Senior Manager: Incident Response

SGS is the world’s leading inspection, verification, testing and certification company. SGS is recognized as the global benchmark for quality and integrity. With more than 97,000 employees, SGS operates a network of over 2,600 offices and laboratories around the world.

Purpose of the role

To lead CyberCom's incident response investigations as the most senior hands-on investigator in the team, and to manage the IR team day to day. The role leads complex investigations personally, directs and reviews the work of other responders, and is accountable for the accuracy, defensibility and timeliness of every investigation the team delivers. It is a people- and quality-focused management role; commercial targets and practice P&L sit elsewhere.

Key responsibilities

1. Senior investigation and incident leadership

• Lead complex and high-severity investigations hands-on: ransomware and double extortion, business email compromise, cloud and identity compromise, insider threat and data theft.
• Carry out and direct host, memory, network, log and cloud forensic analysis, reconstruct attacker timelines and establish root cause, scope of access and data exposure.
• Act as Incident Leader on major engagements: set investigative priorities, coordinate containment and recovery workstreams, and keep a defensible decision log.
• Formulate and test investigative hypotheses, and make sure conclusions are supported by evidence and clearly separated from assumptions.
• Support with briefing of client executives, breach counsel and insurers on findings in plain language, without overstating what the evidence shows.
• Write and review investigation reports, executive summaries and findings; sign off all reports before release.

2. Team management

• Manage the IR team directly: allocate cases, set priorities, track progress and balance workloads across active investigations.
• Run the on-call roster and escalation process, and approve leave, overtime and time off in lieu after major incidents.
• Conduct regular one-on-ones, set objectives, run performance reviews and manage underperformance in line with HR policy.
• Coach and mentor responders through case reviews and peer analysis, and own individual development and certification plans.
• Take part in recruitment, onboarding and induction of new team members, and build a succession bench for senior roles.
• Monitor team wellbeing and fatigue during long incidents, and keep on-call sustainable.
• Report on team activity, case status and resourcing to [Head of Operations / MD].

3. Methodology, quality and tooling

• Maintain the IR methodology, playbooks and checklists in line with NIST SP 800-61 Rev. 3, ISO/IEC 27035 and the practice's 17-service catalogue.
• Ensure evidence handling and chain of custody meet ISO/IEC 27037 and court standards, working with the Cyanre lab on acquisitions and analysis.
• Run post-incident reviews internally and with clients, and feed lessons into playbooks, detections and threat-hunting hypotheses.
• Evaluate and govern the IR tool stack (EDR, forensic suites, log platforms, SOAR) and keep the team current on attacker TTPs (MITRE ATT&CK).
• Support the group's ISO 27001 programme and any IR accreditations the group pursues (e.g. CREST CSIR).

4. Client engagement

• Serve as the senior technical point of contact for clients during investigations.
• Give sales and account management technical input on scoping, effort estimates and statements of work.
• Build working relationships with breach counsel, insurers and law enforcement contacts.

5. Legal, regulatory and expert work

• Prepare affidavits and expert reports, and testify where engagements move to litigation or criminal proceedings, with handoff to Lextrado EDS for litigation support.
• Make sure work under legal privilege is set up and documented correctly from the outset.

Key performance indicators

• Quality of investigations: findings that hold up to peer, client and legal review, and QA defects found after release.
• Time to engage on retainer incidents against contracted SLAs.
• Report turnaround time against agreed deadlines.
• Client satisfaction with investigations led or supervised.
• Team retention, performance review completion, certification progress and succession readiness.
• Playbook and methodology updates delivered from post-incident reviews.

Minimum requirements

• 10+ years in cyber security, with at least 7 years hands-on in incident response, digital forensics or cyber investigations.
• At least 3 years managing a technical team, including case allocation, performance management and staff development.
• A track record as lead investigator on ransomware and enterprise-wide compromises, from initial triage through root cause and final report.
• Expert, hands-on skill in Windows, Linux and cloud forensics (Microsoft 365/Entra ID, Azure, AWS), memory analysis, log and timeline analysis, and EDR-led investigations.
• Proficiency with standard forensic tooling (e.g. Magnet AXIOM, EnCase, X-Ways, Velociraptor, KAPE, Volatility) and scripting for analysis (Python or PowerShell).
• Rigorous evidence handling, chain of custody and report writing that holds up to legal scrutiny.
• Working knowledge of POPIA, the Cybercrimes Act and how notification and privilege work in South Africa.
• At least one senior IR or forensics certification: GIAC GCFA, GCIH, GCFE, GNFA or equivalent.
• Relevant degree or diploma in computer science, information security or digital forensics, or equivalent experience.
• Able to pass criminal record, credit and qualification checks; valid driver's licence and willingness to travel to client sites at short notice.

Advantageous

• GIAC GCIM (SANS LDR553), CREST CCIM, CISM or CISSP.
• PCI Forensic Investigator (PFI) experience, or experience delivering PCI forensic investigations.
• Prior expert witness or court testimony experience in South Africa.
• Malware analysis or reverse engineering (e.g. GREM).
• Mobile forensics experience (e.g. Cellebrite).
• Experience working on insurer or breach-counsel panels.
• Exposure to OT/ICS incidents or AI-related security incidents.

Competencies

• Investigative rigour: follows the evidence, tests alternative explanations and states the limits of what is known.
• Calm command: makes clear decisions on incomplete information and keeps a team and a client steady through long incidents.
• Communication: turns technical findings into business risk for executives, lawyers and insurers, in speech and writing.
• Integrity and defensibility: documents decisions, and doesn't overstate findings.
