Incident Response Lead

“I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC.” - CyberOne Consultant

About CyberOne

CyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio-across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.

Job Title: Incident Response Lead

Location: Remote

Employment Type: Full time

Role purpose

The Cyber Incident Response (CIR) Lead is responsible for delivering CyberOne’s incident response engagements as part of a pool of CIR Leads, leading clients and technical teams through the investigation, containment and recovery of cyber security incidents.

The role combines incident leadership, technical judgement and clear stakeholder communication to minimise business impact and support informed decisions under pressure.

Responsibilities

• Lead cyber incident response engagements from initial assessment and mobilisation through to recovery, reporting and post-incident review.
• Establish the incident’s severity, known scope, business impact and immediate priorities, maintaining an accurate assessment as new evidence emerges.
• Coordinate internal technical teams, client teams and third-party providers, setting clear actions, owners and deadlines.
• Lead war room meetings and maintain an appropriate communication cadence, providing clear updates to technical teams, senior management and board-level stakeholders.
• Translate technical findings into business risks, response options and recommendations, clearly distinguishing confirmed facts, working hypotheses and evidence gaps.
• Coordinate containment, eradication and recovery activities, ensuring recommendations consider operational dependencies, evidence preservation and the client’s approval requirements.
• Maintain incident timelines, decision logs, action trackers and handover records to support continuity and accountability.
• Deliver engagements within the agreed scope and service commitments, escalating capacity constraints, delivery risks and additional requirements to the Head of Incident Response.
• Produce and quality-assure investigation reports and post-incident reviews, ensuring conclusions are supported by evidence and recommendations are practical and prioritised.
• Support client preparedness through incident response plan reviews, onboarding workshops and tabletop exercises.
• Provide mentoring to SecOps team members in training to be cross disciplined responders.
• Contribute improvements to playbooks, templates and delivery processes using lessons identified during engagements.

Essential professional requirements

• Demonstrable experience leading significant cyber security incidents, including coordinating technical response activities and managing client communications.
• Ability to lead multidisciplinary teams during high-pressure situations, including where responders do not report directly to the role.
• Confident communication with executive and board-level stakeholders, including explaining uncertainty, operational risk and difficult response decisions.
• Strong judgement and prioritisation, with the ability to make timely recommendations using incomplete information and escalate decisions appropriately.
• Experience managing stakeholder expectations and maintaining constructive relationships during disruptive or sensitive incidents.
• Excellent written communication, with experience producing clear incident reports, executive summaries and actionable remediation recommendations.
• Strong organisational discipline, including maintaining accurate records, managing competing priorities and providing effective handovers.
• Professional discretion and sound judgement when handling sensitive client information and investigation evidence.

Essential technical requirements

• Practical experience responding to incidents such as ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration.
• Strong understanding of incident response activities, including preparation, detection, investigation, containment, eradication, recovery and continuous improvement.
• Ability to assess and challenge technical findings, identify gaps in an investigation and direct further analysis to establish scope, attack progression and business impact.
• Working knowledge of enterprise environments, including Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies.
• Experience using SIEM, EDR and identity telemetry to support investigations, including correlating activity across endpoints, accounts and cloud services.
• Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications.
• Ability to evaluate containment and recovery options, including their operational consequences, dependencies and potential effects on evidence.
• Understanding of evidence preservation, secure evidence handling and chain-of-custody principles, including recognising when specialist forensic support is required.
• Ability to recognise telemetry, retention and licensing limitations and explain how these affect investigative confidence and conclusions.
• Practical understanding of incident response guidance and threat frameworks, particularly NIST SP 800-61 and MITRE ATT&CK.

Desirable experience and qualifications

• Experience delivering incident response within a consultancy, managed security service provider or other client-facing environment.
• Experience with Microsoft Sentinel, Microsoft Defender XDR and KQL, alongside familiarity with other enterprise security platforms.
• Experience delivering incident preparedness workshops, tabletop exercises and post-incident reviews.
• Experience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams.
• Awareness of data protection and regulatory considerations, including recognising when clients require legal or privacy advice.
• Relevant qualifications such as GCIH, GCFA, CISSP or CISM. Equivalent practical experience is equally valued.
• ITIL 4 knowledge or certification, particularly in relation to incident, problem and change management.

Accountability and authority

The Cyber Incident Response Lead is accountable for the coordination, quality and communication of assigned engagements within agreed scope and delegated authority.

The Head of Incident Response retains accountability for the overall service, including strategy, budgets, staffing, commercial commitments and service governance.

Clients retain authority for business risk acceptance, operational changes, recovery approval and legal or regulatory decisions. The Cyber Incident Response Lead provides the information and recommendations needed to support those decisions.