Security Operations Centre (SOC) Analyst

Job summary

Defra is the UK government department responsible for safeguarding our natural environment, supporting our world-leading food and farming industry, and sustaining a thriving rural economy. Our broad remit means we play a major role in people's day-to-day life, from the food we eat, and the air we breathe, to the water we drink.

Digital, Data, Technology and Security (DDTS) is the trusted team for digital across the entire Defra Group.

We have around 1,000 colleagues across DDTS and our ambition is to make it easier and faster than ever for people to interact with Defra. If you are ready to drive innovation and push boundaries, we want to hear from you. Join us and together we will create a great place for living, and a green and healthy future for all.

Find out more about us on:

• Defra Digital Blog
• LinkedIn
• DefraJobs
• We are Government Digital and Data Candidate Information Pack V3 - 1

Job description

Defra's Security Operations Centre (SOC) is accountable for protecting DEFRA against cyberthreats. Our SOC analysts monitor the network and investigate any potential security incidents.

We are seeking an individual to help build our capability. Working as part of a small team you will be accountable for providing security monitoring and incident response. Using cyber security techniques, you will be ensuring that the DEFRA’s security is maintained. Our Analyst are accountable for the day-to-day handling of alerts in our Security Information and Event Management (SIEM), incidents assigned to the Security Operations Centre and investigating indicators of compromise provided by Threat Intelligence. As a Security Operations Centre (SOC) Analyst you will use a wide range of tool and technical expertise, currently focusing primarily on user behaviour, cloud security & application security.

Defra is transforming its IT security processes via a security improvement plan and approach in line with our new multi-supplier IT operating model. As we develop and grow against this plan the range of services that are protectively monitored by Defra’s SOC will increase.

The SOC team is based in Bristol, Reading and London. The successful applicant will be expected to attend one of these offices for 60% of their working hours and no other office locations will be considered.

We welcome applicants with experience of working in a Security Operations Centre and other technological backgrounds or graduates in a relevant subject who may wish to move into this field of work, it should be noted that you must demonstrate transferable technical skills and a keen interest in cyber security to be considered for the role.

Please note this post requires Security Check (SC) clearance. To gain (SC) clearance all applicants are required to have been a UK resident for a minimum of 5 years. If this requirement is not met, the individual will not be able to progress their application further.

Person specification

Responsibilities

• Accountable for detection, identification and triage of security incidents using the

provided security tooling and IT Service Management (ITSM) tool.

• Expand, tune, and enhance rulesets for our SIEM (Security Information and Event Management) tool etc to identify security incidents and reduce false positives.
• Support the Senior SOC Analyst with Major Incidents and assist the wider SOC team in recovering from security breaches, participating in bridge calls and investigations of security incidents and lessons learned as appropriate.
• Respond to Information Security related queries from stakeholders e.g. wider Security Team or suppliers.
• Work with our cyber partners to better know our estate and how to apply current threat intelligence to make it technologically relevant to our estate.
• Using current tooling run threat hunting queries regularly and investigate results.
• Work with other members of the SOC to improve our threat hunting capability and investigate IOCs (Indicators of Compromise) provided by Threat Intelligence or our cyber partners, including the National Cyber Security Centre (NCSC).
• Communicate and engage with a wide range of stakeholders, telling the story of our work and the service we deliver.

Skills and Experience

• Experience of working in an Cyber Security environment and hold or be working towards a Cyber Security qualification at level 4 and above or an equivalent.
• A good communicator who has the capability to explain complex technical information to senior management and other non-technical staff using language that is plainly understood.
• Self-starter who is keen to learn about new and emerging technologies and cyberthreats and how those threats may apply to a public sector organisation.
• Demonstrate good customer service skills and experience with the ability to be adjustable in all situations.

Selection process

The Civil Service marks each element of the selection process on a merit basis. You can visit the gov.uk website for further information on the Civil Service rating scale.

Ensure you have tailored your CV and your Personal Statement to the 'responsibilities' and 'skills and experience' section of the job advert by providing examples on how you are suitable for the role. You may find the STAR method helpful when writing your personal statement.

For further information on STAR, you can check out our hints and tips document.

Application

Prior to application you will be invited to complete a Civil Service Judgement test, if successful you will be invited to complete the full application.

