Job Summary
The Senior Security Analyst (Ops) sits within the Protective Monitoring function of the Cyber Security Operations Centre (CSOC). The CSOC is composed of Protective Monitoring, Incident Management, Threat Operations, Engineering and Consultancy. The role is a Tier 3 analyst in the Cloud Protective Monitoring Sub‑team.
Cyber Operations purpose is to support safe care, build public trust and enhance NHS England’s cyber resilience, thereby supporting Transformation Directorate’s goal of delivering the best care and outcomes for the NHS.
The Cyber Operations sub‑directorate consists of four operational areas:
* Cyber Security Operations Unit (CSOU)
* Cyber Delivery Unit (CDU)
* Cyber Improvement Programme
* Chief Information Security Office Function (CISO)
The post has been awarded a Recruitment and Retention Premia (RRP) in response to current labour market conditions, and attracts an additional monthly RRP payment equal to 20% per annum. The RRP is non‑contractual and subject to review.
Main Duties
* Provide Tier 3 security analytics and incident response for service‑specific security monitoring.
* Deputise for Security Lead (Analyst) in their absence.
* Act as escalation point for Tier 2 Analysts for incidents and investigations.
* Offer mentorship and guidance to Tier 2 Analysts to support growth and development.
* Keep up to date with the latest security and technology developments, researching emerging cyber‑security threats and mitigation approaches.
* Use advanced analytic tools including SIEMs and Cloud Consoles to determine emerging threat patterns and vulnerabilities.
* Apply experience and knowledge to investigate triggered security alerts.
* Support development and automation of SOC processes to mature the security monitoring service.
* Assist with the refinement of Use Cases and identify areas for improvement of overall security posture.
Location & Working Pattern
Leeds (Wellington Place) / Exeter (Hexagon House). 40% of the role will be spent working in‑person. Full‑time, Fixed‑term (11 months).
Salary & Payment
£66,828 to £75,218 per annum (includes RRP payment of 20%). Pay scheme: Agenda for Change. Salary band: 8a.
Contract Details
Fixed‑term contract, 11 months, full‑time, internal NHS employer.
Qualifications
* SANS SEC504 (GCIH)
* SANS SEC511 (GMON)
* SANS SEC541 (GCTD)
* SANS FOR508 (GCFA)
* SANS FOR509 (GCFR)
* AZ‑500: Azure Security Engineer Associate
* AWS Certified Security Specialty
Person Specification
Essential Knowledge:
* Working knowledge of modules, processes and technologies of Information Security Operation Centre (ISOC); ability to detect, respond and utilise related platforms and applications for cyber‑security initiatives.
* Extensive knowledge of techniques, approaches and processes of digital threats; ability to detect, monitor, analyse and prevent digital threats.
* Proven knowledge of tools, techniques and processes of intrusion detection and prevention; ability to detect, resolve and prevent intrusion behaviours to protect organisational networks.
Desirable Knowledge:
* Working knowledge of cloud security concepts, issues and techniques; ability to ensure cloud infrastructure security compliance.
* Working knowledge of endpoint security concepts, issues and techniques; ability to ensure endpoint infrastructure security compliance.
Essential Skills and Experience:
* Previous experience working in an Analyst role within a Cyber Security Operations Centre.
* Evidence of continuous professional development.
* Master’s level degree or equivalent level of experience.
Compliance & Discretionary Requirements
All NHS England Cyber Security personnel must hold Security Clearance level SC (or higher). National Security Vetting requires 5 years continuous UK residency (or 3 years with overseas checks). Failure to achieve SC after an offer will result in withdrawal of the offer.
Disability and Barring Service Check: This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975. A submission to the Disclosure and Barring Service will be required to check for any previous convictions.
Certificate of Sponsorship: Candidates requiring Skilled‑Worker visa sponsorship will be considered. Further information: https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels#security-check-sc.
Employer Details
Employer: NHS England
Address: Wellington Place, Leeds / Hexagon House, Exeter, LS1 4AP
Website: https://www.england.nhs.uk/about/working-for/
Application Information
Reference number: 990‑TD‑CY‑17782‑E. Posted 21 October 2025. This role is open for application; it is not closed.
#J-18808-Ljbffr