Cybercrime Insight Analyst Lead

Job description

Job summary

The Cyber Crime Fraud team has a critical role to play in protecting the integrity of DWP systems from both internal and external threat actors. The team has detected significant organised attacks against DWP systems. Responding to increasingly sophisticated digital attacks by highly motivated attackers is a growing issue for the Department.

You will be part of an innovative and service-orientated team focused on the detection of cybercrime fraud attacks and malicious abuse of DWP systems.

Cyber Resilience Centre (CRC) provides support 24 hours a day, 7 days a week and as a result job holders may potentially be expected to work as part of an on-call rota, which may also attract occasional out of hours working. Work may involve travel to different DWP sites and Government agencies and occasional overnight stays.

This role will be transformational and will include overseeing the development of analysis teams with the ability and vision to use the latest analytical tools to generate groundbreaking and innovative fraud and security alerts. You will ensure the Departments data is used safely, proportionately and legally at all times.

The Cybercrime Insight Analyst Lead will focus on the delivery of innovation, application of insight and collation and assessment of intelligence surrounding Cybercrime threats to DWP Universal Credit, emerging DWP Digital services and legacy benefits.

The lead has a critical role to play leading, directing and managing a team protecting the integrity of our systems from both internal and external threat actors.

You will lead, manage and develop a team of analysts that is rapidly developing new skills and using the latest analytical tools. You will operate in a dynamic environment at the forefront of the Departments cyber protection capability.

Job description

Developing strong and effective working relationships with Data Scientists, Security Information and Event Management (SIEM) engineers and other data analysts to ensure emerging threats identified are fully assessed in terms of their potential impact.

Working discreetly on very sensitive issues ensuring information is shared and disseminated on a very strict need-to-know basis. You will have highly developed of political sensitivities and the nuances of effective communication across diverse areas of Government and at all grades up to a Ministerial level. If in doubt you will seek senior management input before disclosing information.

Leading on work to identify and address collusion between internal and external threat actors. This includes development of an effective rapid response process when an exploit is found, and attendance at incident case management meetings.

Using your knowledge of Government means tested benefits systems, fraud and security vulnerabilities to engage with and influence key stakeholders involved in the design and delivery of new and existing digital programmes to ensure the safeguarding of DWP services.

Working closely with the DWP Integrated Risk and Intelligence Service (IRIS) to understand the IRIS work plan end to end and how CRC fits into this, both in providing key capability and supporting key IRIS functions, as well as those of DWP Digital such as the Dynamic Trust Hub, and fraud case management system.

Representing the Cybercrime team in key IRIS meetings.

Successful candidates will have, or be expected to undertake, the BCS Certificate in Information Security Management Principle (CISMP) or equivalent qualification.

Person specification

Key Criteria

• Experience of using detailed knowledge of principle attack vectors across the security and counter-fraud disciplines and how these threats link to the delivery of Government means tested benefits and digital services. With detailed understanding of supporting policy, and how they can be exploited (Lead Criteria).
• Experience of using analytical tools including SIEM tools to identify security or fraud compromises within large amounts of complex data, performing complex analysis in a high-pressure environment. Demonstrating adaptability and creativity, with the capability to learn quickly and grasp essential details and be comfortable relying on others expertise to inform decision making/assessments (Second Lead Criteria).
• Experience of working with a digital service that requires trust in an identity, with a good understanding of how it can be assessed, manipulated and escalated.
• Ability to influence senior stakeholders to ensure the integrity and safeguarding of new and emerging digital services as well as non-digital systems.
• Experience of working in Government Counter Fraud, Security or Intelligence, managing an operationally focused delivery team operating in a high-pressure environment.
• Experience of using your knowledge of fraud strategies, policies, procedures and relevant legislation to develop an effective response to web-enabled and organised fraud attacks.
• Experience of working in an agile project environment.
• Experience of working discreetly on very sensitive issues ensuring information is shared and disseminated on a very strict need-to-know basis. You will have highly developed understanding of political sensitivities and the nuances of effective communication across diverse areas of Government and externally at all grades up to a Ministerial level.

