Cyber Security Analyst – Incident Response

About the role

Join GCHQ’s Cyber Security Incident Response Team (CSIRT) as a Cyber Security Analyst. You will protect critical systems from a wide range of cyber threats, working in a high‑stakes environment that safeguards the UK’s networks and data.

Key responsibilities

• Review alerts and overnight activity, prioritising incidents by severity.
• Analyse high‑priority alerts using logs, network traffic and endpoint data with tools such as Splunk.
• Collaborate with IT and security teams to gather information and mitigate emerging threats.
• Monitor security alarms, create new detection content and apply threat intelligence to strengthen defences.
• Develop automations to improve SOC efficiency and respond to security breaches.
• Provide specialist support for digital forensics and assist with HR casework when required.

Required profile

• Problem‑solver with curiosity about system protection and a desire to develop cyber security skills.
• Experience in at least one core cyber security discipline (malware analysis, intrusion detection, security monitoring or incident response), preferably within a SOC environment.
• Solid understanding of Windows and Linux operating systems.

Required skills

• Splunk
• Windows
• Linux
• Malware analysis
• Intrusion detection
• Security monitoring
• Incident response
• Digital forensics
• Threat intelligence
• Automation
• Security Operations Centre (SOC) processes
• Detection content creation

What we offer

• Flexible working arrangements, including part‑time and compressed hours.
• Competitive salary of £37,892 per year, with potential additional skills payments after 6‑13 months.
• Opportunities to work on high‑impact projects and develop expertise in cyber security.
• Supportive team environment focused on collaboration and continuous learning.