Incident Response Lead

CyberOne

22h•Remote

About The Position

The Cyber Incident Response Lead delivers CyberOne incident response engagements as part of a pool of CIR Leads. The role leads clients and technical teams through the investigation, containment and recovery of cybersecurity incidents, combining incident leadership, technical judgement and clear stakeholder communication to minimise business impact and support informed decisions under pressure. The role is accountable for the coordination, quality and communication of assigned engagements within agreed scope and delegated authority. The Head of Incident Response retains accountability for the overall service, including strategy, budgets, staffing, commercial commitments and service governance. Clients retain authority for business risk acceptance, operational changes, recovery approval and legal or regulatory decisions; the Lead provides information and recommendations to support those decisions.

Requirements

Demonstrable experience leading significant cybersecurity incidents, including coordinating technical response activities and managing client communications.
Ability to lead multidisciplinary teams under pressure, including teams whose responders do not report directly to the role.
Confidence communicating with executive and board-level stakeholders, including explaining uncertainty, operational risk and difficult response decisions.
Strong judgement and prioritisation, including making timely recommendations with incomplete information and escalating decisions appropriately.
Experience managing stakeholder expectations and maintaining constructive relationships during disruptive or sensitive incidents.
Excellent written communication and experience producing clear incident reports, executive summaries and actionable remediation recommendations.
Strong organisational discipline, including accurate record-keeping, managing competing priorities and effective handovers.
Professional discretion and sound judgement when handling sensitive client information and investigation evidence.
Practical experience responding to incidents such as ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration.
Strong understanding of incident response activities: preparation, detection, investigation, containment, eradication, recovery and continuous improvement.
Ability to assess and challenge technical findings, identify investigation gaps and direct further analysis to establish scope, attack progression and business impact.
Working knowledge of enterprise environments, including Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies.
Experience using SIEM, EDR and identity telemetry in investigations, including correlating activity across endpoints, accounts and cloud services.
Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications.
Ability to evaluate containment and recovery options, including operational consequences, dependencies and potential effects on evidence.
Understanding of evidence preservation, secure evidence handling and chain-of-custody principles, including recognising when specialist forensic support is required.
Ability to recognise telemetry, retention and licensing limitations and explain their effect on investigative confidence and conclusions.
Practical understanding of incident response guidance and threat frameworks, particularly NIST SP 800-61 and MITRE ATT&CK.

Nice To Haves

Experience delivering incident response in a consultancy, managed security service provider or other client-facing environment.
Experience with Microsoft Sentinel, Microsoft Defender XDR and KQL, and familiarity with other enterprise security platforms.
Experience delivering incident preparedness workshops, tabletop exercises and post-incident reviews.
Experience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams.
Awareness of data protection and regulatory considerations, including recognising when clients require legal or privacy advice.
Relevant qualifications such as GCIH, GCFA, CISSP or CISM; equivalent practical experience is equally valued.
ITIL 4 knowledge or certification, particularly regarding incident, problem and change management.

Responsibilities

Lead cyber incident response engagements from initial assessment and mobilisation through recovery, reporting and post-incident review.
Establish and update the incident’s severity, known scope, business impact and immediate priorities as evidence emerges.
Coordinate internal technical teams, client teams and third-party providers, setting actions, owners and deadlines.
Lead war room meetings and maintain an appropriate communication cadence, providing updates to technical teams, senior management and board-level stakeholders.
Translate technical findings into business risks, response options and recommendations, distinguishing confirmed facts, working hypotheses and evidence gaps.
Coordinate containment, eradication and recovery activities, considering operational dependencies, evidence preservation and client approval requirements.
Maintain incident timelines, decision logs, action trackers and handover records.
Deliver engagements within agreed scope and service commitments, escalating capacity constraints, delivery risks and additional requirements to the Head of Incident Response.
Produce and quality-assure investigation reports and post-incident reviews, ensuring conclusions are evidence-supported and recommendations are practical and prioritised.
Support client preparedness through incident response plan reviews, onboarding workshops and tabletop exercises.
Mentor SecOps team members training to become cross-disciplined responders.
Improve playbooks, templates and delivery processes using lessons identified during engagements.