Essential Security Criteria

Please notethat the role that you are applying for requires National Security Vetting (NSV) to the level Security Check (SC). There may be a requirement to seek Developed Vetting (DV) clearance as the role evolves.You can find more information at United Kingdom Security Vetting: Applicant - GOV.UK (www.gov.uk) .If you are successful in your application, you will need to attain SC clearance before you can take up the post. This is mandatory and is in addition to completion of Baseline Personnel Security Standard (BPSS).

The purpose of the NSV process is to provide a level of assurance about an individuals trustworthiness, integrity and reliability, and other factors that increase their vulnerability to corruption or risk of committing a security breach. It involves the investigation of an individuals background and circumstances to achieve this aim.

For meaningful checks to be carried out, you will need to have lived in the UK for a sufficient period of time to enable appropriate checks to be carried out and produce a result which provides the required level of assurance. Candidates are required to meet the UK residency requirements so that National Security Vetting (NSV) checks can be conducted. Depending on the level of NSV required, you must have resided continuously in the UK for at least 3 of the last 5 years, 2 of which must have been the immediately preceding years from the point of applying for this job.

The application process will ask for personal details about you, your address history,previous relationships, your parents, your employment history, your financial circumstances, and details of any pending, spent or unspent convictions. This list is not exhaustive. Please view the Vetting explained - GOV.UK (www.gov.uk) for more information.

If you require any further information, please contact the vacancy holder. The details are on the jobs portal through which you made your application.

If you are successful in your application, we recommend that you familiarise yourself with the NSV process and advise that you collate as much information as you can prior to starting your vetting application.

Behaviours

We'll assess you against these behaviours during the selection process:

• Leadership
• Making Effective Decisions
• Working Together

Technical skills

We'll assess you against these technical skills during the selection process:

• GSCU1 -Strategy, Systems and Culture Level 3
• Secure operations management - working level
• Intrusion detection and analysis -working level

Benefits

Alongside your salary of 58,961, Department for Work and Pensions contributes 17,081 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).

DWP have a broad benefits package built around your work-life balance which includes:

• These posts may attract a Recruitment and Retention Award of up to 6,500 annually.
• Working patterns to support work/life balance such as job sharing, term-time working, flexi-time and compressed hours.
• Generous annual leave at least 25 days on entry, increasing up to 30 days over time (prorata for part time employees), plus 9 days public and privilege leave.
• Support for financial wellbeing, including interest-free season ticket loans for travel, a cycle to work scheme and an employee discount scheme.
• Health and wellbeing support including our Employee Assistance Programme for specialist advice and counselling and the opportunity to join HASSRA a first-class programme of competitions, activities and benefits for its members (subscription payable monthly).
• Family friendly policies including enhanced maternity and shared parental leave pay after 1 years continuous service.
• Funded learning and development to support progress in your role and career. This includes industry recognised qualifications and accreditations, coaching, mentoring and talent development programmes.
• An inclusive and diverse environment with opportunities to join professional and interpersonal networks including Womens Network, National Race Network, National Disability Network (THRIVE) and many more.

Things you need to know

Artificial intelligence
Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window) , and will assess your Behaviours, Experience and Technical skills.

** Ensure that you read the full information about the selection process thoroughly before starting your application**.

Please note the closing date for your full application (Application Form, CV and Written Statement) is 23:55 on 24th November 2026**

Stage 1 Application Form

Please complete the application form with your basic information, which includes your personal details, eligibility to apply and any reasonable adjustments required.

Stage 2 - Curriculum Vitae (CV)

You will be asked to complete a CV with details of your job history, full qualification details, previous skills and experience.You are not required to upload your personal CV.

In the previous skills/experience section you should detail your employment and/or education history relevant to this vacancy(we recommend a maximum of 500 words). The CV will also cover your work history (we recommend you include up to the last 3 roles of employment history, plus any others that you feel are relevant) and your qualifications.

