Background

CRDB Bank PLC – Benki ya CRDB is hiring for the position of Senior Manager Cyber Defence in Tanzania Head Office.

Job Purpose

Responsible for providing strategic, operational, and technical leadership over the Bank’s cybersecurity monitoring, threat detection, threat intelligence, proactive threat hunting, cyber incident response, and digital-forensics capabilities.

The scope covers Banks’ customers, subsidiaries, business services, information assets, critical financial systems, digital channels, infrastructure, cloud environments, and third-party connections for identification, investigation, containment, eradication, and reporting of related threats and incidents in a timely and effective manner.

The position provides overall leadership to the Security Operations Center and ensures continuous monitoring of security events, effective alert triage, in-depth incident investigation, timely escalation, accurate case documentation, and continuous improvement of detection rules and response playbooks.

The role directs intelligence-led threat hunting across the Bank’s technology environment and ensures that relevant threat intelligence is collected, analyzed, contextualized, and converted into actionable detection rules, hunting hypotheses, security advisories, indicators of compromise, and response measures.

The role also oversees digital-forensics and incident-response readiness, including the investigation of major cyber incidents, preservation and analysis of digital evidence, root-cause determination, coordination of containment and recovery actions, and completion of post-incident reviews.

Principal Responsibilities

• Develop and execute the Bank’s Cyber Defence strategy, operating model, roadmap, and annual operational plan, translating cyber risks, critical business services, emerging threats, incidents, technology changes, and regulatory requirements into clear priorities.
• Provide leadership and direction to the SOC, Cyber Threat Hunting & Intelligence, and Digital Forensics & Incident Response functions, ensuring effective coordination and operational readiness.
• Ensure comprehensive Cyber Defence coverage across the Bank’s networks, endpoints, identities, applications, databases, digital channels, critical financial systems, cloud environments, third-party connections, and regional operations.
• Provide timely advice, reports, and presentations to the Head of Cybersecurity and senior management on material threats, incidents, attacker behaviour, detection capability, response readiness, and required improvement actions.
• Manage the Cyber Defence budget, staffing, technology, specialist services, licenses, training, and operational expenditure, while maintaining a prioritized improvement roadmap addressing identified capability, process, technology, resource, and skills gaps.
• Provide overall leadership and oversight of the Bank’s Security Operations Centre (SOC), ensuring continuous security monitoring, threat detection, investigation, and escalation aligned with the Bank’s risk profile, critical services, emerging threats, technology changes, and lessons from previous incidents.
• Establish effective SOC governance, performance standards, and escalation mechanisms, ensuring gaps in security visibility, monitoring, and detection capabilities are promptly identified, prioritized, and addressed.
• Drive continuous improvement of threat detection and response capabilities through incident lessons, threat intelligence, threat hunting, security testing, and evolving threats, while ensuring SOC platforms remain resilient, integrated, supported, and fit for purpose.
• Provide strategic direction for the Bank’s Cyber Threat Intelligence and proactive Threat Hunting programmes, ensuring activities focus on credible threats relevant to the banking sector, the Bank’s technology environment, and countries of operation.
• Ensure threat intelligence delivers timely and actionable insights on emerging threats, attack campaigns, and threat actors, with findings translated into improvements in monitoring, detection, incident readiness, security controls, and cyber risk management.
• Promote effective threat intelligence sharing and collaboration across internal stakeholders, subsidiaries, trusted industry partners, and relevant external cybersecurity bodies.
• Provide leadership and oversight of the Bank’s Digital Forensics capability, ensuring significant cyber incidents are effectively investigated and supported by reliable digital evidence in line with legal, regulatory, and chain-of-custody requirements.
• Maintain strategic oversight of cyber incident management and response, ensuring incident response plans, escalation arrangements, decision authorities, and procedures remain current and effective.
• Ensure significant cyber incidents are assessed, managed, and escalated based on their operational, financial, customer, regulatory, and reputational impact, while maintaining readiness for material incidents affecting critical financial services and technology infrastructure.
• Ensure significant incidents undergo appropriate root-cause analysis and post-incident reviews to identify control weaknesses, systemic issues, and lessons learned.
• Ensure corrective actions arising from forensic investigations and major incidents are assigned, tracked, and escalated, with lessons learned incorporated into Cyber Defence capabilities and broader security improvements across the Bank.
• Provide leadership, coaching, and development for the Cyber Defence leadership and specialist teams, establishing clear accountability, performance expectations, capability development, and succession priorities.
• Establish and monitor Cyber Defence KPIs, KRIs, and service-performance measures, providing management with clear visibility of threat detection, incident response, threat intelligence, readiness, and operational effectiveness.
• Monitor Cyber Defence performance, material risks, capability gaps, and improvement initiatives, ensuring significant issues are appropriately escalated to the Head of Cybersecurity and relevant governance forums.
• Strengthen collaboration across Cyber Defence, Cybersecurity Engineering, Offensive Security, GRC, Cybersecurity Architecture & DevSecOps, ICT, Risk, Audit, Fraud, Legal, Compliance, and subsidiaries, ensuring effective coordination and escalation of material cyber threats and incidents.

