Junior security operations analyst

Band 5 · Security operations analyst · 348 job evaluation points

A junior security operations analyst monitors security alerts, triages them using runbooks, and escalates events, with guidance from experienced analysts.

Responsibilities

Monitor alerts from security monitoring and endpoint tools, and triage them using runbooks.
Gather evidence about suspicious activity, such as phishing emails or unusual logins, and escalate it.
Check phishing emails reported by staff, and help remove malicious emails from mailboxes.
Record events and actions accurately in the case management tool.
Run vulnerability scans and remind system owners about fixes that are due.

Skills

Skill	Expected level	What this level means
Security operationsThis reference	Working (2)	You can: monitor alerts and triage them using runbooks gather evidence and escalate events tune simple detection rules under guidance
Vulnerability managementThis reference	Working (2)	You can: run vulnerability scans and report the results track fixes with system owners
Identity and access managementThis reference	Awareness (1)	You can: follow access rules and protect your credentials
Information governance and data protectionThis reference	Working (2)	You can: apply data protection principles to your work contribute to data protection impact assessments handle information requests and records correctly
Understanding health and care servicesThis reference	Awareness (1)	You can: describe the main parts of the health and care system and the services the organisation supports explain why patient safety and confidentiality matter in your work
Cyber incident managementUK GDaD PCF	Awareness (1)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: implement cyber incident management processes that reflect the level of risk accepted by the organisation ensure the organisation is prepared for and can effectively respond to incidents determine the impact of critical incidents on the organisation’s technology lead the response to critical incidents that affect the whole organisation helping the incident management team build relationships with senior leaders leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents assessing what to communicate to the board, ministers or the whole organisation, and when to do it
Information securityUK GDaD PCF	Awareness (1)	You can: explain information security and the security controls available to protect solutions and services
Security technologyUK GDaD PCF	Awareness (1)	You can: describe some security architectures explain why security technology is important

Typical qualifications and experience

A qualification in computing or cyber security, a cyber security apprenticeship, or equivalent experience.

Band 5 outline

Knowledge: Professional or technical knowledge, typically from a degree or equivalent experience.
Autonomy: Works to broad objectives within professional standards; plans own work.
Scope: Own professional work within a team or product.
Leadership: May guide and check the work of support staff and apprentices.
Accountability: Quality of own professional work.

Job evaluation (illustrative)

Factor	Level	Level summary	Points
Communication and relationship skills	4	Gives complex, sensitive, or contentious information needing persuasion, negotiation, or training skills, or highly complex information.	32
Knowledge, training, and experience	5	Expertise in a specialism, underpinned by theory or practical experience (degree level or equivalent).	120
Analytical and judgemental skills	3	Judgements on a range of facts or situations needing analysis or comparison of options.	27
Planning and organisational skills	2	Plans straightforward tasks or activities, some ongoing.	15
Physical skills	3	Developed skills needing speed or accuracy, such as advanced keyboard use.	27
Responsibility for patient and client care	1	Helps patients, clients, or relatives during incidental contact.	4
Responsibility for policy and service development	2	Implements policies for own area and proposes changes to its practices.	12
Responsibility for financial and physical resources	2	Handles cash or valuables, looks after equipment used by others, controls stock, or authorises small payments.	12
Responsibility for people	1	Shows own work routines to new or less experienced colleagues.	5
Responsibility for information resources	4	Adapts or designs information systems to others' specifications, or runs information systems for a department as the main duty.	24
Responsibility for research and development	2	Regularly does research, development, trials, or equipment and system testing as part of the job.	12
Freedom to act	3	Follows defined policies and procedures; work is managed rather than supervised.	21
Physical effort	2	Frequent sitting or standing in a restricted position, or occasional light to moderate effort.	7
Mental effort	4	Frequent prolonged concentration, or occasional intense concentration.	18
Emotional effort	1	Rare exposure, or occasional indirect exposure, to distressing circumstances.	5
Working conditions	2	Occasional unpleasant conditions, frequent travel or outdoor work, or near-continuous screen use on most days.	7
Total (Band 5: 326 to 395)			348

Mental effort reflects frequent prolonged concentration on monitoring and triaging unpredictable alerts.