Cyber Defence Lead, CSD

PRINCIPAL ACCOUNTABILITIES

• Lead, establish and continuously enhance the Cyber Defence Unit (CDU) roadmap, strategy and operating model in alignment with Cyber Threat & Defence Management (CTDM) objectives and the evolving cyber threat landscape.
• Provide overall leadership and governance for 24×7 cyber defence operations, including Security Operations Centre (SOC), Security Information and Event Management (SIEM) platform operations, and Digital Forensics & Incident Response (DFIR) capabilities.
• Lead operational oversight of SIEM and security monitoring capabilities to ensure effective threat detection, alerting, log visibility and detection readiness in support of SOC operations and cyber incident response.
• Lead and govern the development, maintenance and execution of cyber defence frameworks, technologies, processes and procedures to ensure effective security monitoring, incident handling, response coordination and recovery.
• Lead the organisation, execution, tracking and reporting of the Cyber Security Incident Response Plan (CSIRP), playbooks, runbooks and cyber drill exercises, ensuring operational readiness and alignment with regulatory and management expectations.
• Provide senior technical leadership and subject matter expertise for cyber defence planning, including evaluation, deployment and enhancement of cyber security technologies, and implementation of continuous improvement initiatives to address identified gaps and risks.
• Lead and monitor technical and operational activities delivered by internal teams and outsourced service providers, including identification and resolution of non-compliance or service deviations, to ensure cyber security surveillance and response activities adhere to approved policies, procedures and service levels.
• Ensure delivery of reliable, effective and timely cyber defence services by SOC, SIEM and DFIR teams, and ensure all cyber security incidents, problems and issues are handled and resolved within agreed service levels, including management escalation where required, to minimise business impact.
• Work in close collaboration with the Cyber Threat Unit (CTU) Head to ensure strong operational alignment between cyber defence activities and threat intelligence, threat hunting, vulnerability management and offensive security functions across CTDM.
• Maintain strateguc relatopnships and collaboration with internal stakeholders, industry peers, regulators and external cyber security experts to benchmark and continuously improve the Bank's cyber security surveillance, monitoring, response and recovery capabilities.

JOB COMPLEXITY AND PROBLEM SOLVING

• Ability to provide effective communications/reporting on cybersecurity surveillance activities among stakeholders and ensure awareness on the roles and responsibilities throughout the organisation.
• Ability to mount and manage a team during cybersecurity incident or outbreak and provide timely response to maintain confidentiality, integrity and availability of the Bank’s information assets.
• Possess technical diversity and ensure that cybersecurity defence roles are effectively and efficiently carried out throughout the organisation.
• Ability to supervise or manage protective or corrective measures when a cybersecurity incident or vulnerability is discovered.

LEADERSHIP AND STAKEHOLDER MANAGEMENT

• Ability to keep abreast with the emerging technology and cybersecurity threats and understand the impact to the Bank’s application and infrastructure, and recommend mitigation plans to address the cybersecurity risks.
• Ability to coordinate cyber operations with other organization functions or support activities.
• Ability to adjust to and operate in a diverse, unpredictable, challenging, and fast-paced work environment
• Ability to understand technology, management, and leadership issues related to organization processes and problem solving.
• Academic Qualifications: Bachelor’s or Master’s degree in Cyber/Information Technology, Security, network engineering, networks and security or forensic computing.
• Experience: At least 8+ years of hands-on experience in these fields with strong knowledge of cybersecurity surveillance and emerging threats. Knowledge of infrastructure and application security is an advantage.