meet the person specification above, your suitability for the role and what experience you bring to the role.

Your application will be sifted based on your CV and Personal Statement

A sift will be carried out within 21 working days of the closing date, and we will interview with 21 working days of the sift result.

At interview you will be assessed on your experience, technical skills, strengths based questions, and the following Behaviours: Making Effective Decisions and  Changing and Improving.

We reserve the right to raise the score required at any stage of the process in order to manage numbers.

Interview dates to be confirmed.

After interview, a single merit list will be created and you will only be considered for posts in locations you have expressed a preference for. Appointments will be made in strict merit order in line with the set number of roles in each location.

A reserve list may be held for a period of up to 12 months from which further appointments may be made for the same or similar roles – if this applies to you, we’ll let you know via your Civil Service Jobs account.

Eligibility

To check that you are eligible to apply, review this eligibility information

Important information for existing HMRC contractual homeworkers:

Please note that this role is unsuitable for contractual homeworkers due to the nature and/or requirements of the role.

Reasonable Adjustments 

We want to make sure no one is put at a disadvantage during our recruitment process because of a disability, condition, or impairment. To assist you with this, we will reduce or remove any barriers where possible and provide additional support where appropriate. 

If you need a reasonable adjustment or a change to be made so that you can make your application, review this information on reasonable adjustments, and contact hmrcrecruitment.grs@cabinetoffice.gov.uk as soon as possible.

Diversity and Inclusion

At HMRC we are committed to creating a great place to work for all our colleagues and creating an inclusive and respectful environment that reflects the diversity of the society we serve.

Diverse perspectives and experiences are critical to our success and we welcome applications from all people from all backgrounds with the experience and skills needed to perform this role. We’re committed to creating a great place to work for all our colleagues here at HMRC. We want everyone to feel valued and supported to achieve their potential at HMRC.

For more information on how we make this happen, review this information on our culture and values

Applications received from candidates with a criminal record are considered fairly in accordance with the DBS Code of Practice and the Recruitment of ex-offenders Policy.

We welcome applications from those who need to work a more flexible arrangement and will agree to requests where possible after considering operational and customer service needs. We can’t guarantee that we can meet all requests to work flexibly, as agreement will be subject to business ability to accommodate, and any request to work a more flexible arrangement should be made prior to your acceptance of the provisional offer.

Customer facing roles in HMRC require the ability to converse at ease with members of the public and provide advice in accurate spoken English and/or Welsh where required. Where this is an essential requirement, this will be tested as part of the selection process. 

The Civil Service runs a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy. 

Locations 

HMRC has a presence in every region of the UK. For more information on where you might be working, review this information on our locations.

Security Update

For more information on the level of security checks we will carry out, review this information on security checks

All Criminal Record Checks applications are considered fairly in accordance with the DBS Code of Practice and the Recruitment of ex-offenders Policy.

Please note: in addition to the standard pre-employment checks for appointment into the Civil Service, all candidates must also obtain National Security Vetting at Security Check (SC) clearance level for this vacancy. You will normally need to meet the minimum UK residency period as determined by the level of vetting being undertaken, which for SC is 5 years UK residency prior to your vetting application. If you have any questions about this residency requirement, please speak to the vacancy holder for this post.

Further Information

The Civil Service values honesty and integrity and expects all candidates to abide by these principles. The evidence you provide in your application must relate to your own experiences.

Any instances of plagiarism or other forms of cheating will be investigated and, if proven, the relevant application/s will be withdrawn from the process. 

Duplicate applications for the same vacancy will also be withdrawn.

Transferring into HMRC from Civil Service If you are currently working for an ‘Other Government Department’ (OGD) and would like to consider the impact on your pay when joining HMRC, please see the attached document "Combined T&C and OGD Pay English”, found at the bottom of this advert. Further information on staff transfers can be found on gov.uk

Problems during the application process 

If you experience accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section. 

If you think you’ve made a mistake on a short application form (e.g. you’ve ticked the incorrect eligibility box), please contact hmrcrecruitment.grs@cabinetoffice.gov.uk at least two working days before the vacancy closes. After this, we won’t be able to reopen your application.   

Please use the subject line to insert appropriate wording e.g. Please re-open my application -  323958 & vacancy closing date 05/01/2024. Please note that we cannot amend or re-open your application if you have submitted your full application in the interests of fair and open recruitment.

For reasonable adjustments queries or requests, please see details within reasonable adjustments section above.

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a criminal record check. Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window). People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

Open to UK nationals only.

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window). The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria. The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.