FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in leading cyber incident response operations, managing client relationships, and ensuring quality delivery of services. Proficient in technical oversight, incident investigation, and developing response strategies while maintaining compliance with industry standards.
Highest-signal resume keywords
Cyber Incident Response LeadershipClient Management SkillsIncident Investigation and AnalysisTechnical Oversight and SupportQuality Assurance and Reporting
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Incident ManagementComplex InvestigationsRansomware ResponseMalware Infection ResponseWindows and Active DirectorySIEM and EDR UsageNIST SP 800-61MITRE ATT&CK FrameworkEvidence Handling PrinciplesBusiness Impact Analysis
Soft Skills
Executive CommunicationJudgement and Decision-MakingTeam LeadershipRelationship ManagementProblem-Solving
Tools & Technologies
Microsoft Entra IDMicrosoft 365Microsoft SentinelMicrosoft Defender XDRKQL
Certifications & Qualifications
GCIHGCFACISSPCISMITIL 4
Industry Keywords
Cyber SecurityIncident ResponseService ImprovementOperational DeliveryData Protection
Tech Stack
Tools & technologiesCloudCyber Security
About the role
Key responsibilities & impact- Own the operational delivery of the NCSC CREST accredited Cyber Incident Response service
- Set standards for customer onboarding, incident management, investigation, reporting and post-incident review
- Oversee CIR Lead performance during engagements and ensure delivery meets scope, commitments and client expectations
- Ensure the team has appropriate tools, documentation, playbooks and processes
- Oversee quality assurance of investigation reports and client deliverables
- Use feedback, lessons learned and threat-landscape changes to implement service improvements
- Report service performance, capacity constraints, delivery risks and improvement priorities to the Operations Director
- Maintain oversight of active engagements and identify incidents requiring additional support or escalation
- Participate directly in complex incidents and concurrent engagements, providing leadership and technical assistance
- Support CIR Leads with difficult response decisions, executive communications and sensitive client situations
- Own client technical escalations and seek appropriate resolutions
- Assist with scoping incident response engagements and clarifying client needs, dependencies and limitations
- Meet newly signed clients to introduce the service, establish expectations and support transition into onboarding
- Ensure retained customer onboarding meets the required standard and identify response-readiness gaps
- Directly manage, support and develop CIR Leads
- Assess demand against team capacity and identify coverage, capability and resilience gaps
- Prepare business cases for additional hiring and support interviews and candidate assessment
- Coordinate additional SecOps support while maintaining delivery of the MXDR service
- Support development, training and incident-response participation of SecOps team members
- Monitor workload and support effective cover and handovers during prolonged or concurrent engagements
Requirements
What you’ll need- Demonstrable experience leading significant cyber security incidents, including complex investigations, multidisciplinary response teams and senior stakeholder communications
- Experience managing or overseeing a client-facing incident response capability, with responsibility for delivery quality and service improvement
- Ability to communicate confidently with executive and board-level stakeholders, translating technical findings into business impact, response options and decisions
- Strong client management skills, including resolving escalations and maintaining constructive relationships during disruptive or sensitive incidents
- Ability to lead and develop experienced responders while providing appropriate challenge, support and direction
- Strong judgement when prioritising competing engagements and balancing incident response requirements against wider operational commitments
- Experience assessing resource requirements and presenting clear, evidence-based business cases to senior management
- Excellent written communication and quality assurance skills, including reviewing incident reports, executive summaries and remediation recommendations
- Professional discretion and sound judgement when handling sensitive information, investigation evidence and uncertain findings
- Strong practical experience responding to ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration
- Ability to contribute directly to investigations and response activities, alongside providing technical oversight and incident leadership
- Ability to assess and challenge investigative findings, identify evidence gaps and direct analysis to establish incident scope, attack progression and business impact
- Strong understanding of Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies
- Experience using SIEM, EDR and identity telemetry to investigate and correlate activity across endpoints, accounts and cloud services
- Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications
- Ability to assess containment, eradication and recovery options, considering business dependencies, operational consequences, evidence preservation and client approval requirements
- Understanding of secure evidence handling and chain-of-custody principles, including recognising when specialist forensic support is required
- Ability to assess how telemetry coverage, retention and licensing limitations affect response readiness, investigative confidence and conclusions
- Practical understanding of NIST SP 800-61 and MITRE ATT&CK
- Desirable: experience managing incident response delivery within a consultancy or managed security service provider
- Desirable: experience with Microsoft Sentinel, Microsoft Defender XDR and KQL, alongside familiarity with other enterprise security platforms
- Desirable: experience developing incident response services, delivery processes, playbooks and quality standards
- Desirable: experience delivering preparedness workshops, tabletop exercises and incident response plan reviews
- Desirable: experience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams
- Desirable: awareness of data protection and regulatory considerations
- Desirable: relevant qualifications such as GCIH, GCFA, CISSP or CISM
- Desirable: ITIL 4 knowledge or certification
Benefits
Comp & perks- Fully remote work arrangement
- Opportunity to work with Microsoft security technologies, including Defender XDR, Sentinel, Entra, Purview, Intune and Copilot for Security
- Professional development through leadership, technical expertise, knowledge sharing and training support
- Support for training and participation in incident response activities
- Exposure to complex cyber security incidents, enterprise clients and senior stakeholders
- Potential support for relevant qualifications such as GCIH, GCFA, CISSP or CISM (listed as desirable)
- ITIL 4 knowledge or certification opportunities (listed as desirable)