Information Security and Monitoring Specialist
Job description
- Job grade: Higher Executive Officer
- Contract type: Permanent
- Business area: DWP - Counter Fraud, Compliance and Debt
- Type of role: Investigation
- Working pattern: Flexible working, Full-time, Job share, Part-time
- Number of jobs available: 1
Location
About the job
Job summary
The post holder will provide dedicated support within Operational Capability and Internal Assurance. This cross-cutting role requires an understanding of the wider team’s responsibilities to deliver a robust service across DWP and partner organisations. The role will consist of a primary specialism alongside additional responsibilities, depending on business requirements at the time of recruitment.
This post requires British nationality (some dual nationals may be ineligible) and a Developed Vetting (DV) clearance. You will also need to undergo additional security clearance checks, with the offer of employment being conditional on obtaining all necessary security clearances.
Job description
You will work as a member of the Operational Capability (OC) Team in the Department's Cyber Resilience Centre (CRC), at the forefront of detecting and investigating potential security threats across CRC. Your primary focus will be on identifying indicators of compromise and malicious activity, conducting in-depth analysis of system alerts and logs, and ensuring swift, effective responses to emerging risks.
You will work closely with stakeholders across CRC and the wider security community to coordinate responses, escalate incidents when necessary, and support investigations with clear, actionable intelligence. Your expertise in Security Information and Event Management (SIEM) tools will be critical in driving informed decision-making.
This role requires a background in information security, incident response, and protective security practices, with the ability to operate discreetly and decisively in high-assurance environments.
Person specification
Key Responsibilities
- Monitor and analyse system alerts and logs to detect suspicious or malicious activity.
- Conduct proactive threat hunting and incident investigations.
- Escalate and present potential incidents with comprehensive supporting evidence.
- Collaborate with internal teams and external partners to coordinate responses to threats.
- Take remedial actions following inappropriate internal behaviour or security breaches.
- Support and manage access to secure site, systems and services, ensuring that access is granted, maintained, and reviewed in line with security policies and business requirements.
- Contribute to the development and continuous improvement of monitoring systems, processes, and playbooks.
- Support strategic capability development alongside the Head of Operational Capability.
- Provide operational support to the team as needed.
What We’re Looking For
We are seeking a highly motivated and experienced professional who can demonstrate
Essential Criteria
- Experience in using SIEM tools and other security technologies. (Lead Criteria)
- Ability to monitor, investigate and manage sensitive information with discretion. (Second Lead Criteria)
- Experience in cyber security monitoring and incident response.
- Strong analytical skills with the ability to interpret complex data and logs.
- Excellent communication and stakeholder engagement skills.
Essential Security Criteria
Please note that the role that you are applying for requires National Security Vetting (NSV) to the level – Developed Vetting (DV). You can find more information at United Kingdom Security Vetting: Applicant - GOV.UK (www.gov.uk) . If you are successful in your application, you will need to attain SC clearance before you can take up the post. This is mandatory and is in addition to completion of Baseline Personnel Security Standard (BPSS).
The purpose of the NSV process is to provide a level of assurance about an individual’s trustworthiness, integrity and reliability, and other factors that increase their vulnerability to corruption or risk of committing a security breach. It involves the investigation of an individual’s background and circumstances to achieve this aim.
For meaningful checks to be carried out, you will need to have lived in the UK for a sufficient period of time to enable appropriate checks to be carried out and produce a result which provides the required level of assurance. Candidates are required to meet the UK residency requirements so that National Security Vetting (NSV) checks can be conducted. Depending on the level of NSV required, you must have resided continuously in the UK for at least 7 of the last 10 years, 2 of which must have been the immediately preceding years from the point of applying for this job.
The application process will ask for personal details about you, your address history, previous relationships, your parents, your employment history, your financial circumstances, and details of any pending, spent or unspent convictions. This list is not exhaustive. Please view the Vetting explained - GOV.UK (www.gov.uk) for more information.
If you require any further information, please contact the vacancy holder. The details are on the jobs portal through which you made your application.
