FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in leading cyber incident response engagements, coordinating multidisciplinary teams, and effectively communicating with executive stakeholders. Proficient in incident management, evidence preservation, and producing comprehensive reports while ensuring compliance with regulatory standards.
Highest-signal resume keywords
Cyber Incident Response LeadershipStakeholder CommunicationIncident ManagementTechnical Analysis and InvestigationRegulatory Compliance
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Incident Response ActivitiesRansomware ResponseMalware Infection HandlingEvidence PreservationTechnical Findings AssessmentIncident Report ProductionDecision-Making Under PressureOperational Consequence EvaluationContinuous Improvement PracticesIncident Preparedness Workshops
Soft Skills
Strong JudgementOrganisational DisciplineMentoringConfident CommunicationPrioritisation
Tools & Technologies
SIEMEDRMicrosoft 365Active DirectoryMicrosoft Entra IDMicrosoft SentinelMicrosoft Defender XDRCloud ServicesCommon Network TechnologiesKQL
Certifications & Qualifications
GCIHGCFACISSPCISMITIL 4
Industry Keywords
NIST SP 800-61MITRE ATT&CKData ProtectionRegulatory ConsiderationsCrisis Communications
Tech Stack
Tools & technologiesCloudCyber Security
About the role
Key responsibilities & impact- Lead cyber incident response engagements from initial assessment and mobilisation through recovery, reporting, and post-incident review
- Establish incident severity, scope, business impact, and immediate priorities as evidence emerges
- Coordinate internal technical teams, client teams, and third-party providers
- Lead war room meetings and maintain communication with technical teams, senior management, and board-level stakeholders
- Translate technical findings into business risks, response options, and recommendations
- Coordinate containment, eradication, and recovery while considering dependencies, evidence preservation, and client approvals
- Maintain incident timelines, decision logs, action trackers, and handover records
- Deliver engagements within agreed scope and service commitments, escalating risks and additional requirements to the Head of Incident Response
- Produce and quality-assure investigation reports and post-incident reviews
- Support client preparedness through incident response plan reviews, onboarding workshops, and tabletop exercises
- Mentor SecOps team members training as cross-disciplined responders
- Improve playbooks, templates, and delivery processes using engagement lessons
- Provide information and recommendations supporting client decisions on business risk, operational changes, recovery, and legal or regulatory matters
Requirements
What you’ll need- Demonstrable experience leading significant cyber security incidents, coordinating technical response activities and managing client communications
- Ability to lead multidisciplinary teams during high-pressure situations, including teams whose members do not report directly to the role
- Confident communication with executive and board-level stakeholders
- Strong judgement, prioritisation, and timely decision-making using incomplete information
- Experience managing stakeholder expectations during disruptive or sensitive incidents
- Excellent written communication and experience producing incident reports, executive summaries, and remediation recommendations
- Strong organisational discipline and accurate record maintenance
- Professional discretion when handling sensitive client information and investigation evidence
- Practical experience responding to ransomware, business email compromise, identity compromise, malware infections, and suspected data exfiltration
- Strong understanding of incident response activities from preparation through continuous improvement
- Ability to assess technical findings, identify investigation gaps, and direct further analysis
- Working knowledge of Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services, and common network technologies
- Experience using SIEM, EDR, and identity telemetry in investigations
- Understanding of credential theft, session compromise, persistence, privilege escalation, lateral movement, and command-and-control techniques
- Ability to evaluate containment and recovery options and their operational consequences
- Understanding of evidence preservation, secure evidence handling, and chain-of-custody principles
- Ability to recognise telemetry, retention, and licensing limitations
- Practical understanding of NIST SP 800-61 and MITRE ATT&CK
- Desirable: experience in consultancy, an MSSP, or another client-facing environment
- Desirable: Microsoft Sentinel, Microsoft Defender XDR, and KQL experience
- Desirable: incident preparedness workshops, tabletop exercises, and post-incident reviews
- Desirable: coordination with legal advisers, cyber insurers, forensic providers, and crisis communications teams
- Desirable: awareness of data protection and regulatory considerations
- Desirable: GCIH, GCFA, CISSP, or CISM qualifications; equivalent practical experience equally valued
- Desirable: ITIL 4 knowledge or certification
Benefits
Comp & perks- Hybrid work arrangement
- Mentoring and professional development through cross-disciplinary responder training
- Opportunities to contribute to playbooks, templates, and delivery process improvements
- Exposure to Microsoft security technologies and incident response engagements