NMC Cyber Incident Responder (Cloud Security)

Police Digital Service; Wigan; Hybrid; GBP 50,000 - 61,000; Full time

Benefits offered by this job

Annual leave + holidays

Employee assistance program (EAP) &福利

Pension & life assurance

Remote GP and wellbeing services

Parental leave enhancements

Volunteer day

Job summary

Police Digital Service’s National Management Centre (NMC) is seeking an experienced NMC Cyber Incident Responder to lead investigations across cloud, endpoints, networks and identities in UK policing. You will analyse telemetry, coordinate with threat intel, detection engineering and force stakeholders, and provide technical guidance for incident response and recovery.

This role requires strong cloud security skills across Azure, AWS and GCP, plus the ability to translate lessons learned into

Qualifications

• Experience investigating and responding to cyber security incidents within enterprise environments.
• Experience investigating ransomware, malware, unauthorised access, cloud compromise and data breach incidents.
• Experience analysing telemetry from cloud, endpoint, network and identity platforms to determine attacker activity, scope and impact.
• Experience working with Azure, AWS or GCP environments.
• Experience investigating identity-based threats involving Microsoft Entra ID and other identity providers (IdPs).
• Strong understanding of attacker tactics, techniques and procedures, and the incident response lifecycle.
• Experience using EDR, SIEM and cloud security tooling to support investigations and response activities.
• Ability to communicate technical findings and recommendations to senior stakeholders.

Responsibilities

• Lead and support investigations into cyber security incidents affecting UK policing, including ransomware, malware, unauthorised access, data compromise and insider threats.
• Conduct technical investigations across endpoints, servers, cloud environments and identities to determine the scope, root cause and impact of incidents.
• Support containment, eradication and recovery activities through evidence-based recommendations.
• Develop and maintain investigative methodologies, playbooks and procedures aligned to recognised incident response frameworks.

Skills

Incident response

Cloud security

Threat intelligence

Stakeholder communication

Tools

EDR

SIEM

Azure

AWS

GCP

Microsoft Entra ID

Job description

Join Police Digital Service as NMC Cyber Incident Responder (Cloud Security)

Salary starting at £55,000 per annum

As a member of the National Management Centre (NMC) Cyber Incident Response team, you will lead and support the investigation of cyber security incidents affecting UK policing. This role combines incident response, cloud security and stakeholder engagement, requiring the ability to identify, contain and investigate sophisticated cyber threats across traditional, hybrid and cloud-hosted environments.

You will investigate incidents across cloud, endpoint, network and identity platforms, analysing security telemetry and attacker activity to determine scope, impact and root cause. Working alongside threat intelligence, detection engineering and force stakeholders, you will provide technical advice to support incident response, recovery and organisational decision-making.

This is a split shift Monday-Friday role covering core hours of 8am - 6pm.

About Police Digital Service

The National Management Centre (NMC) is part of Police Digital Services and provides visibility and control of information risks for policing. It supports the 24x7x365 nature of police operations, providing a threat detection and response capability for digital services before, during and after cyber-attacks, enabling stakeholders to understand and proactively manage risk across the technology estate at both the national and force level.

Key Responsibilities

Incident Response & Investigation

• Lead and support investigations into cyber security incidents affecting UK policing, including ransomware, malware, unauthorised access, data compromise and insider threats.
• Conduct technical investigations across endpoints, servers, cloud environments and identities to determine the scope, root cause and impact of incidents.
• Support containment, eradication and recovery activities through evidence-based recommendations.
• Develop and maintain investigative methodologies, playbooks and procedures aligned to recognised incident response frameworks.

Cloud Security

• Lead and support investigations into cyber incidents affecting Azure, AWS and GCP environments.
• Analyse cloud telemetry, audit logs, identity events and security alerts to identify malicious activity and support incident response activities.
• Investigate attacks targeting the identity control plane, including Microsoft Entra ID and other identity providers (IdPs), identifying compromised accounts, privilege escalation and unauthorised access.
• Support response activities across cloud infrastructure, workloads and SaaS platforms, providing technical expertise during active incidents.
• Work closely with threat intelligence, detection engineering and force stakeholders to improve investigative outcomes and situational awareness.
• Translate lessons learned into improvements to cloud security controls, detections, playbooks and response procedures.

Stakeholder Engagement

• Act as a trusted advisor to police forces and policing organisations during cyber incidents.
• Deliver clear technical and strategic briefings to senior stakeholders, including Chief Officers, CIOs, Heads of IT and Heads of Cyber Security.
• Coordinate with internal and external stakeholders to ensure effective incident management throughout investigations.
• Support national coordination activities where incidents have cross-force or sector-wide implications.

Threat Analysis & Continuous Improvement

• Apply threat intelligence, attacker TTPs and frameworks such as MITRE ATT&CK to support investigations and response activities.
• Identify trends, lessons learned and opportunities to improve cyber resilience across UK policing.
• Contribute to the development of detection capabilities and incident response processes through post-incident reviews and technical findings.
• Support knowledge sharing, mentoring and capability development across the wider NMC function.

What you need to succeed in the role

• Experience investigating and responding to cyber security incidents within enterprise environments.
• Experience investigating ransomware, malware, unauthorised access, cloud compromise and data breach incidents.
• Experience analysing telemetry from cloud, endpoint, network and identity platforms to determine attacker activity, scope and impact.
• Experience working with Azure, AWS or GCP environments.
• Experience investigating identity-based threats involving Microsoft Entra ID and other identity providers (IdPs).
• Strong understanding of attacker tactics, techniques and procedures, and the incident response lifecycle.
• Experience using EDR, SIEM and cloud security tooling to support investigations and response activities.
• Ability to communicate technical findings and recommendations to senior stakeholders.

Why Join us?

• Balance is important and we want you to take time off to recharge - we offer 28 days’ annual leave plus bank holidays, rising to 30 days after 5 years of service. Holiday Purchase also available
• We care about your well‑being - we have an EAP that offers not just welfare benefits but also retail discounts
• Plan for the future - we offer an excellent pension scheme and life assurance cover
• Put your mind at rest regarding your health - offering remote GP, mental health and physiotherapy appointments via video consultation
• Family - Enhanced maternity and paternity pay along with a flexible return to work
• Community - one paid day off per year for volunteering

You can find out more here:
Benefits - Police Digital Service (pds.police.uk)

Diversity, equity and inclusion

We are committed to equal opportunity for all and will not discriminate on any grounds. We encourage applications from people from the widest possible span of experience. We particularly welcome applications from Black, Asian and Minority Ethnic (BAME) candidates and people with disabilities.

Working Arrangements

At the NMC, you will benefit from hybrid working, getting the advantages of both face-to-face team engagement and home working. NMC employees have the opportunity to work in our modern office environment for in-person collaboration, however you will also get the opportunity to work from home 2 days a week pending operational requirements.

All applicants must be eligible for NPPV3 and SC clearances. Successful applicants will require NPPV3 clearance to have been approved before starting with PDS.