Description
The Department for Business, Innovation, Science and Trade (BIST) helps businesses invest, innovate, export and grow across the UK. The Digital, Data and Technology (DDaT) directorate helps to deliver this by designing, building and running the services, platforms and technology that businesses and colleagues rely on every day.
You will be helping to protect BIST and the wider UK government from cyber threats in a fast-paced and exciting role. Reporting and acting as the main support to the Senior Cyber Threat and Vulnerability Analyst and Principle Cyber Threat and Vulnerability Manager. The Threat and Vulnerability Analyst will work with other members of the SOC and technical teams to execute operational threat and vulnerability management activities and help shape the development of BIST’s TVM program and capabilities.
Main responsibilities
- Threat Intelligence and assessment:
- Conduct structured threat hunting and analysis to identify potential threats to BIST, using relevant threat intelligence sources and available security data to detect emerging threats, vulnerabilities and patterns of concern.
- Analyse and communicate relevant threat intelligence, providing actionable information to SOC colleagues and wider technical teams to support investigation, protective action and vulnerability prioritisation.
- Penetration Testing:
- Coordinate penetration testing, vulnerability assessments and security assurance activities across BIST systems, products and technologies, acting as a key cyber point of contact for service teams and testing providers throughout testing engagements.
- Review and assess penetration testing findings, supporting service teams in understanding vulnerabilities and associated risk, and track findings through the agreed remediation and risk-management process.
- Support the verification and closure of findings by reviewing remediation evidence and coordinating appropriate retesting or validation activity.
- Vulnerability management:
- Identify, analyse and assess vulnerabilities and security misconfigurations across BIST's platforms, applications and multi-cloud environments, applying BIST's risk-based approach to support effective prioritisation.
- Provide practical technical advice to service teams on vulnerability remediation and secure configuration improvements, escalating complex or significant issues where appropriate.
- Work collaboratively with service teams and other cyber colleagues to monitor vulnerabilities through the remediation lifecycle and provide clear visibility of outstanding security risk.
- Use vulnerability management and application security testing tools and data to investigate findings, identify trends and support the reduction of risk across BIST's technology estate.
- Cyber Operations:
- Contribute to the effectiveness of the operational TVM service through continuous improvement of processes, tooling and ways of working.
- Use operational metrics and insights to monitor remediation activities, contribute to continuous improvement initiatives and provide updates to stakeholders on progress, while maintaining knowledge of emerging vulnerabilities, BIST's Information Security Framework and industry best practice.
Person specification
Essential skills:
- Experience working in an enterprise technology setting, preferably with experience working with or in Cyber Security
- Understanding of Cyber threat landscape and threat actors’ techniques, tactics, and procedures
- Understanding of Vulnerability management principles
- Understanding of Threat hunting in a cloud-based environment including interpreting device and application logs from various sources in a cloud environment, and monitoring for emerging threat patterns and vulnerabilities
- Familiarity with industry frameworks and standards such as NCSC pen test guidance, OWASP, CVSS, NIST, ISO 27001 etc
- Excellent written and verbal communication skills, including the ability to relate technical information to a non-technical audience
Desirable skills:
- Experience working with cloud environments such as AWS and/or Azure
- A relevant cyber security qualification or equivalent professional experience, for example SANS, CompTIA, EC-Council or a relevant degree
Benefits
- Learning and development tailored to your role
- A flexible, hybrid working environment with options like condensed hours
- A culture encouraging inclusion and diversity
- A Civil Service pension with an average employer contribution of 28.97%
- Annual leave starting at 25 days rising to 30 days with service
- Three paid volunteering days a year
- An employee benefits programme including cycle to work