OF
Cyber Security Threat Hunting Principal
- Hiring from
- United Kingdom
- Work type
- Hybrid
- Posted
607,334 remote jobs, straight from company career pages
100% free · New jobs every minute
Show job descriptionHide job description
Job Summary
The Office for National Statistics (ONS) is the UK’s largest producer of official statistics, covering a range of key economic, social and demographic topics. These include measuring changes in the value of the UK economy, estimating the size, geographic distribution and characteristics of the population, and providing indicators of price inflation, employment, earnings, crime and migration.
The last few years has seen an extensive overhaul of security and information management to meet the challenges of corporate and statistics transformation in technology, methods and practice, the Digital Economy Act and organisational risk appetite. The capability is evolving and expanding to address changes in threat and business direction.
This Cyber Security Threat Hunting Principal role sits within the Security and Information Management (SaIM) Directorate, which operates six key services across ONS: Security Risk Advice and Management; Knowledge and Information Management (KIM); Physical Security and Business Continuity; Security Compliance and Audit (SCA); Cyber Security; and Security Culture Services.
Job Description
The role will lead in delivering the Cyber Security Threat Hunting function which is part of the Cyber Security division, within the Security and Information Management directorate.
This will involve having a detailed understanding of the methods used to malicious attackers as well as business understanding to be able to identify unusual and malicious activity. The role will lead on complexity threat hunts to proactively identify potential malicious activity present in the ONS IT estate and vulnerabilities that could be used for malicious activity. Findings from these threat hunts will be reported to the senior leaders in Security and Information Management, Cyber Security Threat Hunting Principal will advice and lead on remediation steps against identified findings and vulnerabilities.
In addition, the role holder will assist in major incident response providing highly skilled resource to the Cyber Security Incident Response Principal when required.
Typical assignments
Person specification
Essential Criteria
We'll assess you against these behaviours during the selection process:
We'll assess you against these technical skills during the selection process:
Alongside your salary of £60,498, Office for National Statistics contributes £17,526 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).
The Office for National Statistics is part of the Civil Service, and as such we share a number of key benefits with other departments, whilst also having our own unique offerings to support our valued colleagues across the organisation.
Whether you are hearing about us for the first time or already know a bit about our organisation, we hope that our careers site will give you a great insight into the benefits and facilities available to our colleagues, and our fantastic working culture.
Inclusion & Accessibility
At ONS we are always looking to attract the very best people from the widest possible talent pool, and we are proud to be an inclusive, equal opportunities employer. As a Disability Confident Leader we’re committed to ensuring that all candidates are treated fairly throughout the recruitment process.
As part of our application process, you will be prompted to provide details of any reasonable adjustments to our recruitment process that you need. If you would like to discuss any reasonable adjustments before applying, please contact the recruitment team in the first instance.
If you would like an accessible version of any of the attachments or recruitment documents below or linked to in this advert, please contact the recruitment team who will be happy to assist.
ONS are committed to flexible ways of working that support a healthy work-life balance. ONS has already considered how this job could be right sized for applicants working flexibly and we are happy to explore options with you about working part time, in a job share or flexibly, in line with our hybrid working policies.
Things you need to know
Artificial intelligence
Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.
Selection process details
This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.
Security Clearance
For ONS the requirement for SC clearance is to have been present in the UK for 3 consecutive years immediately prior to applying and the department will consider eligibility by exception on a case-by-case basis. You will be asked to provide information regarding your UK residency during your application, and failure to provide this will result in your application being rejected.
If you are unsure that you meet the eligibility above, please read the information available on Gov.uk on this link or contact the recruitment email on the advert before applying to discuss, as failure to meet the residency requirements will result in your security clearance application being rejected and any offer of employment being withdrawn.
At the point of SC application, you will need to provide or give access to the following evidence:
Visa Sponsorship
ONS may be able to provide visa sponsorship where the role meets ONS sponsorship criteria and all relevant Home Office requirements. Applicants must hold, or be eligible to obtain, the right to work in the UK before employment commences.
Application Process
Number of Stages: 2 stage process
Stage 1: Application
Stage 2: Interview
Stage 1 – Application
The assessment process at the application stage will be based on your work history, CV, skills, experience, and personal statement. It is important that your application is tailored to highlight the skills, knowledge, and experience relevant to the role.
A personal statement is required at application stage, the maximum word count allowed is 1250 words, which should not be exceeded. You should provide evidence for each essential skill criterion listed in the person specification. As these criteria are scored, it is advisable to give clear examples for each one, including the impact of your actions, ideally utilising the STAR technique (Situation, Task, Action, Result).
