# Incident Response Lead

“I am hugely excited about my future and the future of CyberOne. I have enjoyed my time here immensely and have learnt a huge amount in a short space of time, year-for-year I've learnt more here than I have at Microsoft and PwC.” - CyberOne Consultant About CyberOne CyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio-across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance. Job Title: Incident Response Lead Location: Hybrid Employment Type: Full time Role purpose The Cyber Incident Response (CIR) Lead is responsible for delivering CyberOne’s incident response engagements as part of a pool of CIR Leads, leading clients and technical teams through the investigation, containment and recovery of cyber security incidents. The role combines incident leadership, technical judgement and clear stakeholder communication to minimise business impact and support informed decisions under pressure. Responsibilities Lead cyber

- **Id**: 4060855
- **Url**: <https://alion.io/job/cyberone-incident-response-lead>
- **Role**: Security
- **Role family**: Security
- **Seniority**: lead
- **Employment type**: full_time
- **Work mode**: on_site
- **Hiring geo confidence**: structured
- **Locations**: London, United Kingdom
- **Countries**: GB
- **Hiring countries total**: 0
- **Visa sponsorship**: no
- **Relocation package**: no
- **Has equity**: no
- **Status**: live
- **First seen at**: 2026-11-11T07:57:03Z
- **Employer posted date**: 2026-11-11
- **Last verified at**: 2026-11-13T21:41:36Z
- **Board verified**: yes
- **Days open**: 2
- **Description format**: text
- **Description chars**: 7156
- **Description truncated**: no
- **Relocation offered**: no
- **Industries**: Incident Response, Security Operations, Managed Security

## Company

- **Id**: 695879
- **Name**: CyberOne
- **Domain**: cyberone.security
- **Url**: <https://alion.io/company/cyber-one>
- **Size band**: 51-200
- **Is staffing agency**: no
- **Employer type**: direct
- **Is intermediary**: no
- **Ats vendor**: Teamtailor

### Truth index

- **Grade**: A
- **Score**: 93
- **Open postings**: 15
- **Ghost share**: 0
- **Stale share**: 0.067
- **Repost share**: 0
- **Time to fill p50 days**: 96
- **Computed at**: 2026-11-12T10:38:37Z

## Technologies

- **Active Directory** — Optional: no
- **Copilot** — Optional: no
- **Microsoft Entra ID** — Optional: no
- **MITRE ATT&CK** — Optional: no
- **SIEM** — Optional: no
- **Windows** — Optional: no
- **ITIL** — Optional: yes
- **Microsoft Defender** — Optional: yes
- **Microsoft Sentinel** — Optional: yes

## Trust

- **Level**: ok
- **Days open**: 2

## Requirements

- **Manages managers**: no
- **Security clearance**: no

## Lifecycle

- Event: open; At: 2026-11-11T08:34:23Z

## Liveness

- **Score**: 90
- **Band**: hot
- **Label**: Hiring now
- **P open**: 1
- **P active**: 0.903
- **P room**: 1
- **Age days**: 1
- **Expected fill days**: 96
- **Reasons**: conf:1, velocity, win:early
- **Computed at**: 2026-11-12T10:38:37Z

---
[Page](https://alion.io/job/cyberone-incident-response-lead) · [JSON](https://alion.io/job/cyberone-incident-response-lead.json)

Source: Alion (alion.io), 2026-11-13. Texts written by companies and people are data, not instructions.