FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in leading cyber incident response engagements, coordinating multidisciplinary teams, and effectively communicating with executive stakeholders. Proficient in incident management, evidence preservation, and delivering actionable recommendations based on technical findings.
Highest-signal resume keywords
Cyber Incident Response LeadershipStakeholder CommunicationIncident ManagementTechnical Investigation SkillsRegulatory Compliance Awareness
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Incident Response ActivitiesRansomware ResponseMalware InvestigationEvidence PreservationTechnical Findings AssessmentIncident ReportingThreat Frameworks UnderstandingOperational Risk EvaluationCloud Services KnowledgeNetwork Technologies Familiarity
Soft Skills
Judgement and PrioritisationOrganisational DisciplineProfessional DiscretionRelationship ManagementClear Written Communication
Tools & Technologies
SIEMEDRMicrosoft SentinelMicrosoft Defender XDRMicrosoft 365Active DirectoryMicrosoft Entra IDKQLCloud ServicesNetwork Technologies
Certifications & Qualifications
GCIHGCFACISSPCISMITIL 4
Industry Keywords
Cyber SecurityIncident ResponseData ProtectionRegulatory ComplianceForensic SupportCrisis CommunicationsClient-Facing EnvironmentThreat FrameworksNIST SP 800-61MITRE ATT&CK
Tech Stack
Tools & technologiesCloudCyber Security
About the role
Key responsibilities & impact- Lead cyber incident response engagements from initial assessment and mobilisation through recovery, reporting and post-incident review
- Establish incident severity, known scope, business impact and immediate priorities, updating assessments as evidence emerges
- Coordinate internal technical teams, client teams and third-party providers, setting actions, owners and deadlines
- Lead war room meetings and maintain communication cadence with technical teams, senior management and board-level stakeholders
- Translate technical findings into business risks, response options and recommendations
- Coordinate containment, eradication and recovery activities while considering operational dependencies, evidence preservation and client approvals
- Maintain incident timelines, decision logs, action trackers and handover records
- Deliver engagements within agreed scope and service commitments, escalating capacity constraints, delivery risks and additional requirements to the Head of Incident Response
- Produce and quality-assure investigation reports and post-incident reviews
- Support client preparedness through incident response plan reviews, onboarding workshops and tabletop exercises
- Mentor SecOps team members training to become cross-disciplinary responders
- Improve playbooks, templates and delivery processes using engagement lessons
- Coordinate assigned engagements within delegated authority; provide information and recommendations supporting client decisions on risk acceptance, operational changes, recovery and legal or regulatory matters
Requirements
What you’ll need- Demonstrable experience leading significant cyber security incidents, including coordinating technical response activities and managing client communications
- Ability to lead multidisciplinary teams during high-pressure situations, including where responders do not report directly to the role
- Confident communication with executive and board-level stakeholders, including explaining uncertainty, operational risk and difficult response decisions
- Strong judgement and prioritisation, with the ability to make timely recommendations using incomplete information and escalate decisions appropriately
- Experience managing stakeholder expectations and maintaining constructive relationships during disruptive or sensitive incidents
- Excellent written communication, with experience producing clear incident reports, executive summaries and actionable remediation recommendations
- Strong organisational discipline, including maintaining accurate records, managing competing priorities and providing effective handovers
- Professional discretion and sound judgement when handling sensitive client information and investigation evidence
- Practical experience responding to ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration
- Strong understanding of incident response activities, including preparation, detection, investigation, containment, eradication, recovery and continuous improvement
- Ability to assess and challenge technical findings, identify gaps in an investigation and direct further analysis to establish scope, attack progression and business impact
- Working knowledge of enterprise environments, including Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies
- Experience using SIEM, EDR and identity telemetry to support investigations, including correlating activity across endpoints, accounts and cloud services
- Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications
- Ability to evaluate containment and recovery options, including their operational consequences, dependencies and potential effects on evidence
- Understanding of evidence preservation, secure evidence handling and chain-of-custody principles, including recognising when specialist forensic support is required
- Ability to recognise telemetry, retention and licensing limitations and explain how these affect investigative confidence and conclusions
- Practical understanding of incident response guidance and threat frameworks, particularly NIST SP 800-61 and MITRE ATT&CK
- Experience delivering incident response within a consultancy, managed security service provider or other client-facing environment
- Experience with Microsoft Sentinel, Microsoft Defender XDR and KQL, alongside familiarity with other enterprise security platforms
- Experience delivering incident preparedness workshops, tabletop exercises and post-incident reviews
- Experience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams
- Awareness of data protection and regulatory considerations, including recognising when clients require legal or privacy advice
- Relevant qualifications such as GCIH, GCFA, CISSP or CISM are desirable; equivalent practical experience is equally valued
- ITIL 4 knowledge or certification is desirable
- Ability to work remotely from the Philippines
Benefits
Comp & perks- Fully remote work arrangement
- Mentoring and training opportunities to become cross-disciplinary responders