Security Operations Centre Specialist

Driver and Vehicle Licensing Agency (DVLA); Swansea; Hybrid; GBP 36,000 - 39,000; Full time

Benefits offered by this job

Learning and development

Flexible working options

Inclusive culture

Pension contribution 28.9%

On-site nursery

25 days holiday + bank holidays

Employee Assistance Programme

Free parking

Job summary

Driver and Vehicle Licensing Agency in Swansea is seeking a Security Operations Centre Specialist to monitor security events, manage incident response and contribute to SOC playbooks as part of the Cyber Security Services team. Hybrid working is available, with a base salary reflecting a comprehensive benefits package.

The role requires hands-on SOC activity, SIEM monitoring with LogRhythm or Sentinel, and collaboration with vendors on SOC product support and contract management.

Qualifications

• Experience in SOC operations and security monitoring.
• Knowledge of security events and incident handling.
• Experience with SIEM tools such as LogRhythm or Sentinel.

Responsibilities

• Monitor operational IT security and generate management reports.
• Manage incident and event processes per SLAs.
• Contribute to SOC playbooks and policies.
• Advise on risk assessments and business impact analysis.

Skills

Security operations

SOC monitoring

SIEM tools

LogRhythm

Sentinel

Incident management

Threat intelligence

Risk assessments

Tools

LogRhythm

Microsoft Sentinel

Job description

480378 Security Operations Centre Specialist

Driver and Vehicle Licensing Agency

Apply before 11:55 pm on Sunday 4th October 2026

Location: Swansea (This role is suitable for hybrid working)

The salary of £39,163 (basic salary £35,663) includes a non-pensionable Recruitment and Retention Allowance of £3,500

A Civil Service Pension with an employer contribution of 28.97%

This role undertakes technical protective monitoring, monitoring of security events and performance of security tools, as well as investigating and handling (or assisting in handling) security events.

This role is responsible for undertaking all aspects of SOC activity, including hands‑on monitoring of SIEM (security incident and event management) tools and other sources of alerts and of threat intelligence, maintaining the relationship with the vendors and suppliers of SOC products, including where relevant contract management responsibilities.

You will work as part of our Cyber Security Services team monitoring, identifying and responding to security relevant events.

We deliver significant and high‑profile on‑line services to the public, with cyber security being viewed as an essential activity in which the organisation continues to invest.

Top Responsibilities

• Responsible for monitoring operational IT Security, producing regular management reports, undertaking trend analysis, tracking resource, evaluating the fitness for purpose and effectiveness of security processes.
• Manages incident and event management processes complying with SLAs.
• Interprets and contributes to the development of SOC playbooks, alarms and policies. Ongoing assurance of fitness for purpose of SOC playbooks, alarms and policies.
• Provides expert advice and recommendations regarding risk assessments and business impact analysis for defined information systems and managing the maintenance processes including quality review.

• Best in class learning and development tailored to your role
• An environment with flexible working options where we encourage a great work-life balance
• A culture encouraging inclusion and diversity with a range of staff communities to support all our colleagues
• Generous employer contribution of 28.9%, depending on chosen pension scheme
• Flexible working options where we encourage a great work-life balance.
• Digital communities with clear career frameworks
• On-site nursery, restaurants and coffee bar
• 25 days holiday (plus bank holidays), increasing by 1 each year (up to 30) & 8 Bank Holidays plus an additional Privilege Day to mark the King’s birthday.
• 24-hour Employee Assistance Programme providing free confidential help and advice for staff.
• Free parking

About You

You will be a security professional with significant experience of cyber security. You will possess a broad knowledge of the issues and techniques associated with securing a variety of technologies.

To be successful in this role you will need to have demonstrable experience of the range of activities of a security operations centre (SOC) including:

• Responding to alerts and handling incidents.
• Monitoring network traffic and user behaviour for potential malicious activity using a variety of tools.
• Investigating security events and anomalous patterns of activity.
• Practical experience of using LogRhythm or Sentinel, although experience of other SIEM (security incident and event management) tools will be considered.

This vacancy closes at 23:55 on Sunday 4th October 2026