If you are successful in your application, we recommend that you familiarise yourself with the NSV process and advise that you collate as much information as you can prior to starting your Vetting application.
Behaviours
We'll assess you against these behaviours during the selection process:
- Communicating and Influencing
- Making Effective Decisions
- Changing and Improving
Technical skills
We'll assess you against these technical skills during the selection process:
- Relating to your experience with SIEM tools to collect, analyse and correlate security events.
Benefits
DWP have a broad benefits package built around your work-life balance which includes:
- Working patterns to support work/life balance such as job sharing, term-time working, flexi-time and compressed hours.
- Generous annual leave – at least 23 days on entry, increasing up to 30 days over time (pro–rata for part time employees), plus 9 days public and privilege leave.
- Support for financial wellbeing, including interest-free season ticket loans for travel, a cycle to work scheme and an employee discount scheme.
- Health and wellbeing support including our Employee Assistance Programme for specialist advice and counselling and the opportunity to join HASSRA a first-class programme of competitions, activities and benefits for its members (subscription payable monthly).
- Family friendly policies including enhanced maternity and shared parental leave pay after 1 year’s continuous service.
- Funded learning and development to support progress in your role and career. This includes industry recognised qualifications and accreditations, coaching, mentoring and talent development programmes.
- An inclusive and diverse environment with opportunities to join professional and interpersonal networks including Women’s Network, National Race Network, National Disability Network (THRIVE) and many more.
Things you need to know
Artificial intelligence
Selection process details
**Ensure that you read the full information about the selection process thoroughly before starting your application**.
Please note the closing date for your full application (Application form, CV and personal statement) is 23:55 on 17th November 2026**
Stage 1 – Application Form
Please complete the application form with your basic information, which includes your personal details, eligibility to apply and any reasonable adjustments required.
Stage 2 - Curriculum Vitae (CV)
You will be asked to complete a CV with details of your job history, full qualification details, previous skills and experience. You are not required to upload your personal CV.
In the previous skills/experience section you should detail your employment and/or education history relevant to this vacancy (we recommend a maximum of 500 words). The CV will also cover your work history (we recommend you include up to the last 3 roles of employment history, plus any others that you feel are relevant) and your qualifications.
Your CV will be scored along with your personal statement.
Stage 3 – Personal Statement and Sift
As part of the application process, you will be asked to complete a personal statement in no more than 750 words detailing the relevant skills and experience you can bring to the role, based on the essential criteria listed.
Please read and understand the essential criteria thoroughly, as this is what your written evidence will be assessed against. Pay particular attention to the lead criteria and second lead criteria as if you do not demonstrate these on your application, you will not progress to the interview stage.
Your layout is entirely your preference; you may choose narrative, bullets, etc. You may choose to address each criterion separately; however, one narrative example may cover and evidence several key criteria. You may not be able to meet all the key criteria, but please ensure you evidence the key personal requirements, what have you done that’s relatable to the requirements. You don’t have to explain the whole process, just what you have done and the skills and experience you have used.
Should a large number of applications be received, an initial sift may be conducted using the lead criteria or lead and second lead criteria. If so, we will sift on:
- Experience in using SIEM tools and other security technologies. (Lead Criteria)
- Ability to monitor, investigate and manage sensitive information with discretion. (Second Lead Criteria)
Candidates who pass the initial sift may be progressed to a full sift or progressed straight to an interview.
**The closing date for all stages of your application is 23:55 on 17/11/2027. If you fail to complete all stages before the deadline, your application will be withdrawn**
The sift is scheduled to be held from 23/11/2026 to 27/11/2026. These dates may be subject to change.
Following completion of the sifting period above, results will be collated, and candidates will receive confirmation of the outcome. Those candidates who have met the agreed pass mark will be invited to interview.
No feedback will be provided at this stage.
Stage 4 - Interview
If you pass the written application sift with the required score, you will be invited to a blended interview and will receive an electronic notification to your Civil Service Jobs account. If high application volumes are received, the benchmark / score for candidates to proceed to the interview stage may be raised.
