Incident Response Analyst

About the job

• Benefits
• Things you need to know
• Apply and further information

• Location
• Bristol Regional Centre - 3 Glass Wharf
• Cardiff Regional Centre - Ty William Morgan
• Edinburgh Regional Centre - Queen Elizabeth House
• Leeds Regional Centre - Wellington Place
• Salford - Trinity Bridge House
• Telford - Plaza 1 and 2
• Stratford Regional Centre - Westfield Avenue

Please note that due to workforce controls, Stratford is only available to existing HMRC staff in this location. HMRC staff based in Reading can also apply to move to Stratford in line with Migration path. HMRC staff based in 100PS can also apply to move to Stratford.

About the job

Job summary

Discover a career in your hands at HMRC. Whether you're seeking purpose, growth, or a workplace that gives you a true sense of belonging, hear from some of our employees as they share their story about what it’s really like to work at HMRC.

Visit our YouTube channel to watch the full series and come and discover your potential.

Our team is rapidly growing as we invest in new technologies and capabilities, and we are in search of enthusiastic individuals who can help us in achieving our mission. We are continually improving the service we give to our customers and, in line with this, we are creating a new response and management team within the HMRC Fraud Prevention Centre.

The Fraud Prevention Centre (FPC) is a strategic capability within HMRC Security, designed to safeguard customers and the organisation against identity-related fraud and emerging threats. Its mission is built on three interconnected pillars: Protection, Detection, and Response, all underpinned by advanced threat intelligence and customer support. The Centre operates across multiple functional areas, including Proactive Protection, Customer Support & Response, and Strategy & Advisory, to deliver a holistic approach to fraud prevention.

Job description

As an Incident Response Analyst, you will act as a key point of contact within the FPC Incident Response Team. You will assess, triage and analyse identity led fraud incidents, supporting effective response activities and helping to minimise the impact on business operations. Working collaboratively with colleagues and stakeholders, you will review existing weak processes, identify opportunities for improvement, and contribute to the development of effective incident response procedures and mitigations. Your work will support the timely restoration of services and the continuous improvement of fraud incident management across the FPC.

Person specification

• Act as an FPC subject matter contributor for fraud incident management, working with colleagues and stakeholders to ensure effective incident response arrangements are in place and standards are adhered to.
• Analyse and resolve detected fraud incidents, contributing to lessons learned activities and identifying opportunities for continuous improvement.
• Support the day-to-day activities of the incident response team, reviewing incidents and contributing to response efforts, helping to prioritise and coordinate activities across the end-to-end fraud incident response cycle.
• Contribute to the development of incident management capability across the FPC, working with SO Incident Response Analysts to promote best practice and consistent application of standards.
• Support FPC SOs and G7s in producing reports and presentations for a variety of stakeholders, communicating technical information in an accessible and meaningful way.
• Experience in developing, delivering and improving IT operations within a complex environment, particularly in incident management.
• Support the capture, dissemination and maintenance of incident information within the incident register, ensuring records, processes and documentation remain accurate and up to date.
• Provide regular updates on incidents and response activities to the G7 Incident Response Lead.
• Contribute to the development and improvement of incident response plans, processes and capabilities, supporting effective information sharing across teams.
• Work collaboratively with HMRC stakeholders, including incident response teams, to escalate findings and support the mitigation of fraud risks.
• Review incidents, provide guidance to colleagues where appropriate, and support the development of FPC processes, standards and templates.
• Maintain awareness of the current threat landscape, emerging fraud risks and developing industry practices.
• Knowledge of fraud detection techniques, including behavioural analysis and anomaly detection and investigation and OSINT (Open Source Intelligence) methods.
• Support the effectiveness and efficiency of FPC Incident Response Services through the identification of opportunities to improve processes, controls and ways of working.
• Share knowledge and experience with colleagues across the FPC, helping to build confidence, capability and understanding of fraud incident management.

