Senior Cyber Defence Officer

As a Senior Cyber Defence Officer you will be a technical specialist in Swan's Cyber Defence team. You will configure and maintain our security controls, investigate escalated alerts and support the response to and recovery from security incidents, working with our managed security partners.
You will work across the full security lifecycle, from identifying and protecting to detecting, responding and recovering, working closely with the CISO, Risk and Compliance, the Project Management Office, the IT Transformation Office, IT and application teams and our third-party security vendors. The role suits an experienced security practitioner who is ready to take on more responsibility across security operations.

KEY RESPONSIBILITIES

1. Identify

• Maintain an accurate inventory of assets, identities, privileged and service accounts.
• Analyse vulnerabilities and security exposures, rate them by risk and recommend how to treat them.
• Work closely with Risk and Compliance on risk assessments and control testing, and with third-party vendors on remediation.

2. Protect

• Configure, maintain and improve security controls across identity and access, privileged access, multi-factor authentication, endpoints, firewalls, email, cloud and data.
• Maintain security baselines and hardening standards, and check systems against them.
• Draw and update the security architecture and technology diagrams, such as network security zones, security tool integrations, identity flows and data flows, whenever systems or controls change, for review and approval by the Cyber Defence Lead.
• Review new systems and projects for security and support them through to secure go-live.
• Implement and tune data protection controls, such as data classification, data loss prevention and encryption, to safeguard customer and personal data.

3. Detect

• Review and tune detection rules and alerts in the SIEM and EDR/XDR platforms with our managed security partner, reducing false positives.
• Review threat intelligence and security advisories, and take or recommend preventive actions.
• Onboard new systems and log sources into monitoring, and review the quality of the managed monitoring service.

4. Respond

• Investigate escalated security alerts, determine their scope and carry out containment actions.
• Support the Cyber Defence Lead in the technical response to incidents, working with incident response partners.
• Apply incident response playbooks for different types of breach, such as ransomware, business email compromise, data exfiltration and account compromise, and help develop and test them.
• Support the assessment of personal data breaches with the Data Protection Officer.
• Guide the Cyber Defence Officers during investigations and review the cases they escalate.

5. Recover

• Plan and carry out recovery and restoration tests with the platform teams.
• Carry out post-incident reviews and root cause analysis, and implement the lessons learned.

6. Reporting, compliance and improvement

• Identify opportunities to automate routine security tasks.
• Maintain technical documentation, procedures and playbooks.
• Prepare accurate and timely security reports, such as incident, vulnerability and control status reports, and contribute security metrics to the KPI dashboards used for management reporting.
• Implement changes and updates to security tools, configurations and systems to meet new regulatory requirements and audit recommendations.
• Provide technical evidence for internal, external and regulatory audits, and remediate audit findings within agreed timelines.
• Share knowledge, coach colleagues and take part in an on-call rota when needed.

7. Business as usual and project

• Carry out BAU security operations alongside project work, prioritising work in line with agreed team priorities.
• Act as the security point of contact on assigned security and IT projects, working closely with the Project Management Office, the IT Transformation Office, IT teams and application teams.
• Define security requirements, review designs and configurations, support security testing and make sure findings are fixed before go-live.
• Implement and configure the security controls delivered through projects, and hand them over into BAU with documentation and monitoring in place.

QUALIFICATIONS AND EXPERIENCE

Essential

• A degree in Information Systems, Cybersecurity or a related field, or equivalent work experience.
• At least 4-5 years' experience in IT security, including security operations, SOC or incident response work.
• Hands-on experience configuring enterprise security controls, such as identity and privileged access management, conditional access and MFA, EDR/XDR, firewalls and email security.
• Experience with a SIEM, including running search queries and reviewing alerts.
• Hands-on experience with the Microsoft security stack, including Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview and Intune.
• Good understanding of attacker techniques (MITRE ATT&CK) and of NIST CSF and ISO 27001 controls.
• Experience supporting audits and implementing control changes to meet regulatory or audit requirements.
• Experience maintaining security architecture and network diagrams.
• Experience supporting IT or security projects from design through to go-live, alongside BAU security work.
• Experience preparing clear, accurate and timely security reports and metrics for management.
• Sound understanding of incident response, including ransomware containment and playbooks for common breach types.
• Understanding of data protection principles and controls, and of the Mauritius Data Protection Act 2017.
• Working knowledge of Windows, Active Directory, networking and cloud platforms.
• Microsoft security certifications, such as Security Operations Analyst (SC-200), Identity and Access Administrator (SC-300), Information Security Administrator (SC-401) or Azure Security Engineer (AZ-500).
• Clear written and spoken communication in English and French.

The Company reserves the right: 

1. To convene only the best qualified candidates to participate in the selection exercise. 
2. Not to make any appointment following this advertisement