Cyber Defence Manager

About the role

An experienced Cyber Defence Manager is sought to oversee vulnerability management, security findings, cyber incident coordination and post-incident governance across a global enterprise. The role focuses on risk-based prioritisation of security exposures, remediation tracking, incident coordination, regulatory compliance and driving security actions to closure, working closely with Cyber Defence, Security Operations, Infrastructure, Application, Risk and business teams.

Key responsibilities

• Consolidate security findings from vulnerability scans, penetration testing, red/purple team exercises, cloud and application security assessments and threat intelligence.
• Prioritise vulnerabilities using risk-based methods such as CVSS, EPSS, CISA KEV, threat intelligence, asset criticality and CIF status.
• Coordinate remediation with infrastructure, patch management, application and service owners, ensuring SLA compliance and reducing aged vulnerabilities.
• Monitor remediation progress, MTTR, scan coverage and SLA breaches, escalating critical exposures and delays.
• Manage vulnerability exceptions and risk-acceptance workflows, with documented ownership, compensating controls and expiry dates.
• Prepare security posture reports, KRIs and governance updates for committees and senior stakeholders.
• Coordinate cyber incidents from invocation to closure, including response meetings, stakeholder communication, documentation and escalation.
• Lead post-incident reviews, root cause analysis and lessons-learned sessions, tracking corrective actions to completion.
• Maintain incident records, post-event trackers and on-call/notification arrangements, including out-of-hours coverage.
• Support regulatory and compliance requirements such as DORA, Lloyd's Principle 12, Remediation Metric 7 and PRA engagements.
• Work with security engineering, architecture and tooling teams to improve processes, reporting automation, scan coverage and data quality, and coordinate scanning attestations and pre-change governance.
• Provide direction to SecOps analysts and coordinate cross-functional remediation and incident management.

Required profile

• Proven experience in vulnerability management, security operations or cyber defence in a large, complex, preferably regulated enterprise.
• Demonstrated experience managing remediation SLAs, reducing vulnerability backlogs, coordinating incident response, conducting root cause analysis and tracking corrective actions.
• Knowledge of security governance, risk acceptance, exception management, KRIs and regulatory reporting (DORA, Lloyd's, PRA).
• Experience with ServiceNow workflows, incident management platforms and remediation tracking.
• Strong stakeholder management, communication, analytical and organisational skills, able to engage technical teams and senior management.

Required skills

• Hands-on experience with vulnerability management platforms such as Tenable, Qualys, Vulcan or equivalent.
• Working knowledge of cloud security (Microsoft Defender for Cloud/Azure), container security and SAST, DAST and SCA tools.
• Preferred: financial services or insurance experience, red/purple teaming, on-call tools such as PagerDuty or xMatters, CMDB and asset management, automation, AI-assisted reporting, and certifications such as CISSP, GIAC or ITIL.