IT Security Analyst

Rochford•Brentwood, NY

8h•Hybrid

About The Position

Brentwood Borough Council and Rochford District Council are seeking an IT Security Analyst to join their shared Digital, Data and Technology team. The role helps safeguard both councils’ information assets, technology services and users through operational cyber security work, security governance and practical advice to projects, services and colleagues. The analyst monitors and responds to cyber security alerts, threats and incidents; leads vulnerability management and remediation tracking; maintains security policies and risk records; and supports assurance activities, including Cyber Essentials Plus and audits. The role also provides secure-by-design advice for systems, projects and cloud services, reviews supplier security, supports data protection compliance, delivers security awareness activities, and contributes to disaster recovery and resilience testing. The position is permanent and 37 hours per week. Hybrid working is offered, with regular attendance expected at both the Brentwood and Rochford offices. Work outside normal hours may occasionally be needed to respond to significant cyber security incidents. Starting salary depends on skills and qualifications, with progression subject to satisfactory performance.

Requirements

Practical experience of cyber security operations, including incident response, vulnerability management and security monitoring.
Understanding of cyber security risks and controls, with the ability to explain technical issues clearly to colleagues, suppliers and senior stakeholders.
Knowledge or experience of Microsoft 365, Azure and Entra ID security.
Knowledge or experience of security monitoring, endpoint protection and SIEM technologies.
Knowledge or experience of identity and access management, MFA and Conditional Access.
Knowledge or experience of cyber risk assessment and security risk registers.
Knowledge or experience of information security frameworks and standards.
Knowledge or experience of UK GDPR, information governance and Data Protection Impact Assessments.
Knowledge or experience of cloud security and secure system configuration.
Knowledge or experience of supplier assurance and third-party security risk.
Knowledge or experience of cyber security awareness and user education.
Collaborative and organised, with the ability to balance security requirements with the practical needs of council services.
Able to promote a positive and pragmatic security culture.

Nice To Haves

Experience in local government or another public sector environment.
Knowledge of Cyber Essentials Plus, the NCSC Cyber Assessment Framework or ISO 27001.

Responsibilities

Monitor, investigate and respond to cyber security alerts, threats and incidents.
Maintain incident response plans and playbooks, coordinating containment, recovery and post-incident reviews.
Lead vulnerability management activities and track remediation actions through to completion.
Maintain and improve information security policies, standards and procedures.
Support cyber risk management and maintain the security risk register.
Assist with Cyber Essentials Plus, audits and wider security assurance activities.
Provide secure-by-design advice for new systems, digital projects and cloud services.
Advise on identity and access management, Conditional Access, multi-factor authentication, privileged access, endpoint protection, encryption and network security.
Review supplier security arrangements and assess technical security evidence.
Support Data Protection Impact Assessments and compliance with UK GDPR and the Data Protection Act 2018.
Deliver security awareness activities and phishing simulation programmes.
Support ICT disaster recovery, business continuity and resilience testing.