Cyber Security Analyst

Bristol, Darlington, London, Manchester, Wolverhampton
Job Summary
We are MHCLG
Here at the Ministry of Housing, Communities & Local Government (MHCLG), we work on things that make a real difference to people’s lives. Whether it's through the homes we live in, the work of our local councils, or the communities we’re all part of, our work is at the top of the political agenda. We have ambitious and far-reaching outcomes to achieve this year and, if you’re thinking of joining us, there’s never been a more exciting time.
We are looking for two motivated Cyber Security Analysts and the aim of the roles are to lead on the creation and management of robust threat intelligence and vulnerability management capabilities for local government. Sharing actionable intelligence with, and between, local authorities to enable them to proactively and promptly respond to emerging cyber threats and vulnerabilities. The role will also be responsible for coordinating with central and local government stakeholders, monitoring and analysing data from multiple sources, and producing effective intelligence products that allow for the meaningful reduction of cyber risk to local government.
You will play a significant role in identifying and developing new capabilities to increase local government awareness of its cyber vulnerabilities/threats working collaboratively with SMEs in other government departments.
Find out more about our Digital teams and what they are working on through our MHCLG Digital blog. Please note that MHCLG do not offer visa sponsorship and applicants will need a valid visa for the duration of your employment.
Job Description
As a Cyber Security Analyst, you'll:
Lead on collaboration with cross-government departments and security stakeholders to coordinate the continued provision and access of threat intelligence and vulnerability data streams
Analyse threat and vulnerability data from multiple sources to provide actionable intelligence for central & local government stakeholders
Utilise multiple cyber frameworks including MITRE ATT&CK and the Cyber Assessment Framework (CAF). to translate the impact of cyber activity with varied technical and non-technical stakeholders
Produce clear intelligence briefings and reporting to advise senior stakeholders on threat trends and strategic decision making
Proactively monitor the threat and vulnerability landscape to identify cyber security threats and weakness to help inform defensive priorities and ensure detection capabilities remain effective for local authorities
Conduct or support Threat Intelligence activities against prominent threat actor groups. Communicating intelligence and risks to improve the response to new threats and attack vectors across networks, systems and applications
Identify areas for opportunity within the sectors threat intelligence or vulnerability management capabilities to develop central tooling, monitoring, or communication solutions to improve sector wide maturity
Provide support to wider cyber operational activity including incident coordination and vulnerability management
As a Cyber Security Analyst, You'll
Lead on collaboration with cross-government departments and security stakeholders to coordinate the continued provision and access of threat intelligence and vulnerability data streams
Analyse threat and vulnerability data from multiple sources to provide actionable intelligence for central & local government stakeholders
Utilise multiple cyber frameworks including MITRE ATT&CK and the Cyber Assessment Framework (CAF). to translate the impact of cyber activity with varied technical and non-technical stakeholders
Produce clear intelligence briefings and reporting to advise senior stakeholders on threat trends and strategic decision making
Proactively monitor the threat and vulnerability landscape to identify cyber security threats and weakness to help inform defensive priorities and ensure detection capabilities remain effective for local authorities
Conduct or support Threat Intelligence activities against prominent threat actor groups. Communicating intelligence and risks to improve the response to new threats and attack vectors across networks, systems and applications
Identify areas for opportunity within the sectors threat intelligence or vulnerability management capabilities to develop central tooling, monitoring, or communication solutions to improve sector wide maturity
Provide support to wider cyber operational activity including incident coordination and vulnerability management
Person specification
As a Cyber Security Analyst, You'll Have
Experience working in cyber security, vulnerability management or threat intelligence environment
Experience working with threat intelligence products and an understanding of threat assessment processes and methodologies
An ability to analyse and assess the impact and risk critical vulnerabilities
An understanding of cyber security concepts, including monitoring techniques, intrusion detection and protective security
Experience implementing Threat Modelling methodologies or data analysis techniques to identify and mitigate potential security risks to systems and applications
An ability to present technical information to stakeholders in concise language, supplementing own knowledge with research where needed
Demonstrable experience producing well-written, well-structured, timely and impactful products and notifications, that meet the requirements of stakeholders
Alongside your salary of £48,501, Ministry of Housing, Communities and Local Government contributes £14,050 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).
At MHCLG we offer many benefits that range from tailored career pathways and flexible working to MyLifestyle Childcare Voucher and Cycle to Work Schemes. For more information, please click here.
Artificial intelligence
Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.
Selection process details
Application and Selection
The application process will be split into 2 stages, testing the following Success Profiles:
Behaviours , Experience , Technical
Please ensure your CV does not contain any personally identifiable information.
Note: We do not consider direct CV applications. All applications must be submitted via the provided application link.
Important: Your CV and Cover Letter must be merged into a single document before uploading.
Stage 1: Sift (CV & Cover Letter)
Experience & Technical: Your covering letter should be no more than 1 page referencing how you meet the criteria set out in the job description.
Most of our campaigns utilise multiple assessors and so it is possible that each of your answers would be viewed by different assessors.
In the event that we receive a large number of applications, we may conduct an initial sift using the lead sift question listed in the advert. Candidates who pass the initial sift may be progressed to a full sift, or progressed straight to interview.
Lead sift question (Technical): Describe a time you made use of cyber threat intelligence or vulnerability information to identify an organisational weaknesses, and used your understanding of the cyber threat landscape to inform risk recommendations or remediation actions.
Stage 2: Interview
Behaviours: Delivering at Pace, Communicating and Influencing, Seeing the Bigger Picture
Technical: Technical questions will be based around the essential skills and criteria as listed in the job description.
Sift and Interview Dates
Sifting is envisaged to take place the week commencing 2nd November 2026.
Interviews are envisaged to take place shortly after and are currently being held remotely via videocall. This could be subject to change.
Group 1 Digital & Data Roles
MHCLG has implemented the Digital and Data capability framework for Group 1 roles. Applicants that are successful and have been offered a position will be required to complete a capability assessment after the interview.
MHCLG will honour completed capability assessments for this role from other Government Departments for existing civil servants on level transfer only. Please provide a copy of your capability assessment to the Hiring Manager when applying. If you have any queries on pay, please contact the Hiring Manager.
Each experience or technical skill is assessed between 1-3, representing working towards, at or above the job level requirements. You are awarded a proficiency level accor

Work arrangement
Yes