FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in managing cyber incident response services, ensuring quality delivery and client satisfaction while leading and developing response teams. Proficient in incident management, stakeholder communication, and implementing service improvements based on operational feedback.
Highest-signal resume keywords
Cyber Incident Response ManagementClient-Facing Incident Response CapabilityExecutive Communication SkillsIncident Investigation and AnalysisQuality Assurance of Incident Reports
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Cyber Security Incident ManagementIncident InvestigationRansomware ResponseMalware Infection ResponseWindows and Active DirectorySIEM and EDR ToolsNIST SP 800-61MITRE ATT&CK FrameworkEvidence Handling PrinciplesBusiness Email Compromise Response
Soft Skills
Client ManagementJudgement and Decision-MakingTeam LeadershipCommunication SkillsProfessional Discretion
Tools & Technologies
Microsoft Entra IDMicrosoft 365Microsoft SentinelMicrosoft Defender XDRKQL
Certifications & Qualifications
GCIHGCFACISSPCISMITIL 4
Industry Keywords
Incident ResponseCyber SecurityService ImprovementOperational DeliveryData Protection Regulations
Tech Stack
Tools & technologiesCloudCyber Security
About the role
Key responsibilities & impact- Own the operational delivery of CyberOne’s NCSC CREST accredited Cyber Incident Response service
- Establish standards for customer onboarding, incident management, investigation, reporting and post-incident review
- Oversee CIR Lead performance during engagements and ensure delivery meets agreed scope, service commitments and client expectations
- Ensure appropriate tools, documentation, playbooks and processes are available
- Oversee quality assurance of investigation reports and client deliverables
- Identify and implement service improvements using feedback, lessons learned and threat landscape changes
- Report service performance, capacity constraints, delivery risks and improvement priorities to the Operations Director
- Maintain oversight of active engagements and escalate incidents requiring additional support or management intervention
- Participate directly in complex incidents and concurrent engagements
- Support CIR Leads with difficult response decisions, executive communications and sensitive client situations
- Own IR client technical escalations and resolve issues in the interests of both parties
- Assist with scoping IR engagements and clarifying client needs, dependencies and service limitations
- Meet newly signed clients with assigned CIR Leads to introduce the service and establish expectations
- Ensure retained customer onboarding meets appropriate standards and gaps affecting response readiness are communicated
- Directly manage, support and develop CIR Leads
- Assess demand against team capacity and identify coverage, capability and resilience gaps
- Prepare business cases for additional hiring and support interviews and candidate assessment
- Coordinate additional SecOps support while maintaining MXDR service delivery
- Support development of SecOps team members contributing to incident response
- Monitor workload and support effective cover and handovers during prolonged or concurrent engagements
Requirements
What you’ll need- Demonstrable experience leading significant cyber security incidents, including complex investigations, multidisciplinary response teams and senior stakeholder communications
- Experience managing or overseeing a client-facing incident response capability, with responsibility for delivery quality and service improvement
- Ability to communicate confidently with executive and board-level stakeholders, translating technical findings into business impact, response options and decisions
- Strong client management skills, including resolving escalations and maintaining constructive relationships during disruptive or sensitive incidents
- Ability to lead and develop experienced responders while providing appropriate challenge, support and direction
- Strong judgement when prioritising competing engagements and balancing incident response requirements against wider operational commitments
- Experience assessing resource requirements and presenting clear, evidence-based business cases to senior management
- Excellent written communication and quality assurance skills, including reviewing incident reports, executive summaries and remediation recommendations
- Professional discretion and sound judgement when handling sensitive information, investigation evidence and uncertain findings
- Strong practical experience responding to ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration
- Ability to contribute directly to investigations and response activities, alongside providing technical oversight and incident leadership
- Ability to assess and challenge investigative findings, identify evidence gaps and direct analysis to establish incident scope, attack progression and business impact
- Strong understanding of Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies
- Experience using SIEM, EDR and identity telemetry to investigate and correlate activity across endpoints, accounts and cloud services
- Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications
- Ability to assess containment, eradication and recovery options, considering business dependencies, operational consequences, evidence preservation and client approval requirements
- Understanding of secure evidence handling and chain-of-custody principles
- Ability to assess how telemetry coverage, retention and licensing limitations affect response readiness, investigative confidence and conclusions
- Practical understanding of NIST SP 800-61 and MITRE ATT&CK
- Desirable: experience managing incident response delivery within a consultancy or managed security service provider
- Desirable: experience with Microsoft Sentinel, Microsoft Defender XDR and KQL
- Desirable: experience developing incident response services, delivery processes, playbooks and quality standards
- Desirable: experience delivering preparedness workshops, tabletop exercises and incident response plan reviews
- Desirable: experience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams
- Desirable: awareness of data protection and regulatory considerations
- Relevant qualifications such as GCIH, GCFA, CISSP or CISM are desirable
- ITIL 4 knowledge or certification is desirable
Benefits
Comp & perks- Hybrid working arrangement
- Professional development and knowledge-sharing opportunities
- Support for training and participation in incident response activities
- Opportunity to work with Microsoft security technologies and services