Cyber Defence Manager

We are looking for an experienced Cyber Defence Manager to oversee vulnerability management, security findings, cyber incident coordination, and post-incident governance across a global enterprise environment. The role will focus on risk-based prioritisation of security exposures, remediation tracking, incident coordination, regulatory compliance, and driving security actions to closure. The position will work closely with Cyber Defence, Security Operations, Infrastructure, Application, Risk, and business teams to strengthen the organisation’s overall security posture.ResponsibilitiesOwn and consolidate security findings from vulnerability scans, penetration testing, red/purple team exercises, cloud security assessments, application security testing, and threat intelligence.Prioritise vulnerabilities using risk-based methodologies, including CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and Critically Important Function (CIF) status.Coordinate remediation activities with infrastructure, patch management, application, and service owners, ensuring SLA compliance and reducing aged vulnerabilities.Monitor remediation progress, MTTR, security posture metrics, scan coverage, and SLA breaches; escalate critical exposures and remediation delays to relevant stakeholders.Manage vulnerability exceptions and risk-acceptance workflows, ensuring documented ownership, compensating controls, approvals, and expiry dates.Prepare security posture reports, Key Risk Indicators (KRIs), and governance updates for relevant committees and senior stakeholders.Coordinate cyber incidents from invocation to closure, including incident response meetings, stakeholder communications, incident documentation, and escalation.Lead post-incident reviews, root cause analysis, and lessons-learned sessions, ensuring corrective actions are tracked through to completion.Maintain central incident records, post-event trackers, and on-call and notification arrangements, including out-of-hours coverage.Support regulatory and compliance requirements, including DORA, Lloyd’s Principle 12, remediation Metric 7, and PRA engagements.Collaborate with security engineering, architecture, and tooling teams to improve vulnerability management processes, reporting automation, scan coverage, and data quality.Coordinate scanning attestations and pre-change governance requirements, ensuring systems are appropriately scanned before deployment.Provide direction to supporting SecOps analysts and coordinate cross-functional remediation and incident management activities.RequirementsProven experience in vulnerability management, security operations, or cyber defence within a large, complex, preferably regulated enterprise environment.Hands-on experience with vulnerability management platforms such as Tenable, Qualys, Vulcan, or equivalent.Working knowledge of cloud security, particularly Microsoft Defender for Cloud/Azure, container security, and application security testing tools, including SAST, DAST, and SCA.Strong understanding of vulnerability risk assessment and prioritisation methodologies, including CVSS, EPSS, CISA KEV, threat intelligence, and asset criticality.Demonstrated experience managing remediation SLAs, reducing vulnerability backlogs, coordinating incident response, conducting root cause analysis, and tracking corrective actions.Knowledge of security governance, risk acceptance, exception management, KRIs, and regulatory reporting requirements, including DORA, Lloyd’s, and PRA.Experience with ServiceNow workflows, incident management platforms, and remediation tracking processes.Strong stakeholder management, communication, analytical, and organisational skills, with the ability to engage technical teams and senior management effectively.Preferred: Financial services or insurance experience, familiarity with red/purple teaming and threat-led penetration testing, on-call tools such as PagerDuty or xMatters, CMDB and asset management, automation, AI-assisted reporting, and relevant certifications such as CISSP, GIAC, or ITIL.