Senior Cyber Security Analyst; Threat Intelligence

Cyber Operations’ purpose is to support safe care and build public trust by building NHS England’s cyber resilience and enabling the wider health system to be cyber resilient.

• Cyber Security Operations Unit (CSOU & SIO)
• Cyber Delivery Unit (CDU)
• Cyber Improvement Programme
• Chief Information Security Office Function (CISO)

This role is within the Cyber Security Threat Intelligence team within NHS England National CSOC, part of CSOU. The CSOU function provides centralised monitoring and response across NHSE, and the system, which consists of Threat Operations, Protective Monitoring, Incident Management & response and Dev Ops.

The Threat Intelligence function is comprised of four primary functions:

• Performing intelligence collection, aggregation, analysis and contextualisation of healthcare and security information to produce actionable cyber threat intelligence
• Performing high-level risk assessments of current and emerging threats to the health & social care estate
• Producing stakeholder-specific intelligence reporting for internal and external stakeholders
• Providing specialist Cyber Threat Intelligence (CTI) support during high complexity incident

The Senior Security Analyst is responsible for collecting, analysing and disseminating cyber threat intelligence to identify threats to the systems, infrastructures, and resources critical to NHS England and across Health & Care.

The Senior Security Analyst (Threat Intelligence) will perform a supervisory role within the Threat Intelligence team as well as acting as a technical subject matter expert for other teams and stakeholders across Cyber Operations.

• Generating Strategic and Technical Threat Intelligence products for CSOC stakeholders. Supervising a team of threat intelligence analysts as well as reporting and raising issues to senior leadership
• Act as a quality and audit layer for written Threat Intelligence products
• Making Cyber Threat Intelligence decisions within Incident Response scenarios and leading in-depth cyber threat intelligence investigations
• Act as the escalation tier for cyber threat intelligence tasks within Cyber Security tooling including EDR and SIEM tooling
• Interrogate threat intelligence and internal security tooling to identify items of interest and potential cyber threats.
• Proactive research and assessment of Tactics, Techniques and Procedures (TTPs) of cyber threat groups
• Development of analytical procedures to meet changing requirements and team development, as well as adapting to a rapidly changing security environment
• Delivery of technical capability development, identification, and implementation of automation use cases within cyber threat intelligence and Security Operations
• Supporting the ongoing development and continuous improvement of the CSOC’s Cyber Threat Intelligence function in line with industry best practice

Our staff bring expertise across clinical, operational, commissioning, technology, data science, cyber security, software engineering, education, and commercial specialisms — enabling us to design and deliver high-quality NHS services.

• Enabling local systems and providers to improve the health of their people and patients and reduce health inequalities
• Making the NHS a great place to work, where people can develop and make a difference
• Working collaboratively to ensure our healthcare workforce has the right knowledge, skills, values and behaviours to deliver accessible, compassionate care
• Optimising the use of digital technology, research, and innovation
• Delivering value for money

Earlier this year, the Government announced that NHS England will gradually merge with the Department of Health and Social Care, to create a smaller, more strategic centre that reduces duplication and waste.

If successful at interview, we will initiate an Inter Authority Transfer (IAT) via the Electronic Staff Record (ESR). This retrieves key data from your current or previous NHS employer to support onboarding, including competency status, Continuous Service Dates (CSD), and annual leave entitlement. You may opt out at any stage of the process.

Colleagues with a contractual office base are expected to spend, on average, at least 40% of their time working in-person.

Staff recruited from outside the NHS will usually be appointed at the bottom of the pay band.

For further details / informal visits contact:
Name:
Francis Taylor |

Job title:

Security Lead (Analyst) | Email address: england.cyber