Your CV will not be formally assessed, so please put the main evidence of your skills into your personal statement. Your CV will be used to add context to your personal statement.

Stage 3 Personal Statement and Sift

As part of the application process, you will be asked to complete a personal statement in no more than 1000 words detailing the relevant skills and experience you can bring to the role, based on the key criteria listed. Please read and understand the key criteria thoroughly, as this is what your written evidence will be assessed against. Pay particular attention to the lead criteria and second lead criteria as if you do not demonstrate these on your application, you will not progress to the interview stage.

Your layout is entirely your preference; you may choose narrative, bullets, etc. You may choose to address each criterion separately; however, one narrative example may cover and evidence several key criteria. You may not be able to meet all the key criteria, but please ensure you evidence the key personal requirements, what have you done thats relatable to the requirements. Youdonthave to explain the whole process, just whatyouhavedone and the skills and experienceyou haveused.

Should a large number of applications be received, an initial sift may be conducted using the lead criteria or lead and second lead criteria. If so, we will sift on:

• Experience of using detailed knowledge of principle attack vectors across the security and counter-fraud disciplines and how these threats link to the delivery of Government means tested benefits and digital services. With detailed understanding of supporting policy, and how they can be exploited (Lead Criteria).
• Experience of using analytical tools including SIEM tools to identify security or fraud compromises within large amounts of complex data, performing complex analysis in a high-pressure environment. Demonstrating adaptability and creativity, with the capability to learn quickly and grasp essential details and be comfortable relying on others expertise to inform decision making/assessments (Second Lead Criteria).

Candidates who pass the initial sift may be progressed to a full sift or progressed straight to an interview.

**The closing date for all stages of your application is23:55 on 24/11/2026. If you fail to complete all stages before the deadline, your application will be withdrawn**

The sift is scheduled to be held from 25/11/2026 to 11/12/2026.These dates may be subject to change.
Following completion of the sifting period above, results will be collated, and candidates will receive confirmation of the outcome. Those candidates who have met the agreed pass mark will be invited to interview.

No feedback will be provided at this stage.

Stage 4 - Interview

If you pass the written application sift with the required score, you will be invited to a blended interview and will receive an electronic notification to your Civil Service Jobs account.If high application volumes are received, the benchmark / score for candidates to proceed to the interview stage may be raised.

The interviews will be conducted face to face. Where possible the interviews will take place at some of the locations listed in the advert , however candidates may be expected to travel to an alternative location as required.

If you require any reasonable adjustments to attend a face-to-face interview, please ensure you state those on your application form when asked to do so.

Interviews are scheduled to take place from 18/01/2027 to 22/01/2027, please note that these dates are only indicative at this stage and could be subject to change. Interviews will be scheduled Monday to Friday, between 09:00 to 17:00.

Communications will be electronic and/or by SMS/telephone; therefore, it is important that you check your Civil Service Jobs account regularly, as well as your spam/junk email folder. Telephone calls may show as a withheld number, it is important that you answer so that your interview can be confirmed. If you wish to opt out of SMS messages, please email this address, including the vacancy reference and your candidate ID [email protected] . As part of our commitment to improving the candidate experience, you may be contacted during the recruitment process to provide feedback.

Preparing for the Interview

The interview will take approximately 40 to 45 minutes and will consist of a presentation on your technical skills with technical and behaviour questions. You will be provided with a pack prior to your interview detailing the requirements of the presentation. A blended interview aims to be more of a conversation offering a more inclusive approach.The questions explore what you, the candidate, can and have done, but also your potential.

Behaviours

You will be assessed against the Civil Service Behaviours listed at Grade 7 Level 4.

An example of a behavioural question would be How did you lead by example to inspire and motivate your teams?. It may help to use one or more examples of a piece of work you have completed, or a situation you have been in, and use the WHO or STAR model to explain:

• WHO - Whatit was?Howyou approached the work/situation? What theOutcomeswere, what did youachieve? or
• STAR - What was theSituation? What were theTasks? WhatActiondid you take? What were the Results of your actions?

