Cyber Operations Manager

The department

The IT department has approximately 60 staff globally, located in London, Paris, Piraeus, Dubai, Hong Kong, Houston, Sao Paulo, Melbourne, Perth, Singapore, and Sydney.

HFW’s Information Technology team’s vision is to deliver a responsive and continuously evolving technology platform, underpinned by a secure, global infrastructure with data and process at its core.

The role

The Cyber Operations Manager is responsible for the operational delivery of HFW’s cyber security function, ensuring that security monitoring, detection, response, engineering and operational security controls effectively protect the Firm from cyber threats.

The role leads day-to-day cyber security operations, develops and maintains security technologies, manages cyber incidents and drives continuous improvement of the Firm’s security monitoring and response capabilities, and ensure that change programmes incorporate security requirements and deliver security by design.

The Cyber Operations Manager provides technical leadership across security operations and works closely with Infrastructure, Business Systems, Service Delivery, Risk & Compliance and third-party security providers to ensure threats are identified, investigated and managed effectively.

The role holder will deliver:

• Effective monitoring, detection and response to cyber threats and incidents.
• Managed and continuously improved technical security controls to maintain security in an evolving threat landscape.
• Reduced exposure to cyber risk through timely remediation of vulnerabilities and security weaknesses.
• Rapid and coordinated response to security incidents.
• Continuous improvements in detection coverage and operational security maturity, using emerging technology such as AI.
• Effective management of outsourced security services and technical partners.
• Appropriate operational security reporting and metrics for management.

The role will be expected to operate at the Skills Framework for the Information Age (SFIA) Information Security discipline, level 5, which includes:

• Provides advice and guidance on security strategies to manage identified risks and ensure adoption and adherence to standards.
• Contributes to development of information security policy, standards and guidelines.
• Obtains and acts on vulnerability information and conducts security risk assessments, business impact analysis and accreditation on complex information systems.
• Investigates major breaches of security and recommends appropriate control improvements.

Key responsibilities

Security Operations

• Manage the day-to-day operation of the Firm’s cyber security capability.
• Lead the Cyber Security team, including coaching, mentoring and performance management.
• Oversee threat monitoring, detection, investigation and response activities.
• Ensure security alerts are appropriately triaged, investigated and resolved.
• Continuously improve security monitoring, detection coverage and investigation processes.
• Develop operational security runbooks and standard operating procedures.
• Maintain security operations metrics, reporting and service performance measures.

Security Engineering

• Own and maintain cyber security technologies, ensuring they remain effective, supported and appropriately configured.
• Develop, tune and optimise security controls across the Firm’s technology estate.
• Lead implementation of new security technologies and enhancements.
• Review security architecture and technical designs to ensure alignment with security standards.
• Provide technical leadership on security improvements and transformation initiatives.
• Act as the escalation point for complex technical cyber security issues.
• Security Monitoring & Detection Engineering
• Develop and maintain SIEM use cases and detection rules.
• Improve detection content based on emerging threats, incident learnings and threat intelligence.
• Establish a structured detection engineering lifecycle.
• Validate and tune security detections to minimise false positives and improve effectiveness.
• Conduct threat modelling to ensure security technology coverage and identify any gaps.
• Develop and maintain operational playbooks and automated response workflows where appropriate.

Vulnerability Management

• Manage the Firm’s vulnerability management programme.
• Review vulnerability assessment results and prioritise remediation activities, working with infrastructure, systems and other teams to ensure vulnerabilities are resolved within agreed timeframes.
• Report on vulnerability trends, remediation effectiveness and risk exposure.

Incident Response

• Lead cyber security incident management and response activities.
• Coordinate technical investigations and containment activities.
• Act as operational lead during significant security incidents.
• Work closely with the Head of Cyber Security, IT teams and managed security service providers during major incidents.
• Coordinate forensic investigations where required.
• Conduct post-incident reviews and ensure lessons learned are implemented.
• Maintain and test incident response playbooks and procedures.

Threat Intelligence & Threat Hunting

• Consume and assess threat intelligence relevant to the legal sector.
• Develop proactive threat hunting activities.
• Identify emerging threats and evaluate their potential impact on the Firm.
• Translate threat intelligence into detection and defensive improvements.
• Support executive reporting on significant cyber threats and adversary activity.

Security Controls

• Maintain the effectiveness of key security controls including:
• SIEM
• Email security
• DLP
• SASE / SWG / CASB
• Endpoint security
• Identity security
• Vulnerability management platforms
• Monitor security control health and performance and identify opportunities for improvement.

Security Projects

• Act as technical cyber security lead on operational security projects.
• Support firm change programmes, providing projects with security expertise.
• Review technical designs and advise on security requirements.
• Ensure security is appropriately embedded within technology change initiatives to ensure the security by design.

Third-Party Security Services

• Manage relationships with managed security service providers and security partners.
• Hold suppliers accountable for agreed service levels.
• Review supplier performance and service reports.
• Escalate service concerns and coordinate remediation activities.

Security Awareness Training

• Support cyber security awareness initiatives.
• Provide technical input into phishing simulations and user awareness campaigns.
• Contribute to cyber security communications and training programmes.

Key skills and experience required

Essential Experience

• At least 5 years’ relevant cyber security experience within a regulated sector, such as professional services, legal or financial sectors
• Experience leading or managing cyber security operations teams, operating and improving technical security controls, developing response playbooks and managing cyber incidents
• Experience managing outsourced security services and security suppliers.
• Experience supporting cloud security operations.

Strong Technical Knowledge

• Microsoft Azure, Entra ID, and security technologies
• SIEM technologies and monitoring platforms
• Email security platforms
• Identity and access management,
• Vulnerability management tools
• Endpoint security technologies, for example EDR
• SASE technologies
• Network security technologies, firewalls, IDS/IPS
• Managing Security Operations Centre (SOC) operations handling
• Detection Engineering, Incident Response
• Threat Modelling, Hunting and Threat Intelligence
• Vulnerability Management
• MITRE ATT&CK Framework
• Security Monitoring

Leadership Skills

• Strong people management and leadership capabilities.
• Ability to coach and develop cyber security professionals.
• Ability to communicate technical cyber risks to non-technical stakeholders.
• Strong analytical and problem-solving skills.
• Ability to remain effective during major incidents and high-pressure situations.
• Strong stakeholder management and influencing skills.

Desirable Experience

• Experience within a global law firm.
• Experience building or transforming security operations functions.
• Experience with managed SOC services.
• Experience with security orchestration and automation technologies.
• Experience with adversary simulation exercises and purple teaming.
• Experience using threat intelligence to improve detection and response.

Qualifications

• Relevant professional qualification or equivalent demonstrable experience, such as CISSP, CISM and GIAC certifications

Additional information

Kindly note, this job description is not contractual. It will be reviewed periodically and may be amended or altered to meet the needs of the firm.

HFW aims to ensure equality of opportunity, and we are actively working towards improving the diversity of our staff. All applications will be considered only on merit and the applicant’s suitability to meet the requirements of the role.

HFW collects and processes personal data relating to job applicants to manage its recruitment process. The firm is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations. For information on how the firm will process your data, please see our Privacy Notice, in the section “What we collect and how we use it”.