Qualifications Required

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Digital Forensics, Computer Engineering, Telecommunications Engineering, Information Systems, or a related academic field.
• Minimum of seven years’ relevant experience in cybersecurity operations, security monitoring, cyber incident response, digital forensics, cyber threat intelligence, or threat hunting.
• Knowledge of relevant cybersecurity frameworks and standards, including NIST Cybersecurity Framework, ISO/IEC 27001, CIS Controls, PCI DSS, and MITRE ATT&CK.
• At least three years’ experience in a managerial, supervisory, team-lead, or senior technical-leadership role within a Security Operations Center, Incident Response, Digital Forensics, Threat Intelligence, or Cyber Defence functions
• Relevant professional certifications such as CISSP, CEH, OSCP, CCISO, CISA or CSA.
• Comprehensive knowledge of SOC operating models, analyst processes, monitoring procedures, and escalation arrangements.
• Extensive knowledge of cybersecurity incident management, incident response, containment, eradication, recovery, and post-incident review.
• Strong knowledge of digital-forensics methodologies, evidence acquisition, evidence preservation, chain of custody, forensic analysis, malware analysis, and investigation reporting.
• Comprehensive knowledge of cyber threat-intelligence lifecycle management, including intelligence requirements, collection, validation, analysis, dissemination, and feedback.
• Extensive knowledge of proactive threat hunting, adversary behaviors, attack techniques, indicators of compromise, and hypothesis-driven investigations.
• Strong knowledge of security monitoring, logs management, detection engineering, correlation-rule development, behavioral analytics, alert enrichment, rule tuning, and security automation.
• Strong understanding of SIEM, SOAR, EDR/XDR, NDR, threat-intelligence, digital-forensics, malware-analysis, and case-management technologies.
• Strong knowledge of attacker tactics, techniques, and procedures and their application within the MITRE ATT&CK framework.
• Knowledge of banking operations, payment services, Core Banking Systems, digital channels, card environments, mobile banking, internet banking, APIs, and financial-sector cyber threats.
• Understanding of cyber risk management, regulatory compliance, business continuity, disaster recovery, crisis management, audit, and evidence-management requirements.
• Knowledge of cloud security monitoring, identity-related threats, digital-channel threats, third-party compromise, and modern attack methods.

Additional Notes

CRDB Bank is dedicated to upholding Sustainability and ESG practices and encourage applicants who share this commitment. The Bank also promotes an inclusive workplace, hence applications from women and individual with disabilities are encouraged.

It is important to note that CRDB Bank does not charge any fees for the application or recruitment process, and any requests for payment should be disregarded as they do not represent the bank’s practices.

Only Shortlisted Candidates will be Contacted.

