·       Incident response – identify and respond to security incidents, including containment and investigation.

·       Maintaining and enhancing existing and new toolsets (like XDR) required for mature active defence.

·       Investigating new approaches, technology, and automation to challenge traditional thinking and raise the level of security.

·       Enabling mature active defence processes through continual validation and verification of infrastructure, platform, applications, and data asset controls.

·       Enhancing defence continuously – work with the team to update defence capabilities in line with threats, vulnerabilities and exploits identified during red teaming and threat hunting. Automating trumping manual.

·       Managing threat intelligence – contribute towards building and running threat intelligence capabilities.

·       Hunting for the needle in the needle stack - proactively search for and identify advanced threats that evade existing security solutions and feed this learning into blue team defence capability.

·       Blue team reporting and metrics – assist with building and maturing blue team reporting mechanisms such as dashboards and key cyber metrics. 

·       Establish relationships with key stakeholders for effective cross-team collaboration and implementation of security operations processes.

·       Supporting the broader Cyber Security Team – collaboration to drive and support various operational and strategic initiatives.

·       Champion or co-champion internal security solutions and/or processes.

·       Help define and set security standards.

·       Provide context and guidance to implement security improvements.