Please note that Success Profiles Behaviour examples are not required at this stage of the application process.
In instances where a high number of applications are received, the sift pass mark may be adjusted, and candidates will be invited to interview based on merit order, i.e., those with the highest scores.
When a high volume of applications are received, the sift pass mark may be adjusted. Candidates will be invited to interview based on their merit order, with those achieving the highest scores being prioritised. Applicants who score below the adjusted pass mark but still pass will be placed on hold and may be invited to interview at a later date.
We often have similar roles available at different grades. If a candidate is suitable for a similar role or a lower grade than they have applied for, we may offer the candidate that role without the need to go through a further selection process providing the role has the same behaviours, and essential skills.
Stage 2 – Interview
If invited to interview, you will be assessed using techniques aligned with the Civil Service Success Profiles framework, covering all behaviours listed in the job advert and any required technical skills.
Interviews will be in person in our Newport and Titchfield offices:
Titchfield: Segensworth Road, Titchfield, Fareham, Hampshire, PO15 5RR
Newport: Government Buildings, Cardiff Road, Newport, NP10 8XG
Please note: Travel expenses will not be reimbursed. You will also be required to bring valid photo identification to your interview.
You will be required to provide a 10 minute presentation at interview. The presentation topic will be emailed to candidates who have passed the initial online application stage, 1 week prior to interview. This presentation will assess candidates against the Success Profiles Behaviour Managing a quality service.
A reserve list may be held for a period up to 12 months from which further appointments may be made.
Important Dates
Please note that all campaigns may be subject to withdrawal at any stage if the internal resource position changes.
This role is eligible for the Government Digital and Data (GDD) Capability and Pay Framework. If you are successful at interview, your salary will be directly linked to your capability outcome, as determined by your performance in the Technical section of the interview.
All successful candidates are required to undertake an annual capability assessment as part of their ongoing employment terms. The outcome of this assessment directly influences individual pay levels:
Initial Capability Assessment
If you're already in a GDD Group 1 role and receiving GDD pay, and you make a lateral move (i.e. same grade, different role):
Development Plan
Please Note
Security
Successful candidates must undergo a basic (or equivalent) criminal record check.
Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).See our vetting charter (opens in a new window).
People working with government assets must complete baseline personnel security standard (opens in new window) checks.
Nationality requirements
This Job Is Broadly Open To The Following Groups
Working for the Civil Service
The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.
We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.
The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.
Diversity and Inclusion
The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).
Apply and further information
This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.
Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.
Contact point for applicants
Job Contact
If you feel your application has not been treated in accordance with the Recruitment Principles and you wish to make a complaint, in the first instance, you should contact recruitment.complaints@ons.gov.uk. If you are not satisfied with the response you receive from the Department, you can contact the Civil Service Commission
The Office for National Statistics (ONS) is the UK’s largest producer of official statistics, covering a range of key economic, social and demographic topics. These include measuring changes in the value of the UK economy, estimating the size, geographic distribution and characteristics of the population, and providing indicators of price inflation, employment, earnings, crime and migration.
The last few years has seen an extensive overhaul of security and information management to meet the challenges of corporate and statistics transformation in technology, methods and practice, the Digital Economy Act and organisational risk appetite. The capability is evolving and expanding to address changes in threat and business direction.
This Cyber Security Threat Hunting Principal role sits within the Security and Information Management (SaIM) Directorate, which operates six key services across ONS: Security Risk Advice and Management; Knowledge and Information Management (KIM); Physical Security and Business Continuity; Security Compliance and Audit (SCA); Cyber Security; and Security Culture Services.
Job Description
The role will lead in delivering the Cyber Security Threat Hunting function which is part of the Cyber Security division, within the Security and Information Management directorate.
This will involve having a detailed understanding of the methods used to malicious attackers as well as business understanding to be able to identify unusual and malicious activity. The role will lead on complexity threat hunts to proactively identify potential malicious activity present in the ONS IT estate and vulnerabilities that could be used for malicious activity. Findings from these threat hunts will be reported to the senior leaders in Security and Information Management, Cyber Security Threat Hunting Principal will advice and lead on remediation steps against identified findings and vulnerabilities.
In addition, the role holder will assist in major incident response providing highly skilled resource to the Cyber Security Incident Response Principal when required.
Typical assignments
- Delivering strategic objectives for Cyber Security Threat Hunting function over the three-year Security and Information Management (SaIM) strategy period.
- Conduct Cyber Security Threat Hunting aligned to the cyber threat faced by ONS, scope the threat hunts hypothesis and report the findings to the Head of Cyber Security.
