{"id":185405,"url":"https://alion.io/job/arctic-wolf-manager-incident-response","title":"Manager, Incident Response","company":{"id":1025,"name":"Arctic Wolf","domain":"arcticwolf.com","url":"https://alion.io/company/arctic-wolf","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":89,"open_postings":17,"ghost_share":0,"stale_share":0.412,"repost_share":0.059,"time_to_fill_p50_days":39,"computed_at":"2026-10-24T06:02:35Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United Kingdom"],"countries":["GB"],"hiring_countries":["GB"],"hiring_countries_total":1,"salary":{"min":76000,"max":114000,"currency":"GBP","period":"year","gross":null,"usd_annual":152690},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Amazon Aurora","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"Linux","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-09-01T14:49:51Z","employer_posted_date":"2026-09-01","last_verified_at":"2026-10-23T19:05:25Z","board_verified":true,"closed_at":null,"days_open":52,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":52},"description":"At Arctic Wolf, we're not just navigating the cybersecurity landscape - we're redefining it. Our global team of dedicated Pack members is driving innovation and setting new industry standards every day. Our impact speaks for itself: we've earned recognition on the Forbes Cloud 100, CNBC Disruptor 50, Fortune Future 50, and Fortune Cyber 60 lists, and we recently took home the 2024 CRN Products of the Year award. We’re proud to be named a Leader in the IDC MarketScape for Worldwide Managed Detection and Response Services and earning a Customers' Choice distinction from Gartner Peer Insights. Our Aurora Platform also received CRN’s Products of the Year award in the inaugural Security Operations Platform category. Join a company that’s not only leading, but also shaping, the future of security operations.\nOur mission is simple: End Cyber Risk. We’re looking for a Manager, Incident Reponse to be part of making this happen, based in the UK.\nAbout the Role\nThe Manager, Incident Response is responsible for leading and maturing Arctic Wolf's Incident Response practice by combining strategic leadership, operational management, and advanced technical incident response expertise. This role leads and develops a team of Incident Response professionals while maintaining the technical depth required to support and lead complex investigations, cyber extortion events, ransomware engagements, business email compromise matters, and large-scale recovery efforts.\nThe Manager is accountable for delivering world-class incident response services, ensuring operational excellence, maintaining technical quality standards, driving process improvements, developing team capabilities, and supporting organizational growth. This individual serves as both a management leader and a senior technical escalation resource capable of leading the most complex investigations and customer engagements\nTeam Leadership & People Management\nLead, mentor, develop, and manage a hybrid/remote team of Incident Response professionals.\nEnsure operational standardization across delivery regions\nRecruit, hire, onboard, train, and retain top DFIR talent.\nConduct performance reviews, career development planning, coaching sessions, and succession planning.\nFoster a culture of collaboration, accountability, technical excellence, and continuous improvement.\nEnsure team members receive exposure to a variety of investigative and recovery activities to support career growth.\nLead team development initiatives through formal mentoring, peer coaching, technical reviews, and knowledge-sharing programs.\nServe as an escalation point for personnel, client, and delivery-related issues.\nIncident Response Operations\nOversee the delivery of Incident Response services to ensure consistent, scalable, and high-quality outcomes.\nScope incoming matters, monitor, and manage incident response engagements across the team.\nAssign personnel to engagements based on skillsets, availability, customer needs, and goals.\nMaintain awareness of all active investigations and recovery efforts, stepping in when escalation or leadership intervention is required.\nEnsure proper case management practices, utilization targets, resource planning, scheduling, and workload balancing.\nDevelop and implement operational processes, standards, and quality assurance mechanisms.\nReview incident reports, executive summaries, investigative findings, and customer deliverables prior to delivery.\nEstablish and maintain key performance indicators (KPIs), service metrics, and operational reporting capabilities.\nDrive continuous improvement initiatives that enhance efficiency, consistency, customer satisfaction, and service quality.