The Role
Supports cybersecurity operations across vulnerability management, patching, access controls, endpoint compliance, security monitoring, phishing response, incident response, evidence preservation, recovery testing, audit compliance, reporting, and security projects. The role administers Microsoft security tools, triages SIEM and EDR alerts, maintains security records, coordinates vendors and IT teams, and participates in an on-call rota.
Summary Generated by Built In
KEY RESPONSIBILITIES
1. Identify
- Run scheduled vulnerability assessments and keep the vulnerability register up to date.
- Support external penetration tests, including scoping, access and retests.
- Help keep asset and account records accurate
2. Protect
- Run patching cycles using our automated patching tools and follow up overdue items with IT Operations.
- Handle access provisioning, multi-factor authentication enrolment and access review evidence.
- Monitor endpoint compliance and device hardening.
- Administer physical security access, such as access cards and cameras.
- Implement approved changes to security tools, following change control.
- Keep records of security tools, versions, integrations and configurations up to date, and report changes so that the security architecture diagrams stay accurate.
- Support security awareness campaigns and phishing simulations.
- Support data protection controls, such as data loss prevention alerts, data classification labels and encryption checks, and escalate potential data leaks.
3. Detect
- Triage security alerts from the SIEM, EDR/XDR and email security platforms, and escalate them in line with procedures.
- Carry out daily reviews of privileged activity and report anything unusual.
- Handle phishing reports and email quarantine requests, and follow up with users.
- Maintain watchlists, blocklists and approved exceptions
4. Respond
- Escalate incidents promptly in line with procedures, including out of hours.
- Follow incident response playbooks for common breach types, such as ransomware, phishing and account compromise, and carry out the first-response steps assigned to you.
- Collect and preserve evidence and build incident timelines.
- Follow up physical security alarms with Facilities
5. Recover
- Support recovery and restoration tests and record the results.
- Track post-incident actions through to closure
6. Reporting and compliance
- Prepare the weekly security monitoring and metrics pack, and keep the cybersecurity KPI dashboard up to date for management reporting.
- Liaise with third-party security vendors on tickets, service requests and follow-ups.
- Gather and organise evidence for internal, external and regulatory audits, such as access reviews, patch reports and system logs.
- Apply approved updates to security tools and system configurations to meet regulatory and audit requirements, and track audit actions through to closure.
- Keep procedures up to date and take part in an on-call rota when needed
6. Business as usual and projects
- Carry out BAU security tasks reliably while supporting the project work assigned to you.
- Support security and IT projects, working with the Project Management Office, the IT Transformation Office, IT teams and application teams, for example with vulnerability scans, access set-up, onboarding systems into security tools and collecting evidence before go-live.
- Track the project security actions assigned to you through to completion, and update procedures and records when new systems move into BAU.
QUALIFICATIONS AND EXPERIENCE
- A degree in Information Systems, Cybersecurity or a related field
- At least 3 years' experience in IT security.
- Hands-on use of vulnerability scanning tools.
- Understanding of patch management and endpoint management tools and processes.
- Familiarity with SIEM, EDR and email security consoles for alert triage.
- Working experience with Microsoft security tools, such as Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview and Intune.
- Awareness of common attack types, such as ransomware and phishing, and of how incident response playbooks are applied.
- Working knowledge of Windows, Active Directory, Linux and networking fundamentals.
- Experience preparing clear and accurate security reports and metrics.
- Microsoft security certifications, such as Security, Compliance and Identity Fundamentals (SC-900), Security Operations Analyst (SC-200) or Identity and Access Administrator (SC-300).
- Well organised, with clear written and spoken communication in English and French.
The Company reserves the right:
- To convene only the best qualified candidates to participate in the selection exercise.
- Not to make any appointment following this advertisement
Skills Required
- Degree in Information Systems, Cybersecurity, or a related field
- At least 3 years of experience in IT security
- Hands-on experience with vulnerability scanning tools
- Understanding of patch management and endpoint management tools and processes
- Familiarity with SIEM, EDR, and email security consoles for alert triage
- Working experience with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Intune
- Awareness of ransomware, phishing, and incident response playbooks
- Working knowledge of Windows, Active Directory, Linux, and networking fundamentals
- Experience preparing clear and accurate security reports and metrics
- Microsoft security certifications such as SC-900, SC-200, or SC-300
- Clear written and spoken communication in English and French
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
SWAN provides the full range of non-banking financial solutions, from Insurance, Pension & Actuarial services, to Wealth Management & Securities Trading.
