Cyber Defence Officer

About the role

Julius Baer's CRO division manages the global framework for risk identification, control, reporting and management across its businesses. The Cyber Defence Officer supports the global Cyber Fusion Center in running security operations, threat intelligence and detection engineering, working closely with IT, Corporate Services and the Head of Cyber Fusion Center Asia so that cyber risks are identified, mitigated and remediated.

Key responsibilities

• Security operations (L1/L2): run 24/7 monitoring, triage and analysis of security events via on-call and on-duty rosters, and handle incident response from detection through containment, eradication and recovery
• Follow up on security incidents, maintain documentation and case management throughout the incident lifecycle
• Cyber threat intelligence: identify critical vulnerabilities, hunt for indicators of compromise and TTPs, gather intelligence from internal and external sources, and simulate attacks to test security controls
• Support cyber investigations, forensic and analysis tools, automated attack simulation testing, and the development of detections
• Support project delivery and help internal and external audits by coordinating reviews, collecting evidence and tracking remediation
• Work with global, regional and local stakeholders and share risk insights and control requirements with senior management

Required profile

• Bachelor's degree in Information Security, Computer Science, Computer Engineering or a related discipline
• Proven L1/L2 security operations, threat analysis and incident response experience in banking or financial services, preferably wealth management
• Strong interpersonal, communication and presentation skills; able to work independently and under pressure
• Analytical and quantitative modelling skills, strong organisation and prioritisation, and willingness to take responsibility

Required skills

• Hands-on experience with SIEM and SOAR platforms, GUI development and dashboarding
• Programming and scripting (e.g. Python) for automating security workflows
• Knowledge of MITRE ATT&CK is advantageous; professional information security certification (e.g. CISSP, CISM) is advantageous