SL2471 - Information Security (Managed Detection and Response)

Responsibilities • Take command of major cyber incidents and own the end-to-end DFIR lifecycle — from detection and containment through eradication, recovery and post-incident review. • Set and drive the Group's cyber defence and detection-and-response strategy, aligned to MAS TRM, NIST CSF v2.0 and ISO/IEC 27001:2022. • Govern and optimise our SIEM, SOAR, EDR and DLP platforms to maximise detection coverage, efficacy and value. • Lead detection engineering and proactive, intelligence-led threat hunting mapped to the MITRE ATT&CK framework. • Shape our security telemetry and logging strategy, prioritising log source onboarding for comprehensive coverage. • Build security automation and orchestration that make detection and response faster, more consistent and higher quality. • Adopt and govern AI-enabled capabilities to strengthen security operations while keeping the right guardrails in place. • Develop, maintain and regularly test incident response playbooks, runbooks and cyber crisis and tabletop exercises. • Manage external forensic, MDR and threat-intelligence partners, including onboarding, performance and SLA oversight. • Define, track and report detection-and-response metrics (such as MTTD and MTTR) to drive continuous improvement. • Mentor analysts and engineers, sharing your expertise to build a high-performing, resilient and collaborative team. • Support audits, regulatory engagements and executive/Board reporting, and represent the organization in industry threat-sharing communities. Requirements • 8+ years in cyber security, with deep, hands-on expertise in DFIR, Detection Engineering, Threat Hunting, SIEM, SOAR, EDR, DLP, security automation and AI-enabled Security Operations. • A proven track record leading major cyber incidents and complex forensic investigations from start to finish. • Strong working knowledge of MAS TRM, NIST CSF v2.0, ISO/IEC 27001:2022 and the MITRE ATT&CK framework. • Hands-on experience across cloud (AWS/Azure), endpoint, network and identity telemetry, detection-as-code and automation. • Experience in a regulated financial services or insurance environment (strongly preferred). • A Bachelor's degree in Computer Science, Information Security or a related field, or equivalent professional experience. • One or more relevant certifications — CISSP, GCFA, GCIH, GNFA, GREM, GCTI or equivalent. • Calm, decisive leadership under pressure, sharp analytical thinking, and the ability to translate technical risk clearly for management and stakeholders.