Essential Criteria

• To have, or be willing to achieve CISMP
• Knowledge of fraud detection techniques, including behavioural analysis and anomaly detection and investigation and OSINT (Open Source Intelligence) methods.
• Data analysis skills and experience with large data sets, with proficiency scripting complex queries in analysis environments.
• Solid technical understanding of web and API services (e.g. cookies, IP addresses, authentication processes) and threats to those services from cybercrime actors and tools.
• Experience using Security Information and Event Management (SIEM) platforms, preferably in a security operations setting.  
• A sound understanding of Identity, Verification and Authentication principles 

Desirable Criteria

• A degree in Data Analysis, Data Science, Information Security, Cyber Security, or other Cyber qualifications eg SANS, or at least previous experience in a relevant cyber role.  
• Active use of at least one of the following: Python, SQL, KQL, SPL

The successful candidate may be required to apply for Developed Vetting (DV) clearance level once in post but must already hold or be willing to obtain Security Check (SC) clearance level before starting the role

Further Location Information

Please ensure that you only apply for a location that you are willing and able to work from, as we will only make one offer of employment. Any additional notes included in a ‘Further Location Preferences (optional)’ field within the application form, will not be considered. Please be aware that you cannot change your location preference after submitting your application.

Office closures

For more information on where you might be working, review this information on our locations .

If your location preference is for one of the following sites, it’s important to note that these are not long-term sites for HMRC and we will require you to move to a new building in the future, subject to our location strategy and the applicable employee policies at that time.

These sites are:

• Telford Plaza, Telford - moving to Parkside Court, Telford
• Trinity Bridge House, Salford - moving to an alternative office in Manchester/ Salford

You will be given more information about what this means at the job offer stage.

Leeds Locations

Moves Adjustment Payment will be available for this role, provided the successful applicant is a current HMRC colleague in Bradford and meets the eligibility requirements outlined in the HMRC’s Moves Adjustment Payment guidance.

Technical skills

We'll assess you against these technical skills during the selection process:

• Incident Response
• Monitoring

Benefits

Alongside your salary of £37,682, HM Revenue and Customs contributes

£10,916 towards you being a member of the Civil Service Defined Benefit Pension scheme.

Find out what benefits a Civil Service Pension provides (opens in a new window).

HMRC operates both Flexible and Hybrid Working policies, allowing you to balance your work and personal commitments. We welcome applications from those who need to work a more flexible arrangement and will agree to requests where possible, considering our operational and customer service needs.

We offer a generous leave allowance, starting at 25 days and increasing by a day for every year of qualifying service up to a maximum of 30 days.

• Pension - We make contributions to our colleagues’ Alpha pension equal to at least 28.97% of their salary.
• Family friendly policies.
• Personal support.
• Coaching and development.

To find out more about HMRC benefits and find out what it’s really like to work for HMRC hear from our insiders or visit Thinking of joining the Civil Service

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window) , and will assess your Strengths, Experience and Technical skills.

How to Apply

As part of the application process, you will be asked to provide the following:

• A name blind CV detailing your job history, which should cover up to a maximum of your last 3 roles. Give a brief summary of what you delivered and any key achievements in each role (max 100-words per role).
• A 1000-word personal statement, describing how your skills and experience would make you suitable for the role, and how you meet the Essential Criteria and Person Specification.
• A 250-word example for the Technical Skills: Incident Response & Monitoring.

Please complete a separate statement (Max 250 words) for the Desirable Criteria where applicable. This is not essential for the role but may be considered by the vacancy-holder where candidates have the same scores at interview.

Sift

In the event of a large number of applications being received, an initial sift may be held on your CV.

At full sift your CV, your Personal Statement and your technical statements, will be assessed, with the successful candidates being invited to interview.

We may also raise the score required at any stage of the process if we receive a high number of applications.

Interview

During the panel interview, Strength-based questions will be asked to explore what you enjoy and your motivations relevant to the role. You will also be asked Experience and Technical questions.

[ This is an example of a strengths-based question] :

“It is often said that the customer's needs should come first. To what extent do you agree or disagree with this statement?”

There is no expectation or requirement for you to prepare for the strengths-based questions in advance of the interview, though you may find it helpful to spend some time reflecting on what you enjoy doing and what you do well.

Here is the link to the framework: Government Digital and Data Profession Capability Framework - Government Digital and Data Profession Capability Framework

Interviews will take place via video link. Sift and interview dates to be confirmed. Please note that circumstances may arise that require the planned interview format to change. We will endeavour to provide you with as much notice of any change as possible.

Eligibility

Please take extra care to tick the correct boxes in the eligibility sections of your application form . Mistakes sometimes happen but if you contact us later than two working days (Monday-Friday) before the vacancy closes, we may not be able to reopen your applica