- Identify opportunities to improve the quality of security alerts and work with the cyber analytics to implement changes to alerting, ensuring all teams involved are briefed and appropriate and high-quality documentation is created.
- Identify misconfiguration and other vulnerabilities present in the ONS network, leading the remediation, working with the stakeholders in Vulnerability Management and Digital Services.
- Liaise with other government departments to assist in the identification and remediation of cyber security threats.
- Lead the Cyber Security Threat Hunting function, developing the function and integrating it into the cyber security division.
- Define and advising on techniques and procedures to undertake Cyber Security Threat Hunting activity.
- Create Cyber Security Threat Hunting hypothesis, undertake testing and produce detailed reports.
- Report the findings and management information of the Cyber Security Threat Hunts to the Head of Cyber Security.
- Identifying opportunities to improve protective monitoring and vulnerability management.
- Support the remediation of high-priority cyber security incidents.
Person specification
Essential Criteria
- Experience in developing and implementing cyber security strategy across people, process, and technology.
- Lead large-scale, cross-functional or highly complex cyber security threat hunts to proactively hunt for malicious activity not identified by protective monitoring or vulnerability management.
- Disseminate the implications of Cyber Security Threat Hunting findings and explain the potential business impact if findings are exploited to senior level leadership across government.
- Lead engagement with senior internal and external stakeholders to manage and provide appropriate Cyber Security assurance to the required standard and in accordance with policy and regulations.
- Advise on complex issues and mitigation options to appropriate stakeholders or governance forums, acting as an SME across government, the public sector, and industry.
- Be the key decision maker on reports, overseeing the remediation of vulnerabilities identified during Cyber Security Threat Hunts.
- Proven track record of analysing complex information associated with Cyber Security.
- Working towards or have obtained, relevant professional membership e.g. GIAC, CISSP.
We'll assess you against these behaviours during the selection process:
- Managing a Quality Service
- Communicating and Influencing
We'll assess you against these technical skills during the selection process:
- Penetration testing
- Information risk assessment and risk management
- Protective Security
- Threat Understanding
Alongside your salary of £60,498, Office for National Statistics contributes £17,526 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).
The Office for National Statistics is part of the Civil Service, and as such we share a number of key benefits with other departments, whilst also having our own unique offerings to support our valued colleagues across the organisation.
Whether you are hearing about us for the first time or already know a bit about our organisation, we hope that our careers site will give you a great insight into the benefits and facilities available to our colleagues, and our fantastic working culture.
Inclusion & Accessibility
At ONS we are always looking to attract the very best people from the widest possible talent pool, and we are proud to be an inclusive, equal opportunities employer. As a Disability Confident Leader we’re committed to ensuring that all candidates are treated fairly throughout the recruitment process.
As part of our application process, you will be prompted to provide details of any reasonable adjustments to our recruitment process that you need. If you would like to discuss any reasonable adjustments before applying, please contact the recruitment team in the first instance.
If you would like an accessible version of any of the attachments or recruitment documents below or linked to in this advert, please contact the recruitment team who will be happy to assist.
ONS are committed to flexible ways of working that support a healthy work-life balance. ONS has already considered how this job could be right sized for applicants working flexibly and we are happy to explore options with you about working part time, in a job share or flexibly, in line with our hybrid working policies.
Things you need to know
Artificial intelligence
Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.
Selection process details
This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.
Security Clearance
For ONS the requirement for SC clearance is to have been present in the UK for 3 consecutive years immediately prior to applying and the department will consider eligibility by exception on a case-by-case basis. You will be asked to provide information regarding your UK residency during your application, and failure to provide this will result in your application being rejected.
If you are unsure that you meet the eligibility above, please read the information available on Gov.uk on this link or contact the recruitment email on the advert before applying to discuss, as failure to meet the residency requirements will result in your security clearance application being rejected and any offer of employment being withdrawn.
At the point of SC application, you will need to provide or give access to the following evidence:
- Departmental or company records (personnel files, staff reports, sick leave reports and security records)
- UK criminal records covering both spent and unspent criminal records
- Your credit and financial history with a credit reference agency
- Security Services records
Visa Sponsorship
ONS may be able to provide visa sponsorship where the role meets ONS sponsorship criteria and all relevant Home Office requirements. Applicants must hold, or be eligible to obtain, the right to work in the UK before employment commences.
Application Process
Number of Stages: 2 stage process
Stage 1: Application
Stage 2: Interview
Stage 1 – Application
The assessment process at the application stage will be based on your work history, CV, skills, experience, and personal statement. It is important that your application is tailored to highlight the skills, knowledge, and experience relevant to the role.
