Head of Security Incident and Response

About this role

Bristol, London, Newcastle-upon-Tyne, Reading, Warrington, York

Job Summary

Defra is the UK government department responsible for safeguarding our natural environment, supporting our world-leading food and farming industry, and sustaining a thriving rural economy. Our broad remit means we play a major role in people's day-to-day life, from the food we eat, and the air we breathe, to the water we drink.

Digital, Data, Technology and Security (DDTS) is the trusted team for digital across the entire Defra Group.

We have around 1000 colleagues across DDTS and our ambition is to make it easier and faster than ever for people to interact with Defra. If you are ready to drive innovation and push boundaries, we want to hear from you. Join us and together we will create a great place for living, and a green and healthy future for all.

Find Out More About DDTS

Defra digital, data and technology blog

LinkedIn

Defra Jobs

Job Description

The Head of Security Incident and Response provides operational leadership of the Defra Group Security Incident Response Management (SIRM) capability, ensuring the organisation is prepared for, and able to respond effectively to, security incidents ranging from routine events to significant security incidents.

As the senior lead for security incident management, the role oversees incident response policy, governance and operational coordination, directs the response to complex and high-impact incidents, and provides authoritative advice and recommendations to senior stakeholders.

Operating across the Defra Group, the postholder ensures a consistent, risk-based approach to incident management, protecting organisational assets, maintaining stakeholder confidence, and supporting the resilience of critical services and business operations.

The role leads the Defra Group's approach to security investigations, including unauthorised disclosure cases, ensuring robust governance, effective investigative oversight, and informed decision-making by senior stakeholders

Please note for this role you will require SC Clearance. To gain SC clearance all applicants are required to have been a UK resident for a minimum of 5 years. If this requirement is not met, the individual will not be able to progress their application further.

The Head of Security Incident and Response provides operational leadership of the Defra Group Security Incident Response Management (SIRM) capability, ensuring the organisation is prepared for, and able to respond effectively to, security incidents ranging from routine events to significant security incidents.

As the senior lead for security incident management, the role oversees incident response policy, governance and operational coordination, directs the response to complex and high-impact incidents, and provides authoritative advice and recommendations to senior stakeholders.

Operating across the Defra Group, the postholder ensures a consistent, risk-based approach to incident management, protecting organisational assets, maintaining stakeholder confidence, and supporting the resilience of critical services and business operations.

The role leads the Defra Group's approach to security investigations, including unauthorised disclosure cases, ensuring robust governance, effective investigative oversight, and informed decision-making by senior stakeholders

Please note for this role you will require SC Clearance. To gain SC clearance all applicants are required to have been a UK resident for a minimum of 5 years. If this requirement is not met, the individual will not be able to progress their application further.

Person specification

Responsibilities

• Define and maintain Security Incident Response Management playbooks for Defra group, providing clear policy, process, responsibilities, and governance for tackling security incidents across core Defra, agencies and ALBs.
• Coordinate across all parts of Defra group to draw on best practice, align Security Incident Response Management processes and integrate with group level approach.
• Lead on security incident response management relating to all levels of incidents, including dealing with complex and varied situations where no clear guidance is available, assimilating available information and making clearly reasoned recommendations to senior stakeholders.
• Responsible for performance of the Security Incident Response Management team including all decision-making associated work allocation and completion of all activities.
• Report on security incidents to security governance groups, including agreeing reporting processes and thresholds will all areas of the business, and overseeing analysis, identification of trends and root cause analysis.
• Coordinate and lead Security Incident Response exercises across physical, personnel, information and cyber security incidents.
• Lead on investigation of leaks and other security breaches on behalf of Defra group, conducting investigations in accordance with policy and in collaboration with Cabinet Office where appropriate.

Skills And Experience

• Demonstrable experience of managing security incidents and providing advice across multiple security disciplines, including physical security, personnel security, information security, risk management, data protection and cyber security.
• Ability to build and maintain effective relationships across organisational boundaries, including with senior stakeholders, security teams, law enforcement partners and the wider UK security community.
• Strong analytical skills, with the ability to interpret complex information and provide clear, evidence-based advice and recommendations.
• Proven ability to think strategically, identify emerging risks and opportunities, and ensure delivery aligns with evolving business and security priorities.
• Experience of managing complex and diverse workloads, coordinating activity across multiple teams, and overseeing sensitive investigations and incident responses.
• Experience of leading teams and influencing outcomes in high-pressure environments where decisions often need to be made with incomplete information.
• Proven experience in protective, cyber and/or information security, together with a recognised professional qualification (e.g. CISMP, CSMP, CPP, CISM, BCI or equivalent), or evidence of working towards achieving such a qualification.

Behaviours

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions
• Leadership
• Communicating and Influencing

Alongside your salary of £56,375, Department for Environment, Food and Rural Affairs contributes £16,331 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).

• Learning and development tailored to your role
• An environment with flexible working options
• A culture encouraging inclusion and diversity
• A Civil Service pension with an employer contribution of 28.97%

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Strengths and Experience.

The Civil Service marks each element of the selection process on a merit basis. You can visit the gov.uk website for further information on the Civil Service rating scale.

About security roles for ex-police

Security management, operations and consultancy roles. Years of operational policing — command, incident response, public order — translate directly into corporate security, and employers in this sector actively rate police experience.