Senior Response Manager – Senior SOAR & Detection-as-Code (DaC) Analyst – Home Office Cyber Security Operations Centre

Overview

In this role you will strengthen cyber detection, response and automation within the Home Office CSOC. You will design and operate security automation, playbooks and Detection-as-Code to improve incident handling and containment. You’ll work with cross‑functional teams to implement advanced detection, respond to threats, and contribute to security standards and process improvements. The role offers opportunities to shape security operations, engage in red team activities and threat hunting, and develop alongside a collaborative, security‑minded culture.

Pay / Benefits

• Civil Service Pension with employer contributions
• 25 days annual leave + 8 public holidays + 1 privilege day
• Hybrid/flexible working options with minimum 60% office presence
• In-year reward scheme for exceptional achievements
• Capability-based allowance potential
• Defined benefit pension scheme

Responsibilities

• Conduct security monitoring, detection and response in line with standards, advising on mitigation and risk reduction
• Identify and investigate indicators of malicious activity across networks, systems and applications
• Triage security events and alerts, support investigations and enhance monitoring and detection coverage
• Support incident response activities including red teaming and threat hunting, and document lessons learned
• Develop and continuously improve monitoring use cases, detection content and alert effectiveness
• Define and enhance processes, tooling and security controls to address emerging threats and mitigate risk
• Drive service and process improvements using best practices to optimize security operations

Key requirements

• Demonstrable passion for Cyber Security, Detection and Response
• Experience in a Security Operations Centre environment
• Designing, developing, testing and improving security automation workflows and playbooks using SOAR or similar technologies with Detection-as-Code
• Strong verbal and written communication, adaptable for varied audiences
• Ability to build partnerships across an organisation and manage technical teams

• Collaborative mindset
• Stakeholder relationship management
• Problem-solving and good judgement
• SOAR platforms or comparable automation technologies
• Detection-as-Code methodologies
• Incident management and security operations

…