A personal statement is required at application stage, the maximum word count allowed is 1250 words, which should not be exceeded. You should provide evidence for each essential skill criterion listed in the person specification. As these criteria are scored, it is advisable to give clear examples for each one, including the impact of your actions, ideally utilising the STAR technique (Situation, Task, Action, Result).
Please note that Success Profiles Behaviour examples are not required at this stage of the application process.
In instances where a high number of applications are received, the sift pass mark may be adjusted, and candidates will be invited to interview based on merit order, i.e., those with the highest scores.
When a high volume of applications are received, the sift pass mark may be adjusted. Candidates will be invited to interview based on their merit order, with those achieving the highest scores being prioritised. Applicants who score below the adjusted pass mark but still pass will be placed on hold and may be invited to interview at a later date.
We often have similar roles available at different grades. If a candidate is suitable for a similar role or a lower grade than they have applied for, we may offer the candidate that role without the need to go through a further selection process providing the role has the same behaviours, and essential skills.
Stage 2 – Interview
If invited to interview, you will be assessed using techniques aligned with the Civil Service Success Profiles framework, covering all behaviours listed in the job advert and any required technical skills.
Interviews will be in person in our Newport and Titchfield offices:
Titchfield: Segensworth Road, Titchfield, Fareham, Hampshire, PO15 5RR
Newport: Government Buildings, Cardiff Road, Newport, NP10 8XG
Please note: Travel expenses will not be reimbursed. You will also be required to bring valid photo identification to your interview.
You will be required to provide a 10 minute presentation at interview. The presentation topic will be emailed to candidates who have passed the initial online application stage, 1 week prior to interview. This presentation will assess candidates against the Success Profiles Behaviour Managing a quality service.
A reserve list may be held for a period up to 12 months from which further appointments may be made.
Important Dates
- Eligibility Security Clearance checks from 06/11 - 13/11. We will be sending you an e-mail with a form to fill out. Please check your junk e-mails for any correspondence.
- Sift will be conducted from 16/11/2026
- Interviews will be conducted from 30/11/2026
Please note that all campaigns may be subject to withdrawal at any stage if the internal resource position changes.
This role is eligible for the Government Digital and Data (GDD) Capability and Pay Framework. If you are successful at interview, your salary will be directly linked to your capability outcome, as determined by your performance in the Technical section of the interview.
- Capability Outcome: Assessed based on scores achieved during the technical interview.
- Salary Determination: Your starting salary will reflect the capability level assigned.
- Feedback: Full feedback on your capability outcome will be provided at the point of offer.
All successful candidates are required to undertake an annual capability assessment as part of their ongoing employment terms. The outcome of this assessment directly influences individual pay levels:
- Higher Capability Outcome: Results in an increase in pay.
- Lower Capability Outcome: Results in a decrease in pay.
Initial Capability Assessment
If you're already in a GDD Group 1 role and receiving GDD pay, and you make a lateral move (i.e. same grade, different role):
- You’ll be assessed in your new role through the interview process.
- If your proficiency level is lower than your current one, you retain your current level and pay for 6 months.
Development Plan
- During those 6 months, you’ll work with your line manager to create and follow a development plan to build the required skills.
- If you reach your previous proficiency level, you keep your current pay.
- If your proficiency is still lower, your pay will decrease to match the new level.
- If your proficiency level is higher, your pay will increase to match the new level.
Please Note
- Existing allowances (scarce skills) will not be taken into account when calculating starting salary.
- This policy applies to all candidates, including existing Civil Servants and ONS colleagues transitioning to the GDD Capability and Pay Framework.
Security
Successful candidates must undergo a basic (or equivalent) criminal record check.
Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).See our vetting charter (opens in a new window).
People working with government assets must complete baseline personnel security standard (opens in new window) checks.
Nationality requirements
This Job Is Broadly Open To The Following Groups
- UK nationals
- nationals of the Republic of Ireland
- nationals of Commonwealth countries who have the right to work in the UK
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
- nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
- individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
- Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service
Working for the Civil Service
The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.
We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.
The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.
Diversity and Inclusion
The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).
Apply and further information
This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.
Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.
Contact point for applicants
Job Contact
- Name : Government Digital and Data Recruitment
- Email : Government-Digital-and-Data-Recruitment@ons.gov.uk
- Email : About.You@ons.gov.uk
If you feel your application has not been treated in accordance with the Recruitment Principles and you wish to make a complaint, in the first instance, you should contact recruitment.complaints@ons.gov.uk. If you are not satisfied with the response you receive from the Department, you can contact the Civil Service Commission
