Senior Specialist, Cyber Threat Response

Job Summary

The Senior Specialist, Cyber Threat Response team handles complex and major cybersecurity incidents in coordination with global incident management.

Key Responsibilities

• Lead and coordinate the response to complex and critical cybersecurity incidents, including identification, containment, eradication, recovery, and post-incident analysis.
• Act as the primary point of contact for major and critical incidents, ensuring timely and effective response and resolution.
• Coordinate with cross-functional teams to manage the impact of major incidents on business operations.
• Establish and lead war room activities during major incidents, ensuring clear communication and efficient incident management.
• Prepare and deliver incident reports, including root-cause analysis and recommendations for future prevention.
• Provide guidance and mentorship to junior incident responders and other team members.
• Handle escalated security incident investigation and response from Cyber Threat Response Tier-1.
• Oversee security incident response activities performed by Cyber Threat Response Tier-1.
• Manage all stages of the incident response process: detection, collection, analysis, mitigation, and remediation.
• Proactively improve monitoring and response playbooks using lessons learned from past incidents; perform deep-dive analysis of identified and known tools, techniques, and procedures (TTPs) used in cyberattacks.
• Stay current on cybersecurity threats and vulnerabilities, the changing threat landscape, and regulatory and compliance requirements.
• Validate and maintain cybersecurity incident response plans, playbooks, and relevant standard operating procedures within the Cyber Defence Centre.
• Work closely with Cyber Defence Alliance (CDA) and Collective Intelligence & Command Centre (CIC) on collective response and situational awareness.
• Collaborate and participate in joint investigations with Fraud, FCC/i3, and Property.
• Participate in cyber stress testing and tabletop exercises (TTXs).

Skills and Experience

• Minimum 8–10 years of cybersecurity incident-response experience in CERT, CIRT, or CSIRT teams.
• Bachelor’s degree in Information Security, Computer Science, Cybersecurity, Information Technology, or Engineering.
• Experience with incidents involving advanced persistent threats (APT) and nation-state actors.
• Familiarity with regulatory requirements and compliance standards relevant to the financial industry.
• Knowledge of scripting and automation tools to enhance incident response processes.
• Solid cybersecurity foundation and broad knowledge of application security, vulnerability management, and identity management.
• Familiarity with cyber threat investigations and malware analysis.
• Cloud application or infrastructure compromise investigation experience is desirable.
• Stakeholder-management skills for interaction with high-level executives and global heads during major incidents.
• Ability to translate complex technical findings into actionable reports for senior leadership and non-technical stakeholders.

What We Offer

• Competitive salary and benefits supporting mental, physical, financial, and social wellbeing.
• Retirement savings funding, medical and life insurance, with flexible and voluntary benefits in some locations.
• Flexible working options based around home and office locations, with flexible working patterns.
• Wellbeing support through Unmind, resilience and human-skills development courses, a global Employee Assistance Programme, sick leave, mental-health first-aiders, and self-help toolkits.
• Continuous learning, reskilling, upskilling, and access to physical, virtual, and digital learning.
• An inclusive, values-driven workplace that embraces diversity across teams, functions, and geographies.