The Role
Leads cyber defence operations across asset and vulnerability management, security controls, SIEM and EDR monitoring, incident response, recovery testing, audits, reporting, and security projects. Configures Microsoft security technologies, investigates escalated alerts, develops playbooks, supports regulatory compliance, maintains security architecture, and ensures secure project delivery. The role also coaches junior officers and participates in an on-call rota.
Summary Generated by Built In
KEY RESPONSIBILITIES
1. Identify
- Maintain an accurate inventory of assets, identities, privileged and service accounts.
- Analyse vulnerabilities and security exposures, rate them by risk and recommend how to treat them.
- Work closely with Risk and Compliance on risk assessments and control testing, and with third-party vendors on remediation.
2. Protect
- Configure, maintain and improve security controls across identity and access, privileged access, multi-factor authentication, endpoints, firewalls, email, cloud and data.
- Maintain security baselines and hardening standards, and check systems against them.
- Draw and update the security architecture and technology diagrams, such as network security zones, security tool integrations, identity flows and data flows, whenever systems or controls change, for review and approval by the Cyber Defence Lead.
- Review new systems and projects for security and support them through to secure go-live.
- Implement and tune data protection controls, such as data classification, data loss prevention and encryption, to safeguard customer and personal data.
3. Detect
- Review and tune detection rules and alerts in the SIEM and EDR/XDR platforms with our managed security partner, reducing false positives.
- Review threat intelligence and security advisories, and take or recommend preventive actions.
- Onboard new systems and log sources into monitoring, and review the quality of the managed monitoring service.
4. Respond
- Investigate escalated security alerts, determine their scope and carry out containment actions.
- Support the Cyber Defence Lead in the technical response to incidents, working with incident response partners.
- Apply incident response playbooks for different types of breach, such as ransomware, business email compromise, data exfiltration and account compromise, and help develop and test them.
- Support the assessment of personal data breaches with the Data Protection Officer.
- Guide the Cyber Defence Officers during investigations and review the cases they escalate.
5. Recover
- Plan and carry out recovery and restoration tests with the platform teams.
- Carry out post-incident reviews and root cause analysis, and implement the lessons learned.
6. Reporting, compliance and improvement
- Identify opportunities to automate routine security tasks.
- Maintain technical documentation, procedures and playbooks.
- Prepare accurate and timely security reports, such as incident, vulnerability and control status reports, and contribute security metrics to the KPI dashboards used for management reporting.
- Implement changes and updates to security tools, configurations and systems to meet new regulatory requirements and audit recommendations.
- Provide technical evidence for internal, external and regulatory audits, and remediate audit findings within agreed timelines.
- Share knowledge, coach colleagues and take part in an on-call rota when needed.
7. Business as usual and project
- Carry out BAU security operations alongside project work, prioritising work in line with agreed team priorities.
- Act as the security point of contact on assigned security and IT projects, working closely with the Project Management Office, the IT Transformation Office, IT teams and application teams.
- Define security requirements, review designs and configurations, support security testing and make sure findings are fixed before go-live.
- Implement and configure the security controls delivered through projects, and hand them over into BAU with documentation and monitoring in place.
QUALIFICATIONS AND EXPERIENCE
Essential
- A degree in Information Systems, Cybersecurity or a related field, or equivalent work experience.
- At least 4-5 years' experience in IT security, including security operations, SOC or incident response work.
- Hands-on experience configuring enterprise security controls, such as identity and privileged access management, conditional access and MFA, EDR/XDR, firewalls and email security.
- Experience with a SIEM, including running search queries and reviewing alerts.
- Hands-on experience with the Microsoft security stack, including Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview and Intune.
- Good understanding of attacker techniques (MITRE ATT&CK) and of NIST CSF and ISO 27001 controls.
- Experience supporting audits and implementing control changes to meet regulatory or audit requirements.
- Experience maintaining security architecture and network diagrams.
- Experience supporting IT or security projects from design through to go-live, alongside BAU security work.
- Experience preparing clear, accurate and timely security reports and metrics for management.
- Sound understanding of incident response, including ransomware containment and playbooks for common breach types.
- Understanding of data protection principles and controls, and of the Mauritius Data Protection Act 2017.
- Working knowledge of Windows, Active Directory, networking and cloud platforms.
- Microsoft security certifications, such as Security Operations Analyst (SC-200), Identity and Access Administrator (SC-300), Information Security Administrator (SC-401) or Azure Security Engineer (AZ-500).
- Clear written and spoken communication in English and French.
The Company reserves the right:
- To convene only the best qualified candidates to participate in the selection exercise.
- Not to make any appointment following this advertisement
Skills Required
- Degree in Information Systems, Cybersecurity, or a related field, or equivalent work experience
- At least 4–5 years of IT security experience, including security operations, SOC, or incident response
- Hands-on experience configuring enterprise security controls, including identity and privileged access management, conditional access, MFA, EDR/XDR, firewalls, and email security
- Experience using a SIEM, including search queries and alert review
- Hands-on experience with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, and Intune
- Understanding of attacker techniques, MITRE ATT&CK, NIST CSF, and ISO 27001 controls
- Experience supporting audits and implementing regulatory or audit-related control changes
- Experience maintaining security architecture and network diagrams
- Experience supporting IT or security projects from design through go-live alongside BAU security work
- Experience preparing security reports and management metrics
- Understanding of incident response, ransomware containment, and breach playbooks
- Understanding of data protection principles and the Mauritius Data Protection Act 2017
- Working knowledge of Windows, Active Directory, networking, and cloud platforms
- Microsoft security certifications such as SC-200, SC-300, SC-401, or AZ-500
- Clear written and spoken communication in English and French
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
SWAN provides the full range of non-banking financial solutions, from Insurance, Pension & Actuarial services, to Wealth Management & Securities Trading.
