Regional CERT Manager

Regional CERT Manager

Location: Sunlight House, Kingston - Full time

Hybrid Working: 3 days per week in the office 

About Unilever

Unilever is one of the world’s leading suppliers of Home and Personal Care products with sales in over 190 countries and reaching 2 billion consumers a day. Unilever has more than 400 brands found in homes around the world, including Dove, Tresemme, Lynx, Persil, Domestos and Vaseline.

Faced with the challenge of climate change and the need for human development, we want to move towards a world where everyone can live well and within the natural limits of the planet. That’s why our purpose is ‘to make sustainable living commonplace’  

Role Overview

The Regional CERT Manager is responsible for leading cyber incident response operations across the region, ensuring effective detection, containment, investigation, remediation, and recovery from security incidents. This role combines strategic leadership with hands-on technical expertise to drive operational excellence, strengthen security capabilities, and enhance organisational cyber resilience.

Key Responsibilities

• Lead regional Cyber Emergency Response Team (CERT) operations, providing both strategic direction and technical guidance for complex cyber security incidents.
• Own and continuously improve the end-to-end Incident Management lifecycle, ensuring alignment with industry best practices and organisational security objectives.
• Monitor, analyse, and report on key performance indicators (KPIs), metrics, and incident trends to drive continual service improvement and operational effectiveness.
• Direct incident response activities including triage, containment, investigation, remediation, recovery, and stakeholder communications.
• Coordinate major incident investigations with internal teams, external forensic specialists, law enforcement, and third-party partners where required.
• Partner with Security Operations Centre (SOC) teams to enhance detection, monitoring, automation, and response capabilities through effective use of SIEM, EDR/XDR, and SOAR technologies.
• Contribute to security operations projects, ensuring seamless integration of new technologies, processes, and use cases into the incident response framework.
• Manage relationships with key stakeholders, vendors, and managed security service providers, establishing clear governance, accountability, and RACI models.
• Provide leadership, coaching, and professional development to incident response personnel, fostering a high-performing and collaborative team culture.
• Communicate complex cyber security risks, incidents, and remediation strategies effectively to technical and non-technical stakeholders, including senior leadership.

Essential Skills

• Minimum 8 years' experience within enterprise Security Operations Centre (SOC), Incident Response, or Cyber Defence environments, including at least 3 years in a people leadership role.
• Experience managing and reporting through strong regulation systems like NIS2
• Strong hands-on expertise with SIEM, EDR/XDR, SOAR, threat detection, monitoring, and incident response technologies.
• Practical experience in malware analysis, digital forensics, threat hunting, and network security investigations.
• Proven ability to lead and coordinate major cyber incident response activities within complex global organisations.
• Strong understanding of cyber security operations, threat intelligence, attack methodologies, and adversary techniques.
• Excellent stakeholder management, communication, and influencing skills.
• High levels of integrity, professionalism, and accountability.

Desirable Skills

• Experience partnering with Legal, Compliance, Privacy, Risk, and Business Continuity teams during significant cyber incidents.
• Working knowledge of scripting and automation tools such as Python, PowerShell, or Perl.
• Knowledge of recognised incident response frameworks and methodologies, including NIST 800-61, ISO 27035, and MITRE ATT&CK.
• Relevant GIAC certifications such as GCFE, GCFA, GREM, GNFA, GCIA, or GMON.
• Cloud security certifications and experience across Azure, AWS, and/or Google Cloud Platform (GCP).
• Experience driving security automation and orchestration initiatives to improve incident response efficiency.

What we offer

Whilst the role is advertised on a full-time basis, we would be happy to discuss possible flexible working options and what this may look like for you. We strive to achieve a family-friendly and inclusive workplace and to, above all, create possibilities for all. 

Diversity at Unilever is about inclusion, embracing differences, creating possibilities and growing together for better business performance. We embrace diversity in our workforce. This means giving full and fair consideration to all applicants and continuing development of all employees regardless of age, disability, gender reassignment, race, religion or belief, sex, sexual orientation, marriage and civil partnership, and pregnancy and maternity. We are also more than happy to provide reasonable adjustments during our application and interview process to enable you to be present your best self.

#LI-Onsite