Cyber Defence Manager

iSystems Ltd; Lahore; On-site; PKR 2,500,000 - 3,800,000; Full time

Job summary

iSystems Ltd in Lahore, Pakistan seeks an experienced Cyber Defence Manager to oversee vulnerability management, security findings, cyber incident coordination, and post-incident governance across a global enterprise environment. The role focuses on risk-based prioritisation, remediation tracking, and driving security actions to closure.

You will collaborate with Cyber Defence, Security Operations, Infrastructure, Application, Risk, and business teams to strengthen the organisation’s security

Qualifications

• Proven experience in vulnerability management and security operations within a large enterprise.
• Hands-on with vulnerability platforms such as Tenable or Qualys.
• Strong knowledge of risk-based vulnerability prioritisation.
• Experience with regulatory reporting and governance.

Responsibilities

• Own and consolidate security findings from vulnerability scans, penetration testing, red/purple team exercises, cloud security assessments, application security testing, and threat intelligence.
• Prioritise vulnerabilities using risk-based methodologies, including CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and CIF status.
• Coordinate remediation activities with infrastructure, patch management, application, and service owners, ensuring SLA compliance and reducing aged vulnerabilities.
• Monitor remediation progress, MTTR, security posture metrics, scan coverage, and SLA breaches; escalate to relevant stakeholders.
• Manage vulnerability exceptions and risk-acceptance workflows, ensuring ownership, compensating controls, approvals, and expiry dates.
• Prepare security posture reports, KRIs, and governance updates for committees and senior stakeholders.
• Coordinate cyber incidents from invocation to closure, including incident response meetings, stakeholder communications, documentation, and escalation.
• Lead post-incident reviews, root cause analysis, and lessons-learned sessions; track corrective actions to completion.
• Maintain central incident records, post-event trackers, and on-call/notification arrangements, including out-of-hours coverage.
• Support regulatory and compliance requirements, including DORA, Lloyd’s Principle 12, remediation Metric 7, and PRA engagements.
• Collaborate with security engineering, architecture, and tooling teams to improve vulnerability management processes, reporting automation, scan coverage, and data quality.
• Coordinate scanning attestations and pre-change governance requirements, ensuring systems are scanned before deployment.
• Provide direction to SecOps analysts and coordinate cross-functional remediation and incident management activities.

Skills

Vulnerability management

Security operations

Cyber defence

Stakeholder management

Regulatory compliance

Education

Bachelor's degree in Cyber Security / Information Systems

Certifications such as CISSP/GIAC/ITIL

Tools

Tenable

Qualys

Microsoft Defender for Cloud / Azure

SAST/DAST tools

ServiceNow

PagerDuty

Job description

We are looking for an experienced Cyber Defence Manager to oversee vulnerability management, security findings, cyber incident coordination, and post-incident governance across a global enterprise environment. The role will focus on risk-based prioritisation of security exposures, remediation tracking, incident coordination, regulatory compliance, and driving security actions to closure. The position will work closely with Cyber Defence, Security Operations, Infrastructure, Application, Risk, and business teams to strengthen the organisation’s overall security posture.

Responsibilities

• Own and consolidate security findings from vulnerability scans, penetration testing, red/purple team exercises, cloud security assessments, application security testing, and threat intelligence.
• Prioritise vulnerabilities using risk-based methodologies, including CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and Critically Important Function (CIF) status.
• Coordinate remediation activities with infrastructure, patch management, application, and service owners, ensuring SLA compliance and reducing aged vulnerabilities.
• Monitor remediation progress, MTTR, security posture metrics, scan coverage, and SLA breaches; escape critical exposures and remediation delays to relevant stakeholders.
• Manage vulnerability exceptions and risk-acceptance workflows, ensuring documented ownership, compensating controls, approvals, and expiry dates.
• Prepare security posture reports, Key Risk Indicators (KRIs), and governance updates for relevant committees and senior stakeholders.
• Coordinate cyber incidents from invocation to closure, including incident response meetings, stakeholder communications, incident documentation, and escalation.
• Lead post-incident reviews, root cause analysis, and lessons-learned sessions, ensuring corrective actions are tracked through to completion.
• Maintain central incident records, post-event trackers, and on-call and notification arrangements, including out-of-hours coverage.
• Support regulatory and compliance requirements, including DORA, Lloyd’s Principle 12, remediation Metric 7, and PRA engagements.
• Collaborate with security engineering, architecture, and tooling teams to improve vulnerability management processes, reporting automation, scan coverage, and data quality.
• Coordinate scanning attestations and pre-change governance requirements, ensuring systems are appropriately scanned before deployment.
• Provide direction to supporting SecOps analysts and coordinate cross-functional remediation and incident management activities.

Requirements

• Proven experience in vulnerability management, security operations, or cyber defence within a large, complex, preferably regulated enterprise environment.
• Hands-on experience with vulnerability management platforms such as Tenable, Qualys, Vulcan, or equivalent.
• Working knowledge of cloud security, particularly Microsoft Defender for Cloud/Azure, container security, and application security testing tools, including SAST, DAST, and SCA.
• Strong understanding of vulnerability risk assessment and prioritisation methodologies, including CVSS, EPSS, CISA KEV, threat intelligence, and asset criticality.
• Demonstrated experience managing remediation SLAs, reducing vulnerability backlogs, coordinating incident response, conducting root cause analysis, and tracking corrective actions.
• Knowledge of security governance, risk acceptance, exception management, KRIs, and regulatory reporting requirements, including DORA, Lloyd’s, and PRA.
• Experience with ServiceNow workflows, incident management platforms, and remediation tracking processes.
• Strong stakeholder management, communication, analytical, and organisational skills, with the ability to engage technical teams and senior management effectively.
• Preferred: Financial services or insurance experience, familiarity with red/purple teaming and threat-led penetration testing, on-call tools such as PagerDuty or xMatters, CMDB and asset management, automation, AI-assisted reporting, and relevant certifications such as CISSP, GIAC, or ITIL.