The interviews will be conducted face to face. Where possible the interviews will take place in London, however candidates may be expected to travel to an alternative location as required.
If you require any reasonable adjustments to attend a face-to-face interview, please ensure you state those on your application form when asked to do so.
Interviews are scheduled to take place from 11/01/2027 to 15/01/2027, please note that these dates are only indicative at this stage and could be subject to change. Interviews will be scheduled Monday to Friday, between 09:00 to 17:00.
Communications will be electronic and/or by SMS/telephone; therefore, it is important that you check your Civil Service Jobs account regularly, as well as your spam/junk email folder. Telephone calls may show as a withheld number, it is important that you answer so that your interview can be confirmed. If you wish to opt out of SMS messages, please email this address, including the vacancy reference and your candidate ID CFCD.RECRUITMENTINBOX@DWP.GOV.UK. As part of our commitment to improving the candidate experience, you may be contacted during the recruitment process to provide feedback.
Preparing for the Interview
The interview will take approximately 40 to 45 minutes and will consist of technical and behavioural based questions. A blended interview aims to be more of a conversation offering a more inclusive approach. The questions explore what you, the candidate, can and have done, but also your potential.
Behaviours
You will be assessed against the Civil Service Behaviours listed at Higher Executive Officer – Level 3.
An example of a behavioural question would be “How did you lead by example to inspire and motivate your teams?”. It may help to use one or more examples of a piece of work you have completed, or a situation you have been in, and use the WHO or STAR model to explain:
- WHO - What it was? How you approached the work/situation? What the Outcomes were, what did you achieve? or
- STAR - What was the Situation? What were the Tasks? What Action did you take? What were the Results of your actions?
Technical
In addition to the behaviours, you will also need to demonstrate your technical skill at interview, as listed above. This will be in the form of questions and will enable you to demonstrate your technical expertise.
If you withdraw your application at any stage, it will not progress further.
Stage 5 – Offer
Once all interviews have been completed, you will be notified of the outcome by email. Our current plan is that this will be week commencing 01/02/2027, but this may be subject to change. Offers will be made in strict merit order to the highest scoring candidate first.
The successful candidate will be notified of a start date following successful pre-employment and security checks, which is likely to be during June 2027.
Visa Sponsorship
Please note that for these vacancies we recommend that applicants seek specialist advice on their eligibility for Visa Sponsorship (if applicable) when considering whether to apply for any role.
We can never guarantee sponsorship; requests will be considered in line with the relevant DWP guidance and Home Office policy in place at the time.
Location
The role available will be based in the following location subject to space availability at the time of posting: London Caxton House
You should only apply for suitable posts where you can travel to and from your home office location daily within a reasonable time. Please be aware that this role can only be worked in the UK and not overseas. Relocation costs will not be reimbursed. Make sure the location work for you before applying!
Hybrid working
This role may be suitable for hybrid working, which is where an employee works part of the week in their DWP office and part of the week from home. This is a voluntary, non-contractual arrangement and your office will be your contractual place of work. If a hybrid working arrangement is suitable for the role and for you, you will normally be required to spend a minimum of 60% of your contracted working hours from your DWP office. If you have a disability, caring responsibilities, or other circumstances that may affect your ability to meet the minimum office attendance requirement, please discuss this with us using the contact details in this advert. Hybrid working will not commence until any training and consolidation period has been successfully completed.
Working pattern
Alternative working patterns will be considered but must meet business needs. We will do our best to let people with existing part-time contracts retain their contracted hours provided they are in line with current business needs. Please note that successful candidates with agreed alternative working patterns may be required to work full time for specific periods to complete all training and consolidation.
Hours of work
The full-time working week in DWP is 37 hours. You may be required to work at any time between the hours of:
- 7:45am and 8:00pm on any day between Monday to Friday, and
- 8:45am to 5:00pm on Saturday.
