Cyber Defence Lead

As Cyber Defence Lead you will be accountable for Swan's cybersecurity operations from end to end. You will lead the Cyber Defence team, set priorities, keep security operations running while new projects are delivered, and take charge when an incident happens. The role covers the full security lifecycle, from identifying and protecting to detecting, responding and recovering. You will work in close collaboration with the CISO, Risk and Compliance, the Project Management Office, the IT Transformation Office, IT and application teams and our third-party security vendors, and will be Swan's main point of contact for all cybersecurity operations. 

1. Leadership and team management

• Lead, coach and develop the Senior Cyber Defence Officers and Cyber Defence Officers, and set clear daily priorities.
• Define how the team works: procedures, escalation paths, on-call arrangements and service levels.
• Plan capacity across operational work and projects, and build skills so the team is resilient to absence.
• Assign roles and responsibilities across the team, applying segregation of duties and sound internal control practices.
• Work in close collaboration with the CISO, Risk and Compliance and third-party vendors to align security priorities, risk treatment and service delivery.

2. Identify
•    Own the view of Swan's assets, identities, privileged accounts and security exposures.
•    Work with Risk and Compliance on security risk assessments, the risk register and the treatment of risks.
•    Oversee vulnerability assessments and external penetration testing, and prioritise findings by business risk.

3. Protect

• Own Swan's security architecture and keep it up to date, including the enterprise security architecture, security technology architecture, network security zones and segmentation, identity and access architecture and data flows, for systems both on-premises and in the cloud, aligned with Swan's enterprise and technology architecture and reviewed with the CISO.
• Review and approve updates to security architecture diagrams and documentation when systems, projects or controls change, and own the configuration standards and effectiveness of controls across identity and access, privileged access, endpoints, networks, email, cloud and data.
• Run the vulnerability and patch management programme with IT Operations so that critical issues are fixed within agreed timelines.
• Make sure projects are secure by design, and approve security sign-off before go-live.
• Oversee security awareness and phishing simulation programmes.
• Secure Swan's use of AI, including AI assistants and generative AI services: set guardrails for their use, protect the data they can access, and manage AI-specific risks such as data leakage, prompt injection and misuse.
• Lead data protection within cyber defence, working with the Data Protection Officer: data classification, data loss prevention, encryption and the secure handling of customer and personal data, in line with the Mauritius Data Protection Act 2017 and GDPR where applicable.

4. Detect

• Oversee security monitoring, detection use cases, threat hunting and the use of threat intelligence.
• Govern the 24/7 managed security monitoring service, including service levels, escalation quality and coverage.
• Make sure new on-premises systems and cloud services are monitored before they go live.

5. Respond

• Act as incident manager for security incidents, coordinating the team, IT Operations, business owners and incident response partners.
• Own incident classification and escalation, and support senior management on notifications to regulators and authorities within the required timelines.
• Lead digital forensic investigations across on-premises and cloud systems, including evidence collection and preservation, chain of custody and root cause analysis, working with specialist forensic partners where needed.
• Maintain incident response playbooks for each type of breach, including ransomware, business email compromise and phishing, data breach and exfiltration, account compromise, insider threat, denial of service and third-party or supply-chain compromise, and test them through tabletop and technical exercises.
• Coordinate the response to personal data breaches with the Data Protection Officer and Legal, including notification to the Data Protection Commissioner and affected customers where required.

6. Recover

• Make sure recovery and restoration plans for critical systems are tested with the platform teams.
• Lead post-incident reviews and track root causes and lessons learned through to closure.

7. Governance, compliance and reporting

• Produce regular management reporting for the CISO, senior management and the Security Forum on security posture, incidents, risks and key metrics.
• Build and maintain cybersecurity KPI dashboards, covering measures such as mean time to detect and respond, critical vulnerability ageing, patch compliance, EDR and monitoring coverage, phishing simulation results, privileged access reviews and vendor service levels.
• Track new and changing regulatory requirements, such as those of the Financial Services Commission and the Data Protection Office, assess their impact and lead the resulting changes and updates to security tools, systems and procedures.
• Review the cybersecurity policies, standards and procedures developed by the CISO and give feedback based on how controls work in day-to-day operations, so that they stay practical and aligned with regulatory requirements, and make sure approved policies are reflected in operational procedures and security controls.
• Lead the response to internal, external and regulatory audits and ISO 27001 assessments: coordinate evidence, agree management responses and make sure findings are remediated within agreed timelines.
• Manage third-party security vendors and service providers, including service level and performance reviews, maintain the security roadmap and track delivery of security projects.

8. Business as usual and projects

• Balance business-as-usual (BAU) security operations with project delivery, so that day-to-day security services keep running while projects are delivered.
• Work in close collaboration with the Project Management Office, the IT Transformation Office, IT teams and application teams, and provide security input to all security and IT projects from planning through to go-live.
• Be accountable for the cybersecurity deliverables of each project, including security requirements, architecture and design reviews, risk assessments, security testing and sign-off, and assign team members to support projects.
• Raise project security risks, dependencies and resource needs early through project governance, and track them through to closure.
• Make sure new systems and services are handed over into BAU with security controls, monitoring, documentation and procedures in place.
• QUALIFICATIONS AND EXPERIENCE 
  • A degree in Information Systems, Cybersecurity or a related field, or equivalent work experience.
  • At least 5-7 years' experience in cybersecurity, including at least 3 years leading or supervising a security team.
  • Broad hands-on experience with enterprise security technologies: SIEM, EDR/XDR, identity and privileged access management, multi-factor authentication, next-generation firewalls, email and data security.
  • Hands-on working experience with the Microsoft security stack, such as Microsoft Entra ID, Microsoft Purview, Microsoft Defender XDR, Microsoft Sentinel and Intune.
  • Experience securing hybrid environments, with systems both on-premises and in the cloud.
  • Experience owning and maintaining security architecture, including enterprise security architecture and security technology architecture, across hybrid environments.
  • Proven experience managing security incidents from detection through to recovery, with a full understanding of incident response and of playbooks for different types of breach, including ransomware.
  • Experience in digital forensics and incident investigation, including evidence handling on on-premises and cloud systems.
  • Understanding of AI security risks and of the controls needed to use AI safely.
   
  
   The Company reserves the right: 
  1. To convene only the best qualified candidates to participate in the selection exercise. 
  2. Not to make any appointment following this advertisement