• Job Description

  Req#: G9076-25-0086?language=en&page=60&sort=publicationDateDesc

  Job summary

  The NHS Counter Fraud Authority (NHSCFA) is the national body responsible for all matters relating to the prevention, detection and investigation of economic crime across the NHS. Further information about our work and annual plan for delivering this is available on our website.

  An exciting opportunity has arisen to join the NHSCFA Technology team as an Information & Cyber Security Analyst. We are looking for someone with a proven background in Information/Cyber security and a flexible 'can do' attitude and approach to work in the Information & Cyber Security (I&CS) Team who manage and maintain the security of NHSCFA ICT infrastructure and information systems.

  You will work within the I&CS team to proactively monitor IT systems; identify, manage and resolve security incidents, vulnerabilities, security alerts and threats; potentially perform penetration testing; and contribute to maintaining security certifications, assurances and accreditations.

  IMPORTANT Note: This position requires UK National Security Vetting to at least SC level. Please confirm residency below.

  We reserve the right to close this vacancy before the advertised closing date should we receive a significant number of applications.

  Potential applicants can contact Kannan Soman at kannan.soman@nhscfa.gov.uk for an informal chat if they have any questions regarding the role.

  The interview will be face to face in 10sc at below address on 10/11th December 2025 , Previous applicants need not apply.

  NHS Counter Fraud Authority HM Government Hub, 7th floor 10 South Colonnade Canary Wharf London E14 4PU

  Main duties of the job

  Actively manage, monitor and develop NHSCFA Cyber operations, including managing alerts, identifying and mitigating vulnerabilities and cyber threats.

  Manage security incidents and requests through to remediation and resolution.

  Support the Security Incident Management Process as a member of the NHSCFA Security Incident Response Team.

  Carry out threat intelligence analysis and recommend or implement remediation or mitigation.

  Perform security risk assessments, identifying security gaps and recommending appropriate remediation.

  Create and prepare Cyber Security Operations reports

  About us

  We have offices in Coventry, Newcastle and London and offer flexible, hybrid and home-based working. In addition to the advertised salary, working in the London area will attract High-Cost Area Supplement where appropriate. The NHSCFA values and respects the diversity of its employees, and aims to recruit a workforce which reflects our diverse communities. We welcome applications irrespective of people's age, disability, gender, race or ethnicity, religion or belief, sexual orientation, or other personal circumstances. We have policies and procedures in place to ensure that all applicants are treated fairly and consistently at every stage of the recruitment process, including an invitation to the first stage of the selection process and consideration of reasonable adjustments for people who have a disability. If you are applying to undertake this role on a secondment basis you should have agreement to being released from your current role in principle, prior to submitting an application form. When you apply for this role you will be redirected to our recruitment system TRAC.The CFA does not hold a sponsor licence in respect of skilled worker visas and so is unable to employ candidates requiring sponsorship.

  To comply with the HM Government Functional Standard GovS 007, and specifically the Personnel Security Standards, individuals employed by NHS Counter Fraud Authority will be required to undergo Baseline Personnel Security Standards checks.

  Details

  Date posted

  18 November 2025

  Pay scheme

  Agenda for change

  Band

  Band 6

  Salary

  £38,682 to £46,580 a year

  Contract

  Permanent

  Working pattern

  Full-time, Flexible working, Home or remote working

  Reference number

  076-CFA7602326

  Job locations

  NHSCFA, 7th Floor,

  10 South Colonnade

  London

  E14 4PU

  
  

  Job description

  Job responsibilities

  Manage, monitor, and develop NHSCFA cyber security operations and ICT security infrastructure to manage and reduce cyber risk and mitigate cyber threats.

  Actively monitor NHSCFA ICT systems:

  manage and operate IT security monitoring tools and systems ; review IT system alerts ; triage to eliminate false positives ; Identify threats that have entered the network.

  Evaluate and address system generated and user-reported security incidents ; identify affected systems and scope of the incident ; analyse running processes and configurations on affected systems ; carry out in-depth threat intelligence analysis to identify an attack type, source, entry point, and possible remediation ; implement remediation or escalate incident.

  Please see full Job Description and Person Specification.

  Job description

  Job responsibilities

  Manage, monitor, and develop NHSCFA cyber security operations and ICT security infrastructure to manage and reduce cyber risk and mitigate cyber threats.

  Actively monitor NHSCFA ICT systems:

  manage and operate IT security monitoring tools and systems ; review IT system alerts ; triage to eliminate false positives ; Identify threats that have entered the network.

  Evaluate and address system generated and user-reported security incidents ; identify affected systems and scope of the incident ; analyse running processes and configurations on affected systems ; carry out in-depth threat intelligence analysis to identify an attack type, source, entry point, and possible remediation ; implement remediation or escalate incident.

  Please see full Job Description and Person Specification.

  Person Specification

  Knowledge and Experience

  Essential

  • Experience of the following: Minimum 2 years' experience of 1st-3rd level technical support of IT infrastructure or security, both in person and remote.
  • Demonstrate detailed knowledge of: oIT system monitoring (SIEM). oSecurity Incident Management. Demonstrate detailed knowledge of Information Security in several of the following areas: oIntrusion detection and prevention systems. oVulnerability Management. oNetwork technology and operations. oWindows 10 and Windows Server. oSUSE Linux. oMicrosoft365. oInformation Security Management Systems ISO27001. oRisk Management Process. oIT system auditing Experience with IT security architectures.

  Desirable

  • Min. 1 year experience as a SOC Analyst, Tier 1 or Tier 2.
  • Demonstrate knowledge of Information. Security in several of the following areas in addition to those matching Essential criteria: oWindows 10 and Server. oSUSE Linux. oMicrosoft365. oInformation Security Management Systems ISO27001. oRisk Management Process. oPublic Services Network (PSN) and NHS N3. oDatabase Security. oMicrosoft Sentinel
  • Experience with software security architecture and software security testing.