Managers will agree working patterns with successful candidates within these business hours and review these as appropriate. You will be given advance notice of your personal schedule.
Further Information
At the Department for Work and Pensions (DWP) we value diversity and inclusion and actively encourage and welcome applications from everyone, including those that are underrepresented in our workforce.
Find out more about working for DWP on the DWP Careers Hub.
Reserve List
A reserve list may be held for a period of 12 months from which further appointments can be made.
If you are placed on a reserve list but we cannot immediately offer you a post, please note:
- If you are later offered the role you applied for, in a location you have expressed a preference for, and you decline the offer or are unable to take up the post within a reasonable timeframe you will be withdrawn from the campaign and removed from the reserve list, other than in exceptional circumstances (e.g. a contractual Part Time Working Pattern cannot be accommodated in the initial role offered or in cases of serious ill health).
- If DWP makes an offer of an alternative role or location to that which you originally applied for, and you decline that offer, you will be able to remain on the reserve list.
Disability Confident Scheme
If high application volumes are received, the benchmark for candidates to proceed to the next stage may be raised. In line with our commitment to the Disability Confident Scheme (DCS), we aim to advance all candidates applying under the DCS who meet the minimum standard. However, we may only progress those candidates who best meet the required standards.
Reasonable Adjustments
We consider visible and non-visible disabilities, neurodiversity or learning differences, chronic medical conditions, or mental ill health. Examples include dyslexia, epilepsy, autism, chronic fatigue, or schizophrenia.
If you need a change to be made so that you can make your application, you should contact the Government Recruitment Service via DWPRecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.
Complete the “Reasonable Adjustments” section in the “Additional requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.
If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.
Integrity, plagiarism and Civil Service Principles
The Civil Service values honesty and integrity and expects all candidates to abide by these principles.
Please ensure that all examples provided in your application are taken directly from your own experience and that you describe the examples in your own words.
Examples of plagiarism can include:
- Presenting the work, ideas and experience of others as your own
- Copying content or answers from an online or published source that is not your own
Disclosure and Barring Service and Internal Fraud Database Checks
To process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service on your behalf. However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.
Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment. A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.
If successful and transferring from another Government Department, a criminal record check will be carried out.
Important
New entrants are expected to join on the minimum of the pay band.
Before applying for this vacancy, current employees of DWP should check whether a successful application would result in changes to their terms & conditions of employment, e.g. mobility, pay, allowances. If you are a current employee and are successful you must be able to be released from your current post within four weeks.
Those on protected TUPE/ COSoP terms and conditions applying on promotion or voluntary permanent level move will adopt DWP’s Terms and Conditions and this may have a different impact on pay and allowances. Please review this prior to acceptance of a role.
Civil Servants that would transfer into DWP from other government organisations, following successful application, will assume DWP's terms & conditions of employment current on the day they are posted, unless DWP has stated otherwise in writing. Accepting a post will be taken to mean acceptance of revised terms & conditions.
Civil Servants applying on promotion will usually be appointed to the salary minimum or within 10% of existing salary.
Any move to DWP from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may, however, be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at the Childcare Choices Website.
For further information on National Security Vetting please visit the Demystifying Vetting website.
Feedback
Feedback will only be provided if you attend an interview or assessment.
Security
See our vetting charter (opens in a new window).
Nationality requirements
Working for the Civil Service
We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
Diversity and Inclusion
Apply and further information
Contact point for applicants
Job contact :
- Name : CFCD RECRUITMENT TEAM
- Email : CFCD.RECRUITMENTINBOX@DWP.GOV.UK
Recruitment team
- Email : dwprecruitment.grs@cabinetoffice.gov.uk
Further information
If you are not satisfied with the response you receive from the Department, you can contact the Civil Service Commission. Click here to visit the Civil Service mmission.
Attachments
| Success-Profiles-Candidate-Overview Opens in new window (pdf, 635kB) |
| DWP Terms and Conditions January 2024 Opens in new window (docx, 17kB) |
Share this page
- Gmail
