Cyber Security Defense Lead

We are seeking an experienced Cyber Defence Lead to establish and lead Nawy's cyber defence capabilities. This role is responsible for monitoring, detecting, investigating, and responding to cybersecurity threats while continuously improving the organization's detection and response capabilities.

The Cyber Defence Lead will oversee Security Operations, Incident Response, Threat Detection, Threat Hunting, and Security Monitoring activities across cloud and on-premises environments. The role will work closely with Security Engineering, Infrastructure, Product Engineering, and GRC teams to strengthen the organization's ability to prevent, detect, and respond to cyber threats.

• Lead the organization's Security Operations and Cyber Defence functions.
• Develop and maintain security monitoring and incident response processes, procedures, and playbooks.
• Manage and continuously improve SIEM, EDR, and security monitoring capabilities.
• Lead the investigation, containment, eradication, and recovery activities for security incidents.
• Develop and maintain threat detection use cases and detection engineering practices.
• Establish threat intelligence and threat hunting capabilities to proactively identify emerging threats.
• Coordinate security incident communications and reporting to relevant stakeholders.
• Ensure continuous monitoring of cloud, endpoint, network, and application security events.
• Conduct post-incident reviews and drive improvements to security controls and operational processes.
• Collaborate with Security Engineering to enhance security visibility and detection coverage.
• Define and track cyber defence metrics, including MTTD, MTTR, detection coverage, and incident trends.
• Manage relationships with external MSSPs, incident response partners, and threat intelligence providers when required.
• Support regulatory reporting requirements related to cybersecurity incidents.

Requirements

• At least 6 years of experience in Security Operations, Incident Response, Threat Hunting, or Cyber Defence roles.
• Strong experience working with SIEM, EDR, SOAR, threat intelligence, and security monitoring platforms.
• Experience leading security incident investigations and coordinating response efforts.
• Strong understanding of attack techniques, threat actor behaviors, and the MITRE ATT&CK framework.
• Experience working with cloud security monitoring across AWS and Google Cloud Platform (GCP).
• Familiarity with digital forensics, malware analysis concepts, and incident response methodologies.
• Knowledge of security frameworks and standards including ISO 27001 and NIST Cybersecurity Framework.
• Relevant certifications such as CISSP, GCIA, GCIH, GCFA, GMON, SC-200, or equivalent are preferred.
• Familiarity with cybersecurity, risk, and data protection regulations in Egypt, including FRA requirements, and relevant DIFC regulatory frameworks.
• University/college degree in a relevant professional field.
• Excellent communication skills in English, both written and spoken.