• Develop and execute the Bank’s Cyber Defence strategy, operating model, roadmap, and annual operational plan, translating cyber risks, critical business services, emerging threats, incidents, technology changes, and regulatory requirements into clear priorities.
• Provide leadership and direction to the SOC, Cyber Threat Hunting & Intelligence, and Digital Forensics & Incident Response functions, ensuring effective coordination and operational readiness.
• Ensure comprehensive Cyber Defence coverage across the Bank’s networks, endpoints, identities, applications, databases, digital channels, critical financial systems, cloud environments, third-party connections, and regional operations.
• Provide timely advice, reports, and presentations to the Head of Cybersecurity and senior management on material threats, incidents, attacker behaviour, detection capability, response readiness, and required improvement actions.
• Manage the Cyber Defence budget, staffing, technology, specialist services, licenses, training, and operational expenditure, while maintaining a prioritized improvement roadmap addressing identified capability, process, technology, resource, and skills gaps.
• Provide overall leadership and oversight of the Bank’s Security Operations Centre (SOC), ensuring continuous security monitoring, threat detection, investigation, and escalation aligned with the Bank’s risk profile, critical services, emerging threats, technology changes, and lessons from previous incidents.
• Establish effective SOC governance, performance standards, and escalation mechanisms, ensuring gaps in security visibility, monitoring, and detection capabilities are promptly identified, prioritized, and addressed.
• Drive continuous improvement of threat detection and response capabilities through incident lessons, threat intelligence, threat hunting, security testing, and evolving threats, while ensuring SOC platforms remain resilient, integrated, supported, and fit for purpose.
• Provide strategic direction for the Bank’s Cyber Threat Intelligence and proactive Threat Hunting programmes, ensuring activities focus on credible threats relevant to the banking sector, the Bank’s technology environment, and countries of operation.
• Ensure threat intelligence delivers timely and actionable insights on emerging threats, attack campaigns, and threat actors, with findings translated into improvements in monitoring, detection, incident readiness, security controls, and cyber risk management.
• Promote effective threat intelligence sharing and collaboration across internal stakeholders, subsidiaries, trusted industry partners, and relevant external cybersecurity bodies.
• Provide leadership and oversight of the Bank’s Digital Forensics capability, ensuring significant cyber incidents are effectively investigated and supported by reliable digital evidence in line with legal, regulatory, and chain-of-custody requirements.
• Maintain strategic oversight of cyber incident management and response, ensuring incident response plans, escalation arrangements, decision authorities, and procedures remain current and effective.
• Ensure significant cyber incidents are assessed, managed, and escalated based on their operational, financial, customer, regulatory, and reputational impact, while maintaining readiness for material incidents affecting critical financial services and technology infrastructure.
• Ensure significant incidents undergo appropriate root-cause analysis and post-incident reviews to identify control weaknesses, systemic issues, and lessons learned.
• Ensure corrective actions arising from forensic investigations and major incidents are assigned, tracked, and escalated, with lessons learned incorporated into Cyber Defence capabilities and broader security improvements across the Bank.
• Provide leadership, coaching, and development for the Cyber Defence leadership and specialist teams, establishing clear accountability, performance expectations, capability development, and succession priorities.
• Establish and monitor Cyber Defence KPIs, KRIs, and service-performance measures, providing management with clear visibility of threat detection, incident response, threat intelligence, readiness, and operational effectiveness.
• Monitor Cyber Defence performance, material risks, capability gaps, and improvement initiatives, ensuring significant issues are appropriately escalated to the Head of Cybersecurity and relevant governance forums.
• Strengthen collaboration across Cyber Defence, Cybersecurity Engineering, Offensive Security, GRC, Cybersecurity Architecture & DevSecOps, ICT, Risk, Audit, Fraud, Legal, Compliance, and subsidiaries, ensuring effective coordination and escalation of material cyber threats and incidents.

• NIST Cybersecurity Framework
• ISO/IEC 27001
• CIS Controls
• PCI DSS
• MITRE ATT&CK
• SIEM
• SOAR
• EDR/XDR
• NDR
• threat-intelligence
• digital-forensics
• malware-analysis
• case-management technologies
• banking operations
• payment services
• Core Banking Systems
• digital channels
• card environments
• mobile banking
• internet banking
• APIs
• financial-sector cyber threats
• cyber risk management
• regulatory compliance
• business continuity
• disaster recovery
• crisis management
• audit
• evidence-management requirements
• cloud security monitoring
• identity-related threats
• digital-channel threats
• third-party compromise
• modern attack methods

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Digital Forensics, Computer Engineering, Telecommunications Engineering, Information Systems, or a related academic field.
• Minimum of seven years’ relevant experience in cybersecurity operations, security monitoring, cyber incident response, digital forensics, cyber threat intelligence, or threat hunting.
• Knowledge of relevant cybersecurity frameworks and standards, including NIST Cybersecurity Framework, ISO/IEC 27001, CIS Controls, PCI DSS, and MITRE ATT&CK.
• At least three years’ experience in a managerial, supervisory, team-lead, or senior technical-leadership role within a Security Operations Center, Incident Response, Digital Forensics, Threat Intelligence, or Cyber Defence functions
• Relevant professional certifications such as CISSP, CEH, OSCP, CCISO, CISA or CSA.
• Comprehensive knowledge of SOC operating models, analyst processes, monitoring procedures, and escalation arrangements.
• Extensive knowledge of cybersecurity incident management, incident response, containment, eradication, recovery, and post-incident review.
• Strong knowledge of digital-forensics methodologies, evidence acquisition, evidence preservation, chain of custody, forensic analysis, malware analysis, and investigation reporting.
• Comprehensive knowledge of cyber threat-intelligence lifecycle management, including intelligence requirements, collection, validation, analysis, dissemination, and feedback.
• Extensive knowledge of proactive threat hunting, adversary behaviors, attack techniques, indicators of compromise, and hypothesis-driven investigations.
• Strong knowledge of security monitoring, logs management, detection engineering, correlation-rule development, behavioral analytics, alert enrichment, rule tuning, and security automation.
• Strong understanding of SIEM, SOAR, EDR/XDR, NDR, threat-intelligence, digital-forensics, malware-analysis, and case-management technologies.
• Strong knowledge of attacker tactics, techniques, and procedures and their application within the MITRE ATT&CK framework.
• Knowledge of banking operations, payment services, Core Banking Systems, digital channels, card environments, mobile banking, internet banking, APIs, and financial-sector cyber threats.
• Understanding of cyber risk management, regulatory compliance, business continuity, disaster recovery, crisis management, audit, and evidence-management requirements.
• Knowledge of cloud security monitoring, identity-related threats, digital-channel threats, third-party compromise, and modern attack methods.