Technical

In addition to the behaviours, you will also need to demonstrate your technical skills at interview, as listed above. This will be in the form of a presentation and questions and will enable you to demonstrate your technical expertise. You will be provided with a pack prior to your interview detailing the full requirements of the presentation.

If you withdraw your application at any stage, it will not progress further.

Stage 5 Offer

Once all interviews have been completed, you will be notified of the outcome by email. Our current plan is that this will be week commencing 08/02/2027, but this may be subject to change. Offers will be made in strict merit order to the highest scoring candidate first

The successful candidates will be notified of a start date following successful pre-employment and security checks, which is likely to be during May 2027.

Further Information

At the Department for Work and Pensions (DWP) we value diversity and inclusion and actively encourage and welcome applications from everyone, including those that are underrepresented in our workforce.

Find out more about working for DWP on the DWP Careers Hub .

Reserve List

A reserve list may be held for a period of 12 months from which further appointments can be made. If you are placed on a reserve list but we cannot immediately offer you a post, please note:

• If you are later offered the role you applied for, in a location you have expressed a preference for, and you decline the offer or are unable to take up the post within a reasonable timeframe you will be withdrawn from the campaign and removed from the reserve list, other than in exceptional circumstances (e.g. a contractual part-time working pattern cannot be accommodated in the initial role offered or in the case of serious ill health).
• If we make an offer of an alternative role or location to that which you originally applied for, and you decline that offer, you will be able to remain on the reserve list.

Visa Sponsorship

Please note that for these vacancies we recommend that applicants seek specialist advice on their eligibility for Visa Sponsorship (if applicable) when considering whether to apply for any role. We can never guarantee sponsorship; requests will be considered in line with the relevant DWP guidance and Home Office policy in place at the time.

Location

The roles available will be based in one of the following locations subject to space availability at the time of posting:

• Birmingham - Arena Central, 3 Arena Central, Bridge St, Birmingham, B1 2AX.
• Leeds - Quarry House, Quarry Hill, Leeds, LS2 7UA.
• London - The following location is restricted to existing DWP staff who are already based at this office, due to estate constraints at this location: Caxton House, Tothill Street, Westminster, SW1H 9NA.
• Manchester - 2 St Peter's Square, Manchester, M2 3AA.
• Newcastle-upon-Tyne - Benton Park View, Benton Park Road, Newcastle Upon Tyne, NE98 1YX (moving to Pilgrim Place in 26/27) .
• Pontypridd - Ty Taf, Main Avenue, Treforest Industrial Estate, Pontypridd, CF37 5YN.
• Sheffield - 1 Hartshead Square, Sheffield, S1 2FD (moving to 1 West Bar by early 2028) .

You should only apply for suitable posts where you can travel to and from your home office location daily within a reasonable time. Please be aware that this role can only be worked in the UK and not overseas. Relocation costs will not be reimbursed. Make sure the locations work for you before applying!

Hybrid working

This role may be suitable for hybrid working, which is where an employee works part of the week in their DWP office and part of the week from home. This is a voluntary, non-contractual arrangement and your office will be your contractual place of work. If a hybrid working arrangement is suitable for the role and for you, you will normally be required to spend a minimum of 60% of your contracted working hours from your DWP office. If you have a disability, caring responsibilities, or other circumstances that may affect your ability to meet the minimum office attendance requirement, please discuss this with us using the contact details in this advert. Hybrid working will not commence until any training and consolidation period has been successfully completed.

Working pattern

Alternative working patterns will be considered but must meet business needs. Wewill do our best to let people with existing part-time contracts retain their contracted hours provided they are in line withcurrent business needs. Please note that successful candidates with agreed alternative working patterns may be required to work full timefor specific periods to complete all training and consolidation.

Hours of work

The full-time working week in DWP is 37 hours. You may be required to work at any time between the hours of:

• 7:45am and 8:00pm on any day between Monday to Friday, and
• 8:45am to 5:00pm on Saturday.

