Manager - CCDI (Centre for Cyber Defence & Intelligence)

fca; Greater London; Vor Ort; GBP 75.000 - 125.000; Vollzeit

Zusammenfassung

The FCA seeks a Manager to lead the Threat, Detection & Response function within the Centre for Cyber Defence and Intelligence (CCDI). This role will mature an intelligence-led cyber defence capability, translating threat intelligence into detection priorities, exposure insights and measurable improvements in incident response.

It links Threat Intelligence with Security Operations, Detection Engineering and Technology teams.

Qualifikationen

• Experience leading Cyber Security, Security Operations, Threat Intelligence or Detection Engineering teams.
• Solid knowledge of modern cyber threats, detection, threat intelligence and incident response.
• Effective stakeholder management and communication skills.

Aufgaben

• Lead and develop the FCA's Threat Intelligence, Detection and Incident Response capability, delivering an intelligence-led approach to cyber defence and risk reduction.
• Drive continuous improvement of detection coverage, telemetry, response effectiveness and security operations through data-led insights, automation and effective stakeholder engagement.
• Shape the security monitoring response to increased adoption of AI and agent-based technologies, ensuring telemetry, detection logic and response capabilities evolve with the tech environment.
• Own the detection improvement roadmap, working with SOC providers, technology teams and cyber security stakeholders to deliver measurable outcomes.
• Lead and develop internal teams and third-party partners, ensuring performance and service quality.
• Establish meaningful cyber security metrics, KPIs and executive reporting to measure performance and risk reduction.
• Build trusted relationships across FCA and external cyber security communities to improve threat awareness and priorities.
• Ensure alignment with frameworks such as MITRE ATT&CK, D3FEND, INFORM and NCSC standards.

Kenntnisse

Cyber Security Leadership

Threat Intelligence

Stakeholder Management

Jobbeschreibung

Job title

Manager - CCDI (Centre for Cyber Defence & Intelligence)

Division: Operations

Department: Cyber & Information Resilience (C&IR)

Salary: National (Edinburgh and Leeds) ranging from £74,900 to 115,000 and London from £82,300 to £125,000 (salary offered will be based on skills and experience)

This role is graded as: Manager, Regulatory

Your external recruitment contact is Raimonda Stankute via [e-mail]

Your internal recruitment contact is Lauren McHale via [e-mail]

About the FCA and team

We regulate financial services firms in the UK, to keep financial markets fair, thriving and effective. By joining us, you'll play a key part in protecting consumers, driving economic growth and shaping the future of UK finance services.

We are recruiting a Manager to lead the FCA's Threat, Detection & Response function, the Centre for Cyber Defence and Intelligence, part of Cyber & Information Resilience (C&IR) at the FCA. This is an exciting time to join the function as the FCA increases its adoption of AI and agent-based technologies. These developments create opportunities to modernise cyber defence, while also requiring a significant uplift in security monitoring, telemetry, detection engineering and response capabilities to manage new and evolving risks.

The FCA regulates over 35,000 financial services firms in the UK, setting standards for firms to meet and holding them to account if they do not. We enable a fair and thriving financial services market for the good of consumers and the UK economy. The CCDI Manager will operate and mature an intelligence-led cyber defence capability, translating current threat intelligence into monitoring priorities, detection improvements, exposure insight and measurable improvement in incident response. The role links Threat Intelligence, Security Operations, Detection Engineering, Cyber Assurance and Technology teams, including outsourced partners and maintains a data-driven view of detection effectiveness, response performance, service outcomes and coverage gaps.

Role responsibilities

• Lead and develop the FCA's Threat Intelligence, Detection and Incident Response capability, delivering an intelligence-led approach to cyber defence and risk reduction
• Drive continuous improvement of detection coverage, telemetry, response effectiveness and security operations through data-led insights, automation and effective stakeholder engagement.
• Shape the security monitoring response to increased adoption of AI and agent-based technologies, ensuring that telemetry, detection logic and response capabilities evolve alongside the FCA's technology environment.
• Own the detection improvement roadmap, working closely with SOC providers, technology teams and cyber security stakeholders to deliver measurable outcomes
• Lead and develop internal teams and third-party partners, ensuring effective performance, service quality and continuous professional growth.
• Establish meaningful cyber security metrics, KPIs and executive reporting to measure performance, resilience and risk reduction.
• Build trusted relationships across the FCA and external cyber security communities to improve threat awareness, influence priorities and share best practice
• Ensure alignment with industry frameworks and guidance, including NIST CSF, MITRE ATT&CK, MITRE D3FEND, INFORM and NCSC standards

Skills required

Minimum

• Experience leading Cyber Security, Security Operations, Threat Intelligence or Detection Engineering teams, including developing people and delivering results through others
• Solid knowledge of modern cyber threats, detection, threat intelligence and incident response, with experience managing cyber security partners and service providers
• Effective stakeholder management and communication skills, with the ability to translate complex technical risks, security metrics and data into clear executive insights and recommendations

Essential

• Experience in one or more of Threat Intelligence, Security Operations, Detection Engineering, SOC Performance Management or Exposure Management, with a practical understanding of threat-informed defence methodologies, security monitoring, incident response and frameworks such as MITRE ATT&CK for adversary behaviour, D3FEND for defensive countermeasures, and INFORM for measuring defensive maturity.
• Experience using security performance metrics, KPIs, KRIs, cyber maturity measures and operational reporting to support informed decision-making, continuous improvement and measurable cyber risk reduction
• Experience delivering improvements to detection coverage, signal quality, response effectiveness and cyber resilience, including the use of automation, SOAR, telemetry enrichme