Hybrid Cloud Security Incident Responder — UK Policing

Police Digital Service; Wigan; Hybride; GBP 50 000 - 61 000; Plein temps

Résumé du poste

Police Digital Service in the United Kingdom is seeking an NMC Cyber Incident Responder (Cloud Security) to lead and support investigations into cyber incidents affecting UK policing, spanning cloud, endpoint, network and identity platforms.

You will work with threat intelligence, detection engineering and force stakeholders, translating lessons learned into stronger cloud security controls and incident response playbooks.

Qualifications

• Experience investigating and responding to cyber security incidents within enterprise environments.
• Experience investigating ransomware, malware, unauthorised access, cloud compromise and data breach incidents.
• Experience analysing telemetry from cloud, endpoint, network and identity platforms to determine attacker activity, scope and impact.
• Experience working with Azure, AWS or GCP environments.
• Experience investigating identity-based threats involving Microsoft Entra ID and other identity providers (IdPs).
• Strong understanding of attacker tactics, techniques and procedures, and the incident response lifecycle.
• Experience using EDR, SIEM and cloud security tooling to support investigations and response activities.
• Ability to communicate technical findings and recommendations to senior stakeholders.

Responsabilités

• Lead and support investigations into cyber security incidents affecting UK policing, including ransomware, malware, unauthorised access, data compromise and insider threats.
• Conduct technical investigations across endpoints, servers, cloud environments and identities to determine the scope, root cause and impact of incidents.
• Support containment, eradication and recovery activities through evidence-based recommendations.
• Develop and maintain investigative methodologies, playbooks and procedures aligned to recognised incident response frameworks.
• Lead and support investigations into cyber incidents affecting Azure, AWS and GCP environments.
• Analyse cloud telemetry, audit logs, identity events and security alerts to identify malicious activity and support incident response activities.
• Investigate attacks targeting the identity control plane, including Microsoft Entra ID and other identity providers (IdPs), identifying compromised accounts, privilege escalation and unauthorised access.
• Support response activities across cloud infrastructure, workloads and SaaS platforms, providing technical expertise during active incidents.
• Work closely with threat intelligence, detection engineering and force stakeholders to improve investigative outcomes and situational awareness.
• Translate lessons learned into improvements to cloud security controls, detections, playbooks and response procedures.
• Stakeholder Engagement: Act as a trusted advisor to police forces and policing organisations during cyber incidents.
• Deliver clear technical and strategic briefings to senior stakeholders, including Chief Officers, CIOs, Heads of IT and Heads of Cyber Security.
• Coordinate with internal and external stakeholders to ensure effective incident management throughout investigations.
• Support national coordination activities where incidents have cross-force or sector-wide implications.
• Apply threat intelligence, attacker TTPs and frameworks such as MITRE ATT&CK to support investigations and response activities.
• Identify trends, lessons learned and opportunities to improve cyber resilience across UK policing.
• Contribute to the development of detection capabilities and incident response processes through post-incident reviews and technical findings.
• Support knowledge sharing, mentoring and capability development across the wider NMC function.

Connaissances

Cyber incident response

Cloud security

Azure AWS GCP

Threat intelligence

Stakeholder communication

Outils

EDR

SIEM

Microsoft Entra ID

Description du poste

Police Digital Service in the United Kingdom is seeking an NMC Cyber Incident Responder (Cloud Security) to lead and support investigations into cyber incidents affecting UK policing, spanning cloud, endpoint, network and identity platforms.

You will work with threat intelligence, detection engineering and force stakeholders, translating lessons learned into stronger cloud security controls and incident response playbooks.