Cyber Analyst in CYBER DEFENCE CENTRE

Bank of England; Leeds; Hybrid; GBP 40,000 - 50,000; Full time

Benefits offered by this job

Pension

Bonus eligibility

Benefits allowance

26 days' annual leave

Private medical insurance

Income protection

Job summary

The Bank of England's Cyber Defence Centre is recruiting a Cyber Analyst (Permanent, Full Time) located in Leeds or London. You will join a security-focused team responsible for detecting and responding to cyber-threats, supporting incident response, and driving automation across detection and response processes.

You will work with MITRE ATT&CK, Splunk, and SOAR platforms, contributing to secure-by-design initiatives and professional development.

Qualifications

• Good understanding of best practice security incident response concepts and approaches.
• Practical experience in technical cyber security incident response methodologies.
• Excellent written and verbal communication skills.
• Experience working in Security Operations Centre with triaging alerts and IR practices.
• Knowledge of networks, protocols and infrastructure (packet capture, firewalls, DNS).
• Ability to convey complex information clearly.
• Willingness to learn new cyber security skills.
• Logical mindset and ability to document IR processes.
• GCIH or similar qualification in Security Incident response.
• DV clearance eligibility (UK citizenship and ties to the UK).
• Understanding of cyber threats and ATT&CK techniques.
• Experience using automation / SOAR platforms.
• Experience with incident response principles and threat intel.
• Experience using MITRE ATT&CK and Splunk.
• Software development, scripting or programming skills.

Responsibilities

• Take part in the operations rota to thoroughly investigate security alerts and escalate appropriately.
• Contribute to Cyber Security incident response activities as part of the wider team.
• Seek opportunities to improve detection and response through automation and tooling.

Skills

Security incident response

SOC triage

Security communications

Network fundamentals

IR playbooks

Automation / SOAR

MITRE ATT&CK

Splunk

Intelligence platform

Scripting / programming

DV clearance eligibility

Tools

Splunk

SOAR platforms

MITRE ATT&CK

Job description

The Cyber Defence Centre (CDC) is responsible for detecting and responding to cyber-attacks against the Bank of England. Whilst the team is primarily located in the Bank's London office in Threadneedle Street, the team does also have a presence in the Leeds office. This posting is therefore open to London OR Leeds applicants.

Department overview:

Within the Cyber Security Division you will be working with people who are passionate about protecting the security and stability of our Technology estate. Whether it is identifying threats, uncovering vulnerabilities or ensuring robust and resilient infrastructure, you'll be working at the cutting edge in a security-centric organisation.

You’ll focus on ensuring security by design, and ensuring we have safe, stable and resilient systems. Collaborating closely with colleagues across Technology and throughout the organisation you will help the division safeguard critical systems and information.

Our award-winning specialist teams are committed to developing their expertise in a constantly evolving environment. Aligned to industry best-practice, staff are encouraged to develop their skills both internally and externally, through mentoring, training and formal qualifications.

The Cyber Defence Centre (CDC) is responsible for detecting and responding to cyber-attacks against the Bank of England. The CDC is made up of four key domains: Capability, Threat, Detection Engineering and Defence Operations.

Reporting to the Cyber Defence Operations Lead Operations lead in the Cyber Defence Operations (CDO) function, The successful candidate will take part in the operations rota ensuring security alerts are thoroughly investigated, escalated appropriately and take part in subsequent Cyber Security incident response activities as part of the wider Cyber Security incident response team where required.

When not responding to security alerts or incidents, as part of the CDO function, the role holder will be expected to proactively seek opportunities to improve the team's operational capability for both detection and response processes through a greater use of automation. The role will require close collaboration across all of the CDC's core functions and has varied and challenging day-to-day responsibilities, as well as exposure to a range of cutting-edge technology in cyber security, data analytics and cyber threat intelligence.

Key Experience / Skills

Minimum:

• Good understanding of best practice security incident response concepts and approaches
• Practical experience in technical cyber security incident response methodologies
• Excellent written and verbal communication skills
• Experience working in Security Operations Centre with specific experience triaging security alerts and an understanding of wider cyber security incident response practices.
• Knowledge of computer network fundamentals, including network protocols and infrastructure (packet capture analysis, firewalls, web proxies, DNS etc.)
• Ability to convey complex information in a clear and concise manner
• Ability and willingness to learn new technical cyber security skills
• Logical mind-set
• Experience developing and documenting incident response processes and designing IR playbooks.
• GCIH or similar qualification in Security Incident response
• The ability to acquire DV clearance (To be eligible to apply you must be a British citizen (either born here or naturalised) and one of your parents must be a British citizen or have substantial ties to the UK.
• Understanding of common cyber threats and attacker tactics, techniques and procedures and an ability to identify appropriate mitigation strategies
• Experience using automation or SOAR platforms
• Knowledge of incident response principles
• Experience using MITRE ATT&CK
• Experience using Splunk
• Experience using an intelligence platform
• Software development, scripting or programming skills

Cyber Analyst, Technology Directorate

Permanent

Full Time

Leeds or London

The Cyber Defence Centre (CDC) is responsible for detecting and responding to cyber-attacks against the Bank of England. Whilst the team is primarily located in the Bank's London office in Threadneedle Street, the team does also have a presence in the Leeds office. This posting is therefore open to London OR Leeds applicants.

Department overview:

Within the Cyber Security Division you will be working with people who are passionate about protecting the security and stability of our Technology estate. Whether it is identifying threats, uncovering vulnerabilities or ensuring robust and resilient infrastructure, you'll be working at the cutting edge in a security-centric organisation.

