Senior security operations analyst

Band 7 · Security operations analyst · 496 job evaluation points

A senior security operations analyst leads the response to significant security incidents, leads threat hunting, and guides the work of the security operations team.

Responsibilities

Lead the technical response to significant security incidents, including ransomware and data theft, and coordinate with incident management.
Advise clinical and operational leaders on containment decisions that affect patient care.
Lead threat hunting and threat intelligence work, and share information with health care security partners.
Set priorities for detection engineering and monitoring coverage, including for medical device networks.
Lead exercises that test incident response with technical and clinical teams.
Coach and guide security operations analysts.

Skills

Skill	Expected level	What this level means
Security operationsThis reference	Practitioner (3)	You can: investigate and contain security incidents write detection rules and threat hunts improve runbooks and tooling after incidents
Vulnerability managementThis reference	Practitioner (3)	You can: prioritise vulnerabilities by risk, including to patient services scope and manage penetration tests and remediation
Identity and access managementThis reference	Working (2)	You can: create, change, and remove user accounts and access rights check access against role-based access rules
Information governance and data protectionThis reference	Working (2)	You can: apply data protection principles to your work contribute to data protection impact assessments handle information requests and records correctly
Understanding health and care servicesThis reference	Working (2)	You can: explain the clinical and care workflows your work supports use common health care terms correctly with clinical and care colleagues recognise when a change could affect patient care and raise it
Organisational risk managementThis reference	Working (2)	You can: record and update risks for your area suggest controls and track actions
Cyber incident managementUK GDaD PCF	Practitioner (3)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: implement cyber incident management processes that reflect the level of risk accepted by the organisation ensure the organisation is prepared for and can effectively respond to incidents determine the impact of critical incidents on the organisation’s technology lead the response to critical incidents that affect the whole organisation helping the incident management team build relationships with senior leaders leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents assessing what to communicate to the board, ministers or the whole organisation, and when to do it
Cyber risk managementUK GDaD PCF	Working (2)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: maintain a clear understanding of the cyber and information security risks across the whole organisation develop and implement risk assessment processes oversee the assessment of the organisation's partners and supply chain for potential threats or vulnerabilities building a culture where teams have awareness of, and take responsibility for, risks and mitigating them advising programme owners and people running IT services about risks in a way that enables them to act on that advice communicating with senior leaders in a way that enables them to make decisions about accepting or mitigating risk
Information securityUK GDaD PCF	Practitioner (3)	You can: design solutions and services with security controls included, specifically engineered to mitigate security threats
Security technologyUK GDaD PCF	Practitioner (3)	This skill level is currently not defined.

Typical qualifications and experience

Substantial experience of security operations and incident response, at a level equivalent to a postgraduate diploma.
Relevant advanced security certifications, or equivalent experience.

Band 7 outline

Knowledge: Highly developed specialist knowledge, typically to master's level or equivalent experience.
Autonomy: Works to organisational policy; decides how results are achieved; is the expert others consult.
Scope: Several products or services, or a specialist function.
Leadership: Leads a team or a professional practice area.
Accountability: Delivery of a service or specialist function, and its budget if held.

Job evaluation (illustrative)

Factor	Level	Level summary	Points
Communication and relationship skills	5	Gives highly complex or contentious information needing developed persuasion and negotiation, presents to large groups, or communicates where there are significant barriers to acceptance.	45
Knowledge, training, and experience	6	Specialist knowledge across the range of the specialism (postgraduate diploma level or equivalent).	156
Analytical and judgemental skills	4	Judgements on complex facts or situations needing analysis, interpretation, and comparison of options.	42
Planning and organisational skills	4	Plans a broad range of complex activities or strategies, adjusting them as needed.	42
Physical skills	3	Developed skills needing speed or accuracy, such as advanced keyboard use.	27
Responsibility for patient and client care	1	Helps patients, clients, or relatives during incidental contact.	4
Responsibility for policy and service development	3	Implements policies for own area and proposes changes that affect other areas.	21
Responsibility for financial and physical resources	3	Authorises payments, buys some assets or supplies, monitors or holds a delegated budget, or maintains assets.	21
Responsibility for people	3	Manages a group of staff day to day, teaches core or specialist training, or gives core HR advice.	21
Responsibility for information resources	5	Designs and develops major information systems, or runs information systems for several services as the main duty.	34
Responsibility for research and development	2	Regularly does research, development, trials, or equipment and system testing as part of the job.	12
Freedom to act	4	Results are defined, but the job holder decides how to achieve them, within broad policy.	32
Physical effort	1	Sitting, standing, and walking, with little physical effort.	3
Mental effort	4	Frequent prolonged concentration, or occasional intense concentration.	18
Emotional effort	2	Occasional exposure, or frequent indirect exposure, to distressing circumstances.	11
Working conditions	2	Occasional unpleasant conditions, frequent travel or outdoor work, or near-continuous screen use on most days.	7
Total (Band 7: 466 to 539)			496

Mental and emotional effort reflect leading the response to serious incidents under pressure, often out of hours, where clinical services are at risk.