{"id":3752900,"url":"https://alion.io/job/endava-security-incident-manager","title":"Security Incident Manager","company":{"id":6702,"name":"Endava","domain":"endava.com","url":"https://alion.io/company/endava","size_band":"51-200","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":75,"open_postings":28,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":26,"computed_at":"2026-11-06T05:58:05Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Cluj-Napoca, Romania"],"countries":["RO"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CAPA","optional":false},{"name":"Incident Management","optional":false},{"name":"ISO 27001","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-11-04T13:24:15Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-06T15:32:15Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Technology is our how. And people are our why. For over two decades, we have been harnessing technology to drive meaningful change.\nBy combining world-class engineering, industry expertise and a people-centric mindset, we consult and partner with leading brands from various industries to create dynamic platforms and intelligent digital experiences that drive innovation and transform businesses.\nFrom prototype to real-world impact - be part of a global shift by doing work that matters.\n We are seeking an experienced Security Incident Manager to lead and coordinate the end-to-end management of escalated information security events and incidents.\nThe role is responsible for ensuring that security incidents are effectively assessed, investigated, managed and resolved in accordance with established security incident management processes. Acting as the central coordination point, the Security Incident Manager will work closely with the Security Operations Centre (SOC), technical response teams, Legal, business stakeholders and senior leadership to ensure timely decision-making, effective incident response and appropriate risk management.\nThe successful candidate will take ownership of incident coordination from initial escalation through investigation, containment, remediation, recovery and formal closure, ensuring clear accountability, effective communication and comprehensive documentation.\nKey Responsibilities\nIncident Management: Lead and coordinate the end-to-end management of escalated security events and incidents, ensuring timely assessment, classification, response, resolution and closure.\nIncident Response Coordination: Coordinate cross-functional incident response activities involving the SOC, IT Operations, technical specialists and other relevant teams, ensuring clear ownership, prioritisation and timely completion of actions.\nInvestigation Oversight: Monitor technical investigations, containment, remediation and recovery activities, ensuring sufficient information is available to assess incident scope, root causes, business impact and required actions.\nStakeholder Management: Act as the central coordination point for incident-related activities, facilitating discussions, decision-making and collaboration between technical teams, Legal, business representatives and senior management.\nEscalation and Risk Management: Assess incident impact and associated risks, ensuring significant issues are appropriately escalated and relevant decision-makers are engaged.\nIncident Communications: Coordinate internal and client-related incident communications, preparing clear and timely status updates, management briefings and executive summaries, in collaboration with Legal and relevant stakeholders.\nDocumentation and Reporting: Maintain comprehensive incident records, including timelines, investigation findings, decisions, response actions and supporting evidence. Prepare incident closure reports and regular management reporting.\nPost-Incident Review: Coordinate root cause analysis and lessons-learned reviews, ensuring corrective and preventive actions are identified, assigned and tracked through completion.\nContinuous Improvement: Identify recurring incident patterns and opportunities to improve incident management processes, escalation procedures, response readiness and overall operational effectiveness.\n Essential Skills and Experience\nProven experience in cybersecurity incident management, incident response coordination or a similar information security role.\nStrong understanding of the security incident lifecycle, including investigation, containment, remediation, recovery and post-incident review.\nGood technical understanding of common cybersecurity threats, including malware, phishing, compromised accounts, unauthorised access, data breaches and insider threats.\nDemonstrated ability to coordinate complex incidents involving multiple technical, business and management stakeholders.\nAbility to interpret technical investigation findings and translate them into business risks, impacts and actionable management information.\nStrong understanding of incident classification, escalation procedures, risk management and evidence preservation.\nExcellent organisational, analytical and problem-solving skills, with the ability to manage multiple priorities and maintain oversight of ongoing incidents.\nExcellent written and verbal communication skills, including experience preparing incident reports and communicating with senior management.\nAbility to remain calm, objective and effective under pressure while handling sensitive and confidential information.\nDesirable Skills and Experience\nExperience working within a Security Operations Centre (SOC), Incident Response Team or enterprise information security function.\nFamiliarity with security technologies such as SIEM, EDR/XDR, threat intelligence and incident management platforms.\nUnderstanding of information security frameworks and standards, particularly ISO 27001 and recognised incident management practices.\nExperience coordinating external forensic investigations or incident response providers.\nExperience managing incidents involving personal data, client information or contractual and regulatory obligations.\nRelevant professional certifications such as CISM, CISSP, GCIH or equivalent.\nPersonal Attributes\nStrong sense of ownership, accountability and attention to detail.\nExcellent stakeholder management, communication and coordination skills.\nCalm and decisive under pressure, with sound judgement in complex situations.\nProactive, analytical and solution-oriented approach.\nHigh standards of confidentiality, professionalism and integrity.\n Discover some of the global benefits that empower our people to become the best version of themselves:\nFinance: Competitive salary package, share plan, company performance bonuses, value-based recognition awards, referral bonus; \nCareer Development: Career coaching, global career opportunities, non-linear career paths, internal development programmes for management and technical leadership;\nLearning Opportunities: Complex projects, rotations, internal tech communities, training, certifications, coaching, online learning platforms subscriptions, pass-it-on sessions, workshops, conferences;\nWork-Life Balance: Hybrid work and flexible working hours, employee assistance programme;\nHealth: Global internal wellbeing programme, access to wellbeing apps;\n Community: Global internal tech communities, hobby clubs and interest groups, inclusion and diversity programmes, events and celebrations.\nAt Endava, we’re committed to creating an open, inclusive, and respectful environment where everyone feels safe, valued, and empowered to be their best. We welcome applications from people of all backgrounds, experiences, and perspectives-because we know that inclusive teams help us deliver smarter, more innovative solutions for our customers. Hiring decisions are based on merit, skills, qualifications, and potential. If you need adjustments or support during the recruitment process, please let us know.","description_format":"text","description_chars":7084,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Flexible schedule","Hybrid work"],"hiring_locations":[{"name":"Romania","iso":"RO","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Consulting & Digital Transformation","IT Outsourcing & Dedicated Teams","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-11-04T15:56:24Z"}],"visa":[],"liveness":{"score":70,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.695,"p_room":1,"age_days":1,"expected_fill_days":26,"reasons":["conf:3","stale_co","wave","velocity","win:early","comp:brand"],"computed_at":"2026-11-06T05:58:05Z"},"pay":null,"html_url":"https://alion.io/job/endava-security-incident-manager","json_url":"https://alion.io/job/endava-security-incident-manager.json","meta":{"generated_at":"2026-11-06T15:55:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":29657,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6702},"rest":"https://alion.io/mcp/rest/get_company?id=6702"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fendava-security-incident-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fendava-security-incident-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fendava-security-incident-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/endava-security-incident-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fendava-security-incident-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3752900}},{"tool":"search_jobs","arguments":{"company":"endava.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3752900},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}