You’ll focus on ensuring security by design, and ensuring we have safe, stable and resilient systems. Collaborating closely with colleagues across Technology and throughout the organisation you will help the division safeguard critical systems and information.

Our award-winning specialist teams are committed to developing their expertise in a constantly evolving environment. Aligned to industry best-practice, staff are encouraged to develop their skills both internally and externally, through mentoring, training and formal qualifications.

Job description

The Cyber Defence Centre (CDC) is responsible for detecting and responding to cyber-attacks against the Bank of England. The CDC is made up of four key domains: Capability, Threat, Detection Engineering and Defence Operations.

Reporting to the Cyber Defence Operations Lead Operations lead in the Cyber Defence Operations (CDO) function, The successful candidate will take part in the operations rota ensuring security alerts are thoroughly investigated, escalated appropriately and take part in subsequent Cyber Security incident response activities as part of the wider Cyber Security incident response team where required.

When not responding to security alerts or incidents, as part of the CDO function, the role holder will be expected to proactively seek opportunities to improve the team's operational capability for both detection and response processes through a greater use of automation. The role will require close collaboration across all of the CDC's core functions and has varied and challenging day-to-day responsibilities, as well as exposure to a range of cutting-edge technology in cyber security, data analytics and cyber threat intelligence.

Key Experience / Skills

Minimum:

• Good understanding of best practice security incident response concepts and approaches
• Practical experience in technical cyber security incident response methodologies
• Excellent written and verbal communication skills

Essential:

• Experience working in Security Operations Centre with specific experience triaging security alerts and an understanding of wider cyber security incident response practices.
• Knowledge of computer network fundamentals, including network protocols and infrastructure (packet capture analysis, firewalls, web proxies, DNS etc.)
• Ability to convey complex information in a clear and concise manner
• Ability and willingness to learn new technical cyber security skills
• Logical mind-set

Desirable:

• Experience developing and documenting incident response processes and designing IR playbooks.
• GCIH or similar qualification in Security Incident response
• The ability to acquire DV clearance (To be eligible to apply you must be a British citizen (either born here or naturalised) and one of your parents must be a British citizen or have substantial ties to the UK.
• Understanding of common cyber threats and attacker tactics, techniques and procedures and an ability to identify appropriate mitigation strategies
• Experience using automation or SOAR platforms
• Knowledge of incident response principles
• Experience using MITRE ATT&CK
• Experience using Splunk
• Experience using an intelligence platform
• Software development, scripting or programming skills

Our Approach to Inclusion

The Bank values diversity, equity and inclusion. We play a key role in maintaining monetary and financial stability, and to do that effectively, we believe we need a workforce that reflects the society we serve.

At the Bank of England, we want all colleagues to feel valued and respected, so we're working hard to build an inclusive culture which supports people from all backgrounds and communities to be at their best at work. We celebrate all forms of diversity, including (but not limited to) age, disability, ethnicity, gender, gender identity, race, religion, sexual orientation and socioeconomic status. We believe that it's by drawing on different perspectives and experiences that we'll continue to make the best decisions for the public.

We welcome applications from individuals who work flexibly, including job shares and part time working patterns. We've also partnered with external organisations to support us in making adjustments for candidates and employees in the recruitment process where they're needed.

From 1st October 2026, we expect all our colleagues to spend a minimum of 50% of their working time in the office per month. This is to capitalise on the benefits of working together in person across teams, while maintaining the flexibility offered by home working. Subject to that minimum requirement, individuals and managers should work together to find what works best for them and their team.

Finally, we're proud to be a member of the Disability Confident Scheme. If you wish to apply under this scheme, you should check the box in the 'Candidate Personal Information' under the 'Disability Confident Scheme' section of the application.

Salary and Benefits Information

We encourage flexible working, part time working and job share arrangements. Part time salary and benefits will be on a pro-rated basis as appropriate.

Leeds: £40,320 - £45,360

London: £44,800 - £50,400

In addition, we also offer a comprehensive benefits package as detailed below:

• Currently a non-contributory, career average pension giving you a guaranteed retirement benefit of 1/80th of your annual salary for every year worked. There is the option to increase your pension (to 1/65th) or decrease (to 1/105th) in exchange for salary through our flexible benefits programme each year. The Bank has the discretion to vary standard accrual rates and dial up and dial down rates at any time and to withdraw dial up and dial down options at any time.
• A discretionary performance award based on a current award pool.
• An 8% benefits allowance with the option to take as salary or purchase a wide range of flexible benefits.
• 26 days' annual leave with option to buy up to 12 additional days through flexible benefits.
• Private medical insurance and income protection.

National Security Vetting Process

Employment in this role will be subject to the National Security Vetting clearance process (and typically can take between 6 to 12 weeks post offer) and the passing of additional Bank security checks in accordance with the Bank policy. Further information regarding the vetting and security clearance requirements for the role will be provided to the successful applicant, and information about how the Bank processes personal data for these purposes, is set out in the Bank's Privacy Notice.

The Bank of England welcomes applications from all candidates, but as a UK Visas and Immigration (UKVI) approved sponsor, we have a responsibility to comply with the Immigration Rules and guidance. As such, our ability to employ individuals who require sponsorship for immigration purposes is limited. The Bank cannot guarantee that you and / or the role you are applying for will be eligible for sponsorship and that any application made to UKVI will be successful. Eligibility will therefore be considered on a case by case basis.

This role closes on 13 September 2026