{"id":4060855,"url":"https://alion.io/job/cyberone-incident-response-lead","title":"Incident Response Lead","company":{"id":695879,"name":"CyberOne","domain":"cyberone.security","url":"https://alion.io/company/cyber-one","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":{"grade":"A","score":93,"open_postings":15,"ghost_share":0,"stale_share":0.067,"repost_share":0,"time_to_fill_p50_days":96,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Copilot","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"ITIL","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"Microsoft Sentinel","optional":true}],"status":"live","first_seen_at":"2026-11-11T07:57:03Z","employer_posted_date":"2026-11-11","last_verified_at":"2026-11-13T21:41:36Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"“I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC.” - CyberOne Consultant\nAbout CyberOne\nCyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio-across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.\nJob Title: Incident Response Lead\nLocation: Hybrid\nEmployment Type: Full time\nRole purpose\nThe Cyber Incident Response (CIR) Lead is responsible for delivering CyberOne’s incident response engagements as part of a pool of CIR Leads, leading clients and technical teams through the investigation, containment and recovery of cyber security incidents.\nThe role combines incident leadership, technical judgement and clear stakeholder communication to minimise business impact and support informed decisions under pressure.\nResponsibilities\nLead cyber incident response engagements from initial assessment and mobilisation through to recovery, reporting and post-incident review.\nEstablish the incident’s severity, known scope, business impact and immediate priorities, maintaining an accurate assessment as new evidence emerges.\nCoordinate internal technical teams, client teams and third-party providers, setting clear actions, owners and deadlines.\nLead war room meetings and maintain an appropriate communication cadence, providing clear updates to technical teams, senior management and board-level stakeholders.\nTranslate technical findings into business risks, response options and recommendations, clearly distinguishing confirmed facts, working hypotheses and evidence gaps.\nCoordinate containment, eradication and recovery activities, ensuring recommendations consider operational dependencies, evidence preservation and the client’s approval requirements.\nMaintain incident timelines, decision logs, action trackers and handover records to support continuity and accountability.\nDeliver engagements within the agreed scope and service commitments, escalating capacity constraints, delivery risks and additional requirements to the Head of Incident Response.\nProduce and quality-assure investigation reports and post-incident reviews, ensuring conclusions are supported by evidence and recommendations are practical and prioritised.\nSupport client preparedness through incident response plan reviews, onboarding workshops and tabletop exercises.\nProvide mentoring to SecOps team members in training to be cross disciplined responders.\nContribute improvements to playbooks, templates and delivery processes using lessons identified during engagements.\nEssential professional requirements\nDemonstrable experience leading significant cyber security incidents, including coordinating technical response activities and managing client communications.\nAbility to lead multidisciplinary teams during high-pressure situations, including where responders do not report directly to the role.\nConfident communication with executive and board-level stakeholders, including explaining uncertainty, operational risk and difficult response decisions.\nStrong judgement and prioritisation, with the ability to make timely recommendations using incomplete information and escalate decisions appropriately.\nExperience managing stakeholder expectations and maintaining constructive relationships during disruptive or sensitive incidents.\nExcellent written communication, with experience producing clear incident reports, executive summaries and actionable remediation recommendations.\nStrong organisational discipline, including maintaining accurate records, managing competing priorities and providing effective handovers.\nProfessional discretion and sound judgement when handling sensitive client information and investigation evidence.\nEssential technical requirements\nPractical experience responding to incidents such as ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration.\nStrong understanding of incident response activities, including preparation, detection, investigation, containment, eradication, recovery and continuous improvement.\nAbility to assess and challenge technical findings, identify gaps in an investigation and direct further analysis to establish scope, attack progression and business impact.\nWorking knowledge of enterprise environments, including Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies.\nExperience using SIEM, EDR and identity telemetry to support investigations, including correlating activity across endpoints, accounts and cloud services.\nUnderstanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications.\nAbility to evaluate containment and recovery options, including their operational consequences, dependencies and potential effects on evidence.\nUnderstanding of evidence preservation, secure evidence handling and chain-of-custody principles, including recognising when specialist forensic support is required.\nAbility to recognise telemetry, retention and licensing limitations and explain how these affect investigative confidence and conclusions.\nPractical understanding of incident response guidance and threat frameworks, particularly NIST SP 800-61 and MITRE ATT&CK.\nDesirable experience and qualifications\nExperience delivering incident response within a consultancy, managed security service provider or other client-facing environment.\nExperience with Microsoft Sentinel, Microsoft Defender XDR and KQL, alongside familiarity with other enterprise security platforms.\nExperience delivering incident preparedness workshops, tabletop exercises and post-incident reviews.\nExperience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams.\nAwareness of data protection and regulatory considerations, including recognising when clients require legal or privacy advice.\nRelevant qualifications such as GCIH, GCFA, CISSP or CISM. Equivalent practical experience is equally valued.\nITIL 4 knowledge or certification, particularly in relation to incident, problem and change management.\nAccountability and authority\nThe Cyber Incident Response Lead is accountable for the coordination, quality and communication of assigned engagements within agreed scope and delegated authority.\nThe Head of Incident Response retains accountability for the overall service, including strategy, budgets, staffing, commercial commitments and service governance.\nClients retain authority for business risk acceptance, operational changes, recovery approval and legal or regulatory decisions. The Cyber Incident Response Lead provides the information and recommendations needed to support those decisions.","description_format":"text","description_chars":7156,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-11-11T08:34:23Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":96,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-11-12T10:38:37Z"},"pay":null,"html_url":"https://alion.io/job/cyberone-incident-response-lead","json_url":"https://alion.io/job/cyberone-incident-response-lead.json","meta":{"generated_at":"2026-11-13T23:07:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":46056,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":695879},"rest":"https://alion.io/mcp/rest/get_company?id=695879"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcyberone-incident-response-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcyberone-incident-response-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcyberone-incident-response-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cyberone-incident-response-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcyberone-incident-response-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4060855}},{"tool":"search_jobs","arguments":{"company":"cyberone.security","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4060855},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}