\nProvide technical leadership and mentorship to team members throughout engagements and forensic activities\nTechnical Incident Response & Forensics\nLead and support advanced digital forensic and incident response investigations.\nConduct and oversee host, network, cloud, and log-based forensic analysis.\nPerform investigative activities involving Windows, Linux, macOS, Azure, AWS, and Google Cloud environments.\nGuide containment, eradication, recovery, and remediation activities during active security incidents.\nValidate investigative findings and technical conclusions developed by team members.\nDevelop complex investigation strategies and incident response plans for customer environments.\nConduct forensic analysis through collected evidence to determine threat actor activity and timeline, identify persistent mechanisms, data impact and indicators of compromise.\nMaintain expert-level knowledge of emerging threats, attack methodologies, ransomware trends, and DFIR best practices.\nParticipate directly in the most complex, high-risk, or high-visibility engagements, when required.\nCustomer & Stakeholder Engagement\nServe as a senior trusted advisor during active cybersecurity incidents.\nCommunicate technical findings to executive leadership, legal counsel, insurance carriers, and technical stakeholders.\nLead scoping discussions and engagement planning for new incident response matters.\nSupport cyber extortion and ransomware negotiation strategy development and approval.\nPresent recovery plans, investigative findings, and strategic recommendations to customer stakeholders.\nBuild and maintain relationships with legal counsel, cyber insurance carriers, strategic partners, and customers.\nSupport business development activities, attend industry events, and thought leadership initiatives as needed.\nRecommend Arctic Wolf solutions and services where appropriate based on customer needs.\nStrategic Leadership & Program Development\nPartner with Directors and Executive Leadership to execute the vision, strategy, and growth plans for the Incident Response organization.\nIdentify opportunities for automation, innovation, tooling improvements, and operational efficiencies.\nDefine and standardize processes, methodologies, documentation, and service delivery frameworks.\nDrive reporting and analytics initiatives that demonstrate business impact, customer outcomes, operational efficiency, and risk reduction.\nCollaborate across Product, Engineering, Security Operations, Concierge, MDR, Sales, Marketing, and Customer Success teams.\nSupport strategic planning, budgeting, forecasting, workforce planning, and organizational scaling initiatives.\nChampion quality assurance programs, service delivery excellence, and customer experience improvements\nGeneral Responsibilities\nCreate and participate in escalation, evening, weekend, and holiday on-call rotations.\nConduct peer reviews, quality reviews, and case audits.\nPromote information sharing, documentation, and organizational learning.\nMaintain required technical certifications and professional development goals.\nPerform other duties as assigned in support of Arctic Wolf's Incident Response mission and organizational objectives.\nKey Skills\nDigital Forensics & Incident Response (DFIR)\nLeadership and Team Development\nIncident Command and Crisis Management\nCyber Extortion and Ransomware Response\nExecutive Communication\nCustomer Relationship Management\nStrategic Planning\nOperational Excellence\nProcess Development and Standardization\nPerformance Metrics and Reporting\nCloud and Enterprise Incident Response\nInvestigation Quality Assurance\nResource Planning and Utilization Management\nStakeholder Management\nCross-Functional Collaboration\nProject and Program Management\nMinimum Qualifications\n3+ years of experience leading technical teams, people management, or service delivery organizations.\nDemonstrated experience leading complex cyber incident investigations and recovery efforts.\nStrong knowledge of host, network, cloud, and enterprise forensic analysis.\nExperience managing customer-facing engagements involving legal counsel, cyber insurance carriers, and executive stakeholders.\nExceptional verbal and written communication skills.\nExperience developing operational processes, performance metrics, and quality assurance programs.\nAbility to lead multiple concurrent initiatives and prioritize effectively in high-pressure environments.\nFluency in English, verbal and written\nPreferred Qualifications\nBachelor's degree in Information Security, Digital Forensics, Computer Science, Cybersecurity, or a related discipline.\nIndustry certifications such as GCFA, GCFE, CISSP, GCIH, EnCE, ACE, or equivalent.\nExperience within consulting, managed security services, or incident response service organizations.\nExperience presenting at industry conferences, customer events, or technical forums.