Security operations analyst

Band 6 · Security operations analyst · 440 job evaluation points

A security operations analyst investigates and contains security incidents, writes detection rules, and improves the organisation's security monitoring.

Responsibilities

Investigate security incidents, work out their scope, and contain them, working with system owners and clinical services.
Write and tune detection rules, and run threat hunts based on current threats to health care.
Monitor for inappropriate access to patient records, and pass cases to information governance.
Assess vulnerabilities by risk, including their effect on clinical services and medical devices.
Improve runbooks and tools after incidents.
Take part in the on-call rota for out-of-hours security incidents.

Skills

Skill	Expected level	What this level means
Security operationsThis reference	Practitioner (3)	You can: investigate and contain security incidents write detection rules and threat hunts improve runbooks and tooling after incidents
Vulnerability managementThis reference	Working (2)	You can: run vulnerability scans and report the results track fixes with system owners
Identity and access managementThis reference	Working (2)	You can: create, change, and remove user accounts and access rights check access against role-based access rules
Information governance and data protectionThis reference	Working (2)	You can: apply data protection principles to your work contribute to data protection impact assessments handle information requests and records correctly
Understanding health and care servicesThis reference	Working (2)	You can: explain the clinical and care workflows your work supports use common health care terms correctly with clinical and care colleagues recognise when a change could affect patient care and raise it
Organisational risk managementThis reference	Awareness (1)	You can: explain what a risk is and how to raise one
Cyber incident managementUK GDaD PCF	Working (2)	Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level. You can: Examples of leadership using this skill: implement cyber incident management processes that reflect the level of risk accepted by the organisation ensure the organisation is prepared for and can effectively respond to incidents determine the impact of critical incidents on the organisation’s technology lead the response to critical incidents that affect the whole organisation helping the incident management team build relationships with senior leaders leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents assessing what to communicate to the board, ministers or the whole organisation, and when to do it
Information securityUK GDaD PCF	Working (2)	You can: use information security practices and available security controls to contribute to protecting solutions and services
Security technologyUK GDaD PCF	Working (2)	You can: explain the effect of vulnerabilities on current and future designs share information on a range of systems, but may specialise in one

Typical qualifications and experience

A degree in computing or cyber security, relevant security certifications, or equivalent experience.
Experience of security monitoring or incident response.

Band 6 outline

Knowledge: Specialist knowledge across a range of procedures, built through further training or experience.
Autonomy: Works independently; interprets policy for own area; seeks advice on complex issues.
Scope: A product, service, or workstream.
Leadership: May lead a small team or mentor colleagues.
Accountability: Outcomes of own workstream and quality of advice given.

Job evaluation (illustrative)

Factor	Level	Level summary	Points
Communication and relationship skills	4	Gives complex, sensitive, or contentious information needing persuasion, negotiation, or training skills, or highly complex information.	32
Knowledge, training, and experience	6	Specialist knowledge across the range of the specialism (postgraduate diploma level or equivalent).	156
Analytical and judgemental skills	4	Judgements on complex facts or situations needing analysis, interpretation, and comparison of options.	42
Planning and organisational skills	3	Plans several complex activities, adjusting plans as needed.	27
Physical skills	3	Developed skills needing speed or accuracy, such as advanced keyboard use.	27
Responsibility for patient and client care	1	Helps patients, clients, or relatives during incidental contact.	4
Responsibility for policy and service development	3	Implements policies for own area and proposes changes that affect other areas.	21
Responsibility for financial and physical resources	2	Handles cash or valuables, looks after equipment used by others, controls stock, or authorises small payments.	12
Responsibility for people	2	Supervises or coordinates staff day to day, trains others regularly, or gives basic HR advice.	12
Responsibility for information resources	4	Adapts or designs information systems to others' specifications, or runs information systems for a department as the main duty.	24
Responsibility for research and development	2	Regularly does research, development, trials, or equipment and system testing as part of the job.	12
Freedom to act	4	Results are defined, but the job holder decides how to achieve them, within broad policy.	32
Physical effort	1	Sitting, standing, and walking, with little physical effort.	3
Mental effort	4	Frequent prolonged concentration, or occasional intense concentration.	18
Emotional effort	2	Occasional exposure, or frequent indirect exposure, to distressing circumstances.	11
Working conditions	2	Occasional unpleasant conditions, frequent travel or outdoor work, or near-continuous screen use on most days.	7
Total (Band 6: 396 to 465)			440

Mental effort reflects frequent prolonged concentration during investigations, including on call. Emotional effort reflects frequent indirect exposure to distressing material in patient records and to the pressure of live incidents.