NMC Cyber Incident Responder; Cloud Security

Position not right for you?
Share it with someone you know.

Join Police Digital Service as NMC Cyber Incident Responder (Cloud Security)

Salary starting at £55,000 per annum

As a member of the National Management Centre (NMC) Cyber Incident Response team, you will lead and support the investigation of cyber security incidents affecting UK policing. This role combines incident response, cloud security and stakeholder engagement, requiring the ability to identify, contain and investigate sophisticated cyber threats across traditional, hybrid and cloud-hosted environments.

You will investigate incidents across cloud, endpoint, network and identity platforms, analysing security telemetry and attacker activity to determine scope, impact and root cause. Working alongside threat intelligence, detection engineering and force stakeholders, you will provide technical advice to support incident response, recovery and organisational decision-making.

Key Responsibilities

• Lead and support investigations into cyber security incidents affecting UK policing, including ransomware, malware, unauthorised access, data compromise and insider threats.
• Conduct technical investigations across endpoints, servers, cloud environments and identities to determine the scope, root cause and impact of incidents.
• Support containment, eradication and recovery activities through evidence-based recommendations.
• Develop and maintain investigative methodologies, playbooks and procedures aligned to recognised incident response frameworks.
• Lead and support investigations into cyber incidents affecting Azure, AWS and GCP environments.
• Analyse cloud telemetry, audit logs, identity events and security alerts to identify malicious activity and support incident response activities.
• Investigate attacks targeting the identity control plane, including Microsoft Entra  other identity providers (IdPs), identifying compromised accounts, privilege escalation and unauthorised access.
• Support response activities across cloud infrastructure, workloads and SaaS platforms, providing technical expertise during active incidents.
• Work closely with threat intelligence, detection engineering and force stakeholders to improve investigative outcomes and situational awareness.
• Translate lessons learned into improvements to cloud security controls, detections, playbooks and response procedures.

Stakeholder Engagement

• Act as a trusted advisor to police forces and policing organisations during cyber incidents.
• Deliver clear technical and strategic briefings to senior stakeholders, including Chief Officers, CIOs, Heads of IT and Heads of Cyber Security.
• Coordinate with internal and external stakeholders to ensure effective incident management throughout investigations.
• Support national coordination activities where incidents have cross-force or sector-wide implications.
• Apply threat intelligence, attacker TTPs and frameworks such as MITRE ATT&CK to support investigations and response activities.
• Identify trends, lessons learned and opportunities to improve cyber resilience across UK policing.
• Contribute to the development of detection capabilities and incident response processes through post-incident reviews and technical findings.
• Support knowledge sharing, mentoring and capability development across the wider NMC function.

What you need to succeed in the role

• Experience investigating and responding to cyber security incidents within enterprise environments.
• Experience investigating ransomware, malware, unauthorised access, cloud compromise and data breach incidents.
• Experience analysing telemetry from cloud, endpoint, network and identity platforms to determine attacker activity, scope and impact.
• Experience working with Azure, AWS or GCP environments.
• Experience investigating identity-based threats involving Microsoft Entra  other identity providers (IdPs).
• Strong understanding of attacker tactics, techniques and procedures, and the incident response lifecycle.
• Experience using EDR, SIEM and cloud security tooling to support investigations and response activities.
• Ability to communicate technical findings and recommendations to senior stakeholders.

We are committed to equal opportunities for all and will not discriminate on any grounds. We encourage applications from people from the widest possible span of experience. All applicants will be considered without attention to age, ethnicity, religion, sex, sexual orientation, gender identity, parental status, nationality, neurodiversity or disability status.

Working…