  Specialist Knowledge

  Essential

  • Knowledge of IT security and Data protection issues.
  • IT Service Management best practice, including ITIL and ISO20000
  • Demonstrate knowledge in some of the following areas: oEncryption Systems. oSecurity Products (Authentication, Data Loss Prevention, SEIM). oFirewall/WAF administration

  Desirable

  • Demonstrate knowledge of HMG Infosec standards and Good Practice Guides, including IS1
  • ITIL foundation level certification.
  • Demonstrate knowledge of current best practice in obtaining electronic evidence. Knowledge of one or more digital forensic tools.

  Qualifications

  Essential

  • Degree in computer science, information technology, or a related field OR equivalent experience in a related field, e.g. network operations plus specialist security certification(s).

  Desirable

  • Recognised qualification in area of specialisation: oEC-Council Certified SOC Analyst (CSA) oEC-Council Certified Ethical Hacker ?CompTIA Security+ ?CompTIA Network+

  Communication Skills

  Essential

  • Good communication and interpersonal skills.

  Vetting

  Essential

  • Eligible for UK National Security vetting to SC level.

  Desirable

  • Has UK National Security vetting at SC or above.

  Aptitudes

  Essential

  • Demonstrate a thorough understanding of the use of remote management tools in the effective support of a user base distributed over a wide geographic area.
  • Well-developed interpersonal skills and the ability to communicate effectively and articulate ideas and plans verbally, in a logical and coherent manner.
  • Ability to form and build working relations with a wide range of people and organisations.
  • The ability to interpret complex information, solve problems and identify solutions.
  • Demonstrable understanding of Equal Opportunities and valuing diversity.
  • Ensure and maintain the highest standards of integrity and professionalism.

  Person Specification

  Knowledge and Experience

  Essential

  • Experience of the following: Minimum 2 years' experience of 1st-3rd level technical support of IT infrastructure or security, both in person and remote.
  • Demonstrate detailed knowledge of: oIT system monitoring (SIEM). oSecurity Incident Management. Demonstrate detailed knowledge of Information Security in several of the following areas: oIntrusion detection and prevention systems. oVulnerability Management. oNetwork technology and operations. oWindows 10 and Windows Server. oSUSE Linux. oMicrosoft365. oInformation Security Management Systems ISO27001. oRisk Management Process. oIT system auditing Experience with IT security architectures.

  Desirable

  • Min. 1 year experience as a SOC Analyst, Tier 1 or Tier 2.
  • Demonstrate knowledge of Information. Security in several of the following areas in addition to those matching Essential criteria: oWindows 10 and Server. oSUSE Linux. oMicrosoft365. oInformation Security Management Systems ISO27001. oRisk Management Process. oPublic Services Network (PSN) and NHS N3. oDatabase Security. oMicrosoft Sentinel
  • Experience with software security architecture and software security testing.

  Specialist Knowledge

  Essential

  • Knowledge of IT security and Data protection issues.
  • IT Service Management best practice, including ITIL and ISO20000
  • Demonstrate knowledge in some of the following areas: oEncryption Systems. oSecurity Products (Authentication, Data Loss Prevention, SEIM). oFirewall/WAF administration

  Desirable

  • Demonstrate knowledge of HMG Infosec standards and Good Practice Guides, including IS1
  • ITIL foundation level certification.
  • Demonstrate knowledge of current best practice in obtaining electronic evidence. Knowledge of one or more digital forensic tools.

  Qualifications

  Essential

  • Degree in computer science, information technology, or a related field OR equivalent experience in a related field, e.g. network operations plus specialist security certification(s).

  Desirable

  • Recognised qualification in area of specialisation: oEC-Council Certified SOC Analyst (CSA) oEC-Council Certified Ethical Hacker ?CompTIA Security+ ?CompTIA Network+

  Communication Skills

  Essential

  • Good communication and interpersonal skills.

  Vetting

  Essential

  • Eligible for UK National Security vetting to SC level.

  Desirable

  • Has UK National Security vetting at SC or above.

  Aptitudes

  Essential

  • Demonstrate a thorough understanding of the use of remote management tools in the effective support of a user base distributed over a wide geographic area.
  • Well-developed interpersonal skills and the ability to communicate effectively and articulate ideas and plans verbally, in a logical and coherent manner.
  • Ability to form and build working relations with a wide range of people and organisations.
  • The ability to interpret complex information, solve problems and identify solutions.
  • Demonstrable understanding of Equal Opportunities and valuing diversity.
  • Ensure and maintain the highest standards of integrity and professionalism.

  Disclosure and Barring Service Check

  This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.

  Employer details

  Employer name

  NHS Counter Fraud Authority

  Address

  NHSCFA, 7th Floor,

  10 South Colonnade

  London

  E14 4PU

  
  

  Employer's website

  https://cfa.nhs.uk/ (Opens in a new tab)

  Employer details

  Employer name

  NHS Counter Fraud Authority

  Address

  NHSCFA, 7th Floor,

  10 South Colonnade

  London

  E14 4PU

  
  

  Employer's website

  https://cfa.nhs.uk/ (Opens in a new tab)

• About the company

  National Health Service (NHS) is the umbrella term for the publicly-funded healthcare systems of the United Kingdom (UK). The founding principles were that services should be comprehensive, universal and free at the point of delivery—a health service based on clinical need, not ability to pay. Each service provides a comprehensive range of health services, free at the point of use for people ordinarily resident in the United Kingdom apart from dental treatment and optical care.

Notice