Online Test

After submission of the first stage of your application you will be invited to complete a Civil Service Judgement Test. If you successfully pass the test, you will be invited to complete the final stage of the application.

Please complete the online tests as soon as possible (within 24-48 hours is recommended), the closing date for the tests is 23:55pm on 11th September 2026. If you fail to complete the online test before the deadline your application will be withdrawn. Guidance for the test will be available when you are invited to take the test. The tests are administered online and accessed via the CS Jobs website.

Do not leave completing the tests until the last minute in case you experience any access or technical issues. There may not be technical support available after business hours and after 2pm on the closing date of 11th September 2026.

While the tests should work on most operating systems and modern browsers with a good internet connection, we cannot guarantee that every combination will work. At the beginning, the test will check which browser you are using, and alert you if it is likely to be incompatible.

It is highly recommended that you complete the online tests on a desktop computer, not a mobile phone or tablet.

Please note that online tests associated with this vacancy are not subject to time limits; for further information visit the Reasonable adjustments for online tests - a candidate guide

Online Test Maintenance

Our online test supplier will be performing scheduled maintenance between 4.00pm - midnight on 30th August 2026 . You will be unable to access tests during this period.

If you are in the middle of a test when the maintenance begins, your progress will be paused. You will be able to resume your test from where you left off via your application centre once the downtime has ended. Please note that you will not be able to launch any new tests while the system is offline.

You will be directed to the Talogy - True Talent – Scheduled Maintenance Window Webpage for online tests during an outage.

As part of the application process, you will be assessed on your experience . This will be evaluated by looking at your CV and personal statement, so please provide the following and ensure your experience is clearly demonstrated:

• A CV
• A 500-word personal statement: Referring to the 'skills and experience' sections of the job advert, please demonstrate how you are suitable for the role by providing relevant examples.

Further details around what this will entail are listed on the application form.

Sift

Sift will begin shortly after the advert closes.

Should there be a large number of applications, an initial sift will be conducted using your CV. Candidates who pass the initial sift may be progressed to a full sift, or progressed straight to interview.

Interview

If successful at sift stage, you will be invited to interview where you will be assessed on Technical Skills, Strengths and the Behaviours listed below.

Interviews will commence no earlier than the 5th of October and may be subject to change. Interviews will be held virtually via MS Teams.

For further information on Success Profiles , please use the links below and watch our videos on Defra Jobs .

• Behaviours
• Experience
• Technical Skills
• Strengths
• Behaviours

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions
• Managing a Quality Service

Technical skills

We'll assess you against these technical skills during the selection process:

• Scenario-based exercise on Skills - Incident management and Information security

Benefits

Alongside your salary of £34,765, Department for Environment, Food and Rural Affairs contributes

£10,071 towards you being a member of the Civil Service Defined Benefit Pension scheme.

Find out what benefits a Civil Service Pension provides (opens in a new window).

• 25 days leave (rising to 30 days over 5 years) plus bank holidays.
• A Civil Service pension with an average employer contribution of 28.97%.
• A day off per year for the King's birthday.
• Access to a range of retail discounts (these include supermarket, tech, gym, holiday, phone and more).
• Flexible working options such as condensed hours, part-time and flexi time.
• 3 paid volunteering days per year.
• Funding for professional membership of a recognised professional body.
• Learning and development tailored to your role and budget for training or qualifications.
• A culture encouraging inclusion and diversity.
• Cycle to work scheme.
• Health cash plan to help you manage health costs for a reduced monthly fee.
• Access to the Employee Assistance Programme open 24 hours, 7 days a week, that provides support to you during any times of stress or difficulty.
• Free access to Headspace for wellbeing.
• Season ticket loan for public transport.

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window) , and will assess your Behaviours, Strengths, Experience and Technical skills.

For further information on the selection process for this role, please refer to the person specification section of the job advert.

Location

As part of the pre-employment process for this post, successful candidate(s) will be able to agree a contractual workplace from those locations listed in this advert. The agreed contractual workplace is then the substantive and permanent place of work for the successful candidate(s).

Where the location is ‘National’ the successful appointee should discuss and agree an appropriate contractual location in line with both Defra’s location policy and site capacity, prior to proceeding with pre-employment processes.

The agreed amount of time spent at a workplace for this post will reflect th