Support Analyst

Cyber Security Operations Support Analyst – UK Health Security Agency

The UK Health Security Agency (UKHSA) is recruiting a Cyber Security Operations Support Analyst to join its Cyber Security Operations team.

This is a permanent Senior Executive Officer (SEO) position with flexible working options, including full-time, part-time and job-share arrangements.

The successful candidate will support UKHSA’s operational cyber security activities across areas including security monitoring, vulnerability management, incident response, security engineering and digital forensics.

Job Overview

Salary and Market Pay Supplement

The position has a salary range depending on location:

• National: £41,983 – £48,128
• Outer London: £44,148 – £50,121
• Inner London: £46,310 – £52,113

A Market Pay Supplement (MPS) of up to £10,000 per year pro rata may also be available depending on the successful candidate’s capability level.

The MPS levels are:

• Accomplished: Up to £10,000
• Proficient: Up to £6,650
• Developing: Up to £3,350

The MPS is scheduled for review on 1 January 2027.

About the Role

The Cyber Security Operations team at UKHSA is responsible for the organisation’s operational cyber security.

The successful candidate will work as part of the Security Operations team and support the delivery of security operations projects and business-as-usual activities.

The role will involve working on complex security incidents and collaborating with technical teams, suppliers and other stakeholders to detect, contain and remediate security events and risks.

Key Responsibilities

Security Monitoring

You will:

• Monitor, triage and investigate security alerts.
• Identify and analyse potential security incidents.
• Analyse security event data to support incident response and reporting.
• Escalate security incidents where appropriate.
• Support automated monitoring processes.
• Work with SIEM and network analysis technologies.
• Help improve security monitoring and detection capabilities.

Incident Response

Responsibilities include:

• Following UKHSA incident response policies and procedures.
• Supporting the response to cyber security incidents.
• Providing standardised advice on mitigation.
• Escalating complex incidents to the appropriate team leader.

Vulnerability Management

You will also:

• Triage and prioritise security vulnerabilities.
• Support vulnerability management throughout its lifecycle.
• Implement appropriate mitigating measures.
• Provide advice on improving security controls.
• Communicate mitigation strategies such as patching and system hardening.

Digital Forensics

The successful candidate will:

• Support the implementation of forensic readiness policies.
• Work with other teams to maintain forensic readiness.
• Analyse digital evidence to identify potential breaches of policy, regulation or law.

Collaboration

You will work closely with:

• Cyber security teams
• Technology teams
• Privacy teams
• Internal stakeholders
• External suppliers

Essential Criteria

Applicants should demonstrate the following:

• An interest in cyber security.
• A proactive approach to investigating data in a work or educational environment.
• The ability to analyse and interpret data.
• Strong verbal and written communication skills.
• Knowledge of Common Vulnerabilities and Exposures (CVEs) and remediation techniques.
• Solid operational knowledge of Threat Intelligence Platforms, SIEM appliances or intelligence feeds used in large organisations.
• Experience working with large LANs and cloud environments, preferably AWS or Azure.

Key Skills

The role would particularly suit candidates with experience or knowledge in:

• Cyber Security Operations
• SIEM
• Threat Intelligence
• Security Monitoring
• Incident Response
• Vulnerability Management
• Digital Forensics
• Network Security
• Cloud Security
• AWS
• Microsoft Azure
• CVEs and vulnerability remediation

Working Location and Hybrid Working

The position is offered on a hybrid working basis from one of UKHSA’s core headquarters:

• Birmingham
• Leeds
• Liverpool
• London – Canary Wharf

Employees are expected to spend a minimum of 60% of their contractual working hours, approximately three days per week pro rata averaged over a month, at one of the core headquarters where business needs require it.

Benefits

The successful candidate will have access to a range of benefits, including:

• Civil Service Defined Benefit Pension Scheme.
• Employer pension contribution of 28.97%.
• Learning and development opportunities tailored to the role.
• Flexible working options.
• Inclusive and diverse working environment.
• Opportunities to work on cyber security services supporting millions of citizens.

Application Process

The recruitment process uses the Civil Service Success Profiles framework and will assess:

• Behaviours
• Experience
• Technical skills

Stage 1 – Application and Sift

Applicants must complete an application form and provide a supporting statement of no more than 750 words.

The supporting statement should explain how your skills, experience and knowledge demonstrate that you meet the essential criteria.

CV uploads are not accepted for this vacancy.

Shortlisting

If there is a high number of applications, an initial sift may focus particularly on:

• Solid operational knowledge of Threat Intelligence Platforms, SIEM appliances or intelligence feeds used in large organisations.
• Demonstrable ability to analyse and interpret data.

Stage 2 – Interview

Successful applicants will be invited to a single remote interview.

The interview will assess behaviours, experience and technical skills.

Candidates will also give a 5–10 minute presentation on:

“How AI is Transforming Both Cyber Threats and Security Operations”

The behaviours assessed will include:

• Managing a Quality Service – Lead Behaviour
• Making Effective Decisions
• Delivering at Pace
• Working Together

Security Clearance Requirement

Successful candidates must undergo the required pre-employment security checks, including a Security Check (SC) clearance.

Candidates normally need to have been resident in the UK for the previous five years for meaningful national security vetting.

Having lived outside the UK does not necessarily mean you cannot obtain clearance, but applicants with less UK residency should contact the vacancy holder or recruiting manager for advice.

An international police check may also be required if an applicant has spent more than six months abroad during the previous three years.

Who Can Apply?

The vacancy is advertised as open to external applicants, but nationality and right-to-work rules apply.

The advert is broadly open to:

• UK nationals
• Republic of Ireland nationals
• Commonwealth nationals who have the right to work in the UK
• Eligible EU, Swiss, Norwegian, Icelandic and Liechtenstein nationals with relevant EUSS status
• Certain individuals with limited or indefinite leave to remain
• Turkish nationals and certain qualifying family members who have acquired the right to work in the Civil Service

Is Visa Sponsorship Available?

The advert does not state that visa sponsorship is available for this position.

Applicants who require UK visa sponsorship should not assume that sponsorship or a Certificate of Sponsorship (CoS) will be provided.

Applicants should confirm their right-to-work and sponsorship eligibility before applying.

Important Application Warning

UKHSA states that artificial intelligence tools may be used to support an application, but all examples and statements must be truthful, factually accurate and based on your own experience.

Applications may be withdrawn where plagiarism or misrepresentation is identified.

Application Deadline

Friday, 21 August 2026 at 11:55 PM

How to Apply

Applicants should apply through the official vacancy listing.

Job Reference: 475123

Vacancy: Cyber Security Operations Support Analyst

Employer: UK Health Security Agency

Closing Date: 21 August 2026

Apply Online: Health Jobs UK Vacancy

Contact Information

Job Contact: Timor Miakhel
Email: timor.miakhel@ukhsa.gov.uk

Recruitment Team: recruitment@ukhsa.gov.uk

Final Reminder

This is an opportunity for cyber security professionals interested in working within the UK public sector.

Before applying, carefully review the essential criteria, nationality requirements, right-to-work requirements and Security Check (SC) clearance requirements.

Closing date: 21 August 2026 at 11:55 PM.