To apply direct for this role please visit Civil service Jobs and quote ref no.
HMRC is the UKs tax, payments, and customs authority. Our vital purpose is to collect the money that pays for the UKs public services and help citizens with targeted financial support. As such, the need to protect and preserve the ability of HMRC to function and serve the public against threats posed by possible cyber-attacks is critical. Cyber Threat Operations (CTO) is part of the Cyber Security Delivery (CSD) function in HMRC Security. CTO covers a diverse range of responsibilities across the span of anti-phishing, brand abuse management, cyber threat intelligence, data science, and threat hunting. We are seeking an G7 Cyber Threat Intelligence Lead, who will report to the G6 Head of CTO. The successful candidate will manage three SO Cyber Threat Intelligence Managers and one SO Threat Hunting Manager.
Job description As the Cyber Threat Intelligence Lead, on a day-to-day basis you will be overseeing and directing the work of Cyber Threat Intelligence and Threat Hunting which will involve: Overseeing the delivery of high quality cyber threat analysis at the tactical, operational, and strategic levels, managing all aspects of this including stakeholder requirements, technical collection and investigation methods, and employment of analytical best practice; Steering, supporting and directing threat hunts on the HMRC estate; Introducing new tooling, technologies, and processes to continue to mature the teams capability; Developing and maintaining threat understanding through subject matter expertise and productive partnerships and networks across wider government departments. Person specification The responsibilities for this role will include: Driving the production of intelligence to inform our understanding of the current and future threat landscape for HMRC, its people, and platforms; Managing and motivating personnel to deliver to the best of their capacity; Liaising closely with colleagues across other CTO functions to inform threat-focused outputs and joint-working efforts; Supporting efforts to drive towards increased automation and adoption of AI-enabled capabilities where appropriate; Forging relationships with other teams in CSD, HMRC Security, and beyond, to further the goals of CTO in protecting HMRC Essential Criteria
Proven ability to manage and lead teams operating in cyber intelligence and/or threat hunting; Demonstrated experience in forming and executing strategies aligned with organisational goals; Excellent communication skills (both written and verbal) across a range of outputs, from longform through to presentations; Experience of forging and maintaining effective working relationships with internal and external stakeholders; Ability to work effectively under pressure and direct the progression of multiple tasks simultaneously.
Desirable Criteria
Familiarity with open source (clear, deep, and dark web) investigations and associated tooling such as Cyjax, Flashpoint, Silobreaker etc Familiarity with threat hunting methodologies Familiarity with cyber threat intelligence models and frameworks like the Diamond Model, MITRE ATT&CK etc Familiarity with email security tools and/or SIEM/SOAR tooling like Splunk/Sentinel etc Relevant cyber or intelligence qualifications such as CCTIM, GCTI etc
TPBN1_UKTJ