Senior Incident Responder

Blackpanda

. Lead live incident response engagements end-to-end, including scoping, containment, evidence acquisition, forensic analysis, and final reporting .

Posted 11/5/2026full-timeRemote • SingaporeSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in leading end-to-end incident response engagements, with strong technical expertise across Windows, Linux, and macOS environments. Proficient in scripting for automation and capable of delivering high-quality client interactions and documentation.

Highest-signal resume keywords

DFIR Caseload ExperienceIncident Response LeadershipScripting in Python, Bash, or PowerShellClient-Facing CommunicationCloud Provider Experience (AWS, Azure/M365, GCP)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital ForensicsIncident ResponseEvidence AcquisitionForensic AnalysisContainment StrategiesRemediation and RecoveryAutomation ToolingTechnical InvestigationsChain of Custody ManagementClient Deliverables Authoring

Soft Skills

Sound Judgement Under AmbiguityCalm Under PressureMentoring Junior RespondersEffective CommunicationCoaching and Training

Tools & Technologies

EDRSIEMForensic ToolingCloud EnvironmentsAutomation Tools

Certifications & Qualifications

SANS/GIAC (GCFA, GCIH, GNFA, GCFR, GREM)CISSPOSCP

Industry Keywords

BECRansomwareData BreachCompromise AssessmentInsider ThreatsClient ExperienceIncident ScopingOn-Call TriageAsia-Pacific OperationsHigh-Stakes Situations

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformLinuxMacOSPython

About the role

Key responsibilities & impact

Lead live incident response engagements end-to-end, including scoping, containment, evidence acquisition, forensic analysis, and final reporting
Run technical investigations across Windows, Linux, macOS, and cloud environments
Manage multiple concurrent engagements while maintaining quality
Own chain of custody, evidence handling, deliverable quality, and client experience
Participate in on-call triage for retainer and IR-1 activations
Deliver initial containment advice promptly after triage calls
Scope incidents directly with clients and define plans, deliverables, and commercial terms
Serve as senior technical point of contact throughout engagements
Advise on remediation, recovery, and hardening
Identify when to involve legal, insurance, or specialist services
Guide junior responders by assigning work, reviewing output, and coaching tradecraft and judgement
Share knowledge through writeups, internal training, walkthroughs, and mentoring
Lead delivery through others while maintaining technical quality
Contribute to playbooks, tooling, automation, and methodology
Bring engagement lessons back into the practice
Adopt AI and automation to improve work speed and quality
Report to a Response Director

Requirements

What you’ll need

At least 3 years of full DFIR caseload experience
Client-facing incident response experience in consultancy, MSSP IR team, or in-house CSIRT handling real incidents
Ability to lead investigations end-to-end across BEC, ransomware, data breach, compromise assessment, insider, and digital forensics cases
Strong technical depth across Windows, Linux, and macOS
Working comfort with at least one major cloud provider: AWS, Azure/M365, or GCP
Scripting ability in Python, Bash, or PowerShell sufficient to build collection, parsing, or automation tooling without supervision
Professional written and spoken English
Ability to author client deliverables, run client meetings, and represent Blackpanda in high-stakes situations
Sound judgement under ambiguity and calm under pressure
Preferred: SANS/GIAC certifications such as GCFA, GCIH, GNFA, GCFR, or GREM; or CISSP/OSCP
Preferred: hands-on experience with EDR, SIEM, and forensic tooling
Preferred: fluency in additional market languages such as Japanese, Mandarin, Cantonese, Korean, Bahasa Malaysia/Indonesia, or Tagalog
Preferred: mentoring or training junior responders
Preferred: contribution to tooling, automation, methodology, open-source, or internal improvements
Ability to work reliably across Asia-Pacific and Japan business hours, roughly GMT+7 to GMT+10
Willingness to join the response on-call rotation
Secure, private working space and stable, high-speed internet connection suitable for sensitive client evidence
Occasional travel for on-site engagements and attendance at the annual week-long Tribe Onsite

Benefits

Comp & perks

40 days paid leave per year inclusive of public holidays
Comprehensive corporate health plan with medical and dental coverage
Opportunities for inter-office travel
Required annual week-long Tribe Onsite meet-up
$5000 USD/year professional training budget, subject to manager approval and a 12-month retention requirement
Competitive base salary with performance-based variable compensation tied to market results
Equity participation in Blackpanda's growth
Real engagements from day one, with a clear path into leading more complex cases, technical specialisation, and broader team leadership