\nExperience supporting large-scale enterprise incident response programs and global service delivery teams\nAbout Arctic Wolf\nAt Arctic Wolf, we foster a collaborative and inclusive work environment that thrives on diversity of thought, background, and culture. This is reflected in our multiple awards, including Top Workplace USA (2021-2024), Best Places to Work - USA (2021-2024), Great Place to Work - Canada (2021-2024), Great Place to Work - UK (2025), and Kununu Top Company - Germany (2025). Our commitment to bold growth and shaping the future of security operations is matched by our dedication to customer satisfaction, with over 7,000 customers worldwide and more than 2,000 channel partners globally. As we continue to expand globally and enhance our technology, Arctic Wolf remains the most trusted name in the industry.\nOur Values\nArctic Wolf recognises that success comes from delighting our customers, so we work together to ensure that happens every day. We believe in diversity and inclusion, and truly value the unique qualities and unique perspectives all employees bring to the organization. And we appreciate that-by protecting people’s and organisations’ sensitive data and seeking to end cyber risk- we get to work in an industry that is fundamental to the greater good. We celebrate unique perspectives by creating a platform for all voices to be heard through our Pack Unity program. We encourage all employees to join or create a new alliance. See more about our Pack Unity here. We also believe and practice corporate responsibility, and have recently joined the Pledge 1% Movement, ensuring that we continue to give back to our community. We know that through our mission to End Cyber Risk we will continue to engage and give back to our communities.\nAll wolves receive compelling compensation and benefits packages, including:\nEquity for all employees\n28 days annual leave, 8 bank holidays and paid volunteering days off\nPension plan employer match\nTraining and career development programs\nRobust Employee Assistance Program (EAP) with mental health service\nComprehensive private benefits plan including medical insurance, virtual GP, optical and dental cashback, life insurance (4x basic salary) and group income protection.\nFertility support and paid parental leave\nArctic Wolf is an Equal Opportunity Employer and considers applicants for employment without regard to race, colour, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under federal, provincial, or local law. Arctic Wolf is committed to fostering a welcoming, accessible, respectful, and inclusive environment ensuring equal access and participation for people with disabilities. As such, we strive to make our entire employee experience as accessible as possible and provide accommodations as required for candidates and employees with disabilities and/or other specific needs where possible. Please let us know if you require any accommodations by emailing .\nSecurity Requirements\nConducts duties and responsibilities in accordance with AWN’s Information Security policies, standards, processes and controls to protect the confidentiality, integrity and availability of AWN business information (in accordance with our employee handbook and corporate policies). \nBackground checks are required for this position. \nThis position may require access to information protecte...","description_format":"text","description_chars":12899,"description_truncated":true,"requirements":{"experience_years_min":3,"management_years_min":3,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Annual leave","Equity","Health insurance","Life insurance","Paid volunteering days","Parental leave","Professional development"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-09-01T14:49:51Z"}],"visa":[],"liveness":{"score":43,"band":"fade","label":"Fading","p_open":1,"p_active":0.779,"p_room":0.55,"age_days":52,"expected_fill_days":39,"reasons":["conf:10","velocity","win:tail"],"computed_at":"2026-10-24T06:02:35Z"},"pay":{"stated_usd_annual":152690,"is_top_pay":true},"html_url":"https://alion.io/job/arctic-wolf-manager-incident-response","json_url":"https://alion.io/job/arctic-wolf-manager-incident-response.json","meta":{"generated_at":"2026-10-24T06:21:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9195,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-25T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1025},"rest":"https://alion.io/mcp/rest/get_company?id=1025"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farctic-wolf-manager-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farctic-wolf-manager-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farctic-wolf-manager-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arctic-wolf-manager-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farctic-wolf-manager-incident-response"}]}