Cyber Security Lead

As the Cyber Security Lead at IBCA, you will play a vital role in upholding our commitment to the infected, affected, and deceased blood community. We are an organisation built on the principles of integrity, compassion, and transparency, and your work is the foundation that keeps our services secure and reliable. You are not just protecting a network; you are safeguarding the privacy and trust of individuals who have waited decades for recognition and support.

In this position, you will move beyond traditional oversight to foster a culture of security by design that prioritises the needs of the community. You will collaborate across teams to ensure that our digital systems, ranging from claims processing to support services, are resilient and accessible. By balancing technical excellence with a deep sense of empathy, you will help us deliver a service that is both modern and profoundly human, ensuring that every interaction remains safe, dignified, and stable.

Your expertise will guide the selection of security tooling and the implementation of secure engineering principles, ensuring that "security by design" is embedded within every technical design. You will oversee compliance with relevant standards and frameworks while directing overall cyber management and incident readiness.

Beyond the technical, you will lead stakeholder management, translating complex risks into clear, concise guidance for leadership. The ideal candidate will have strong knowledge and experience in the security domains of Security Operations, Security Architecture, and Governance, Risk, and Compliance.

Responsibilities

• Technical Design & Secure Engineering: Act as the primary security design authority for the compensation services architecture. Collaborate with Solution Architects and Developers to implement Secure by Design principles at the code and infrastructure level, ensuring robust identity management (e.g., MFA, RBAC), data encryption at rest and in transit, and secure API integrations across the digital service;

Essential Criteria

• Solid understanding of secure development frameworks (such as the OWASP Top 10 or SANS Top 25) and the ability to apply them within a cloud-native environment. You should have experience reviewing system architectures and code to ensure the implementation of technical controls like Zero Trust principles, robust API security, and secure identity/access management (IAM).
• Practical experience in implementing and managing automated security tools within a CI/CD pipeline. This includes the ability to interpret and act upon results from SAST/DAST (Static/Dynamic Analysis) tools, container scanning, and infrastructure-as-code (IaC) security assessments to ensure vulnerabilities are caught and remediated before they reach production.

Additional information:

A minimum 60% of your working time should be spent at your principal workplace. Although requirements to attend other locations for official business will also count towards this level of attendance.