Senior Cyber Security Analyst (SIEM Engineering)
Cyber Operations purpose is to support safe care and build public trust by building NHS England's cyber resilience and enabling the wider health system to be cyber resilient, supporting Transformation Directorate's purpose of delivering the best care and outcomes for the NHS.
The Cyber Operations sub‑directorate consists of four operational areas:
Cyber Security Operations Unit (CSOU)
Cyber Delivery Unit (CDU)
Cyber Improvement Programme
Chief Information Security Office Function (CISO)
This role is in the Cyber Security Operations Centre (CSOC), which is part of CSOU and provides centralised security monitoring across both NHS England and the wider health and care system in England. The CSOC teams work closely together to improve NHS cyber resilience and enable a “Defend as one” strategy across the health and care system.
The Senior Security Analyst SIEM Engineering is responsible for deploying feeds from data sources into NHS England's SIEM system, for both newly developed services and existing services being updated. They also manage the SIEM environment, build cyber detection capability and improve the automation of security monitoring.
Main duties of the job
The Senior Security Analyst SIEM Engineering is responsible for:
Deploying feeds from data sources into the NHS England’s SIEM tool and ensuring compliance with the SIEM's data modelling, both for newly developed services and for existing services being updated.
Maintaining the SIEM data feed infrastructure to ensure the timely delivery of security logs into the SIEM without loss of data fidelity.
Managing the technical relationship with services and customers during the deployment and updating of data feeds into the SIEM.
Working closely with the Cyber Monitoring teams to manage the SIEM environment, build cyber detection capability and improve the automation of security monitoring.
Managing and developing the SIEM configuration and the SIEM's interfacing with other SOC tooling.
Identifying and delivering continuous improvements to enrich, refine and optimise SIEM capabilities.
Investigating, troubleshooting and resolving service incidents.
Collaborating and conducting knowledge transfer with architects, engineers and subject matter experts.
Implementing organisational standards for design, development, testing, deployment, maintenance and documentation.
Providing clear and accurate SIEM status reporting for technical and non-technical stakeholders.
Mentoring and coaching junior staff within the Cyber Security Operations Centre.
If you currently work within the NHS and if successful at interview, we will initiate an Inter Authority Transfer (IAT) via the Electronic Staff Record (ESR). This retrieves key data from your current or previous NHS employer to support onboarding, including competency status, Continuous Service Dates (CSD), and annual leave entitlement. You may opt out at any stage of the process.
Colleagues with a contractual office base are expected to spend, on average, at least 40% of their time working in our offices.
Staff recruited from outside the NHS will usually be appointed at the bottom of the pay band.
Important: Please be aware there are residency requirements you need to meet:
All NHS England Cyber Security personnel must hold Security Clearance level as a minimum. To meet National Security Vetting requirements, SC clearances require 5 years continuous UK residency. In certain cases, this can be reduced to three years continuous UK residency, with additional overseas checks for the previous two years. Candidates who were posted abroad for service with HM Government, Armed Forces or within a UK government role will still be considered.
Please make sure you meet these requirements before applying for this role. You do not need to have SC already; however, failure to achieve the requirements for SC after offer will result in the job offer being withdrawn. For further advice please check https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels#security-check-sc
The post of Senior Security Analyst has been awarded a Recruitment and Retention Premia (RRP) in response to current labour market conditions. In recognition of this, the role attracts an additional monthly RRP payment equal to 20% per annum. Please be aware that RRP is non-contractual and subject to review.
Person Specification
Knowledge
Extensive knowledge of the tools and techniques used for creating software, hardware, networking and application infrastructure; ability to meet information security objectives while using these.
Detailed knowledge of the processes and techniques used to identify, clarify, and organise system requirements for users and systems within a business; ability to utilise use case modelling, define and document business requirements and application scenarios during this process.
Advanced specialist knowledge of concept, procedures and processes of Security Information and Event Management (SIEM); ability to utilise related applications to protect organisational networks from cyber risks.
Skills & Experience
Detailed knowledge of and the ability to monitor, measure, and optimise individual and combined utilisation of hardware, software and telecommunications components.
Extensive knowledge of and ability to use a variety of tools and techniques for conducting, automating, simplifying and enhancing system testing.
Qualifications
Masters level degree in Cyber Security or a relevant subject, or equivalent level of experience
Disclosure and Barring Service Check
This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.
Employer name
NHS England
Address
Wellington Place, Leeds / Hexagon House, Exeter / Wellington House, London
£69,033.60 to £77,700 a year (Excluding HCAS) (this includes a RRP payment of 20%)
Contract
Permanent
Working pattern
Full-time
Reference number
990-TDD-CY-EC2624-E-A
Job locations
Wellington Place, Leeds / Hexagon House, Exeter / Wellington House, London
#J-18808-Ljbffr