Managers will agree working patterns with successful candidates within these business hours and review these asappropriate. You will be given advance notice of your personal schedule.

NB Cyber Resilience Centre (CRC) provides support 24 hours a day, 7 days a week and as a result job holders may potentially be expected to work as part of an on-call rota, which may also attract occasional out of hours working. Work may involve travel to different DWP sites and Government agencies and occasional overnight stays.

Disability Confident Scheme

If high application volumes are received, the benchmark for candidates to proceed to the next stage may be raised. In line with our commitment to the Disability Confident Scheme (DCS), we aim to advance all candidates applying under the DCS who meet the minimum standard. However, we may only progress those candidates who best meet the required standards.

Reasonable Adjustments

We consider visible and non-visible disabilities, neurodiversity or learning differences, chronic medical conditions, or mental ill health. Examples include dyslexia, epilepsy, autism, chronic fatigue, or schizophrenia.

If you need a change to be made so that you can make your application, you should contact the Government Recruitment Service via [email protected] as soon as possible before the closing date to discuss your needs.

Complete the Reasonable Adjustments section in the Additional requirements page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if youre deaf, a Language Service Professional.

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for candidates section.

Integrity, Plagiarism and Civil Service Principles

The Civil Service values honesty and integrity and expects all candidates to abide by these principles. Please ensure that all examples provided in your application are taken directly from your own experience and that you describe the examples in your own words.

Examples of plagiarism can include:

• Presenting the work, ideas and experiences of others as your own.
• Copying content or answers from an online or published source that is not your own.

Disclosure and Barring Service and Internal Fraud Database Checks

To process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service on your behalf.However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing [email protected] stating the job reference number in the subject heading.

If successful and transferring from another Government Department a criminal record check will be carried out.

Candidates who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any candidates details held on the IFD will be refused employment. A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5-year period following a dismissal for carrying out internal fraud against government.

Important Information

New entrants are expected to join on the minimum of the pay band.

Before applying for this vacancy, current employees of DWP should check whether a successful application would result in changes to their terms & conditions of employment, e.g. mobility, pay, allowances. If you are a current employee and are successful you must be able to be released from your current post within four weeks.

Those on protected TUPE/ COSoP terms and conditions applying on promotion or voluntary permanent level move will adopt DWPs Terms and Conditions and this may have a different impact on pay and allowances. Please review this prior to acceptance of a role.

Civil Servants that would transfer into DWP from other government organisations, following successful application, will assume DWP's terms & conditions of employment current on the day they are posted, unless DWP has stated otherwise in writing. Accepting a post will be taken to mean acceptance of revised terms & conditions.

Civil Servants applying on promotion will usually be appointed to the salary minimum or within 10% of existing salary.

Any move to DWP from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may, however, be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at the Childcare Choices Website.

Diversity and Inclusion

At the Department for Work and Pensions (DWP) we value diversity and inclusion and actively encourage and welcome applications from everyone, including those that are underrepresented in our workforce.

Find out more about working for DWP on the DWP Careers Hub . Click on the Application Guidance link for lots of help and guidance on making your application.

For further information on National Security Vetting please visit the Demystifying Vetting website .

Feedback

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a basic (or equivalent) criminal record check.

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window) .

See our vetting charter (opens in a new window) .

People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window) .

The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion
The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window) .

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.

Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants
Job contact :

• Name : CFCD RECRUITMENT TEAM
• Email : [email protected]

Recruitment team

• Email : [email protected]

Further information

Appointment to the Civil Service is governed by the Civil Service Commissions Recruitment Principles. If you feel your application has not been treated in accordance with these principles and you wish to make a complaint, you should in the first instance contact DWP by email: [email protected]. If you are not satisfied with the response you receive from the Department, you can contact the Civil Service Commission. Click here to visit the Civil Service Commission.

Attachments DWP Terms and Conditions January 2024 Opens in new window (docx, 17kB) Success-Profiles-Candidate-Overview Opens in new window (pdf, 635kB)