Cyber Defence Officer

KEY RESPONSIBILITIES

1. Identify

• Run scheduled vulnerability assessments and keep the vulnerability register up to date.
• Support external penetration tests, including scoping, access and retests.
• Help keep asset and account records accurate

2. Protect

• Run patching cycles using our automated patching tools and follow up overdue items with IT Operations.
• Handle access provisioning, multi-factor authentication enrolment and access review evidence.
• Monitor endpoint compliance and device hardening.
• Administer physical security access, such as access cards and cameras.
• Implement approved changes to security tools, following change control.
• Keep records of security tools, versions, integrations and configurations up to date, and report changes so that the security architecture diagrams stay accurate.
• Support security awareness campaigns and phishing simulations.
• Support data protection controls, such as data loss prevention alerts, data classification labels and encryption checks, and escalate potential data leaks.

3. Detect

• Triage security alerts from the SIEM, EDR/XDR and email security platforms, and escalate them in line with procedures.
• Carry out daily reviews of privileged activity and report anything unusual.
• Handle phishing reports and email quarantine requests, and follow up with users.
• Maintain watchlists, blocklists and approved exceptions

4. Respond

• Escalate incidents promptly in line with procedures, including out of hours.
• Follow incident response playbooks for common breach types, such as ransomware, phishing and account compromise, and carry out the first-response steps assigned to you.
• Collect and preserve evidence and build incident timelines.
• Follow up physical security alarms with Facilities

5. Recover

• Support recovery and restoration tests and record the results.
• Track post-incident actions through to closure

6. Reporting and compliance

• Prepare the weekly security monitoring and metrics pack, and keep the cybersecurity KPI dashboard up to date for management reporting.
• Liaise with third-party security vendors on tickets, service requests and follow-ups.
• Gather and organise evidence for internal, external and regulatory audits, such as access reviews, patch reports and system logs.
• Apply approved updates to security tools and system configurations to meet regulatory and audit requirements, and track audit actions through to closure.
• Keep procedures up to date and take part in an on-call rota when needed

6. Business as usual and projects

• Carry out BAU security tasks reliably while supporting the project work assigned to you.
• Support security and IT projects, working with the Project Management Office, the IT Transformation Office, IT teams and application teams, for example with vulnerability scans, access set-up, onboarding systems into security tools and collecting evidence before go-live.
• Track the project security actions assigned to you through to completion, and update procedures and records when new systems move into BAU.