Cyber Defence Manager

We are seeking an experienced Cyber Defence Manager to lead vulnerability management, security findings consolidation, cyber incident coordination, and post-incident governance within a global enterprise environment. This role emphasizes risk-based prioritization of security exposures, remediation tracking, incident response, regulatory compliance, and driving security actions to resolution. The successful candidate will collaborate closely with Cyber Defence, Security Operations, Infrastructure, Application, Risk, and business teams to enhance the organization’s overall security posture.

Key Responsibilities

- Own and consolidate security findings from various sources including vulnerability scans, penetration testing, red/purple team exercises, cloud security assessments, application security testing, and threat intelligence.

- Prioritize vulnerabilities using risk-based methodologies such as CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and Critically Important Function (CIF) status.

- Coordinate remediation efforts with infrastructure, patch management, application, and service owners, ensuring compliance with SLAs and reducing aged vulnerabilities.

- Monitor remediation progress, mean time to remediate (MTTR), security posture metrics, scan coverage, and SLA breaches; escalate critical exposures and delays to relevant stakeholders.

- Manage vulnerability exceptions and risk acceptance workflows, ensuring documented ownership, compensating controls, approvals, and expiry dates.

- Prepare security posture reports, Key Risk Indicators (KRIs), and governance updates for committees and senior leadership.

- Coordinate cyber incidents from initiation to closure, including incident response meetings, stakeholder communications, documentation, and escalation.

- Lead post-incident reviews, root cause analysis, and lessons-learned sessions, ensuring corrective actions are tracked through to completion.

- Maintain central incident records, post-event trackers, and manage on-call and notification arrangements, including out-of-hours coverage.

- Support regulatory and compliance requirements such as DORA, Lloyd’s Principle 12, remediation Metric 7, and PRA engagements.

- Collaborate with security engineering, architecture, and tooling teams to improve vulnerability management processes, reporting automation, scan coverage, and data quality.

- Coordinate scanning attestations and pre-change governance requirements to ensure systems are appropriately scanned before deployment.

- Provide guidance to SecOps analysts and coordinate cross-functional remediation and incident management activities.

Required Qualifications

- Proven experience in vulnerability management, security operations, or cyber defence within a large, complex, and preferably regulated enterprise environment.

- Hands-on experience with vulnerability management platforms such as Tenable, Qualys, Vulcan, or equivalent tools.

- Working knowledge of cloud security, particularly Microsoft Defender for Cloud/Azure, container security, and application security testing tools including SAST, DAST, and SCA.

- Strong understanding of vulnerability risk assessment and prioritization methodologies including CVSS, EPSS, CISA KEV, threat intelligence, and asset criticality.

- Demonstrated ability to manage remediation SLAs, reduce vulnerability backlogs, coordinate incident response, conduct root cause analysis, and track corrective actions.

- Knowledge of security governance, risk acceptance, exception management, KRIs, and regulatory reporting requirements including DORA, Lloyd’s, and PRA.

- Experience with ServiceNow workflows, incident management platforms, and remediation tracking processes.

- Excellent stakeholder management, communication, analytical, and organizational skills, with the ability to engage both technical teams and senior management effectively.

Preferred Qualifications and Benefits

- Experience in financial services or insurance sectors.

- Familiarity with red/purple teaming and threat-led penetration testing.

- Experience with on-call tools such as PagerDuty or xMatters.

- Knowledge of CMDB and asset management, automation, AI-assisted reporting.

- Relevant certifications such as CISSP, GIAC, or ITIL are highly desirable.

This role offers the opportunity to play a critical part in strengthening the cybersecurity framework of a global enterprise, working alongside diverse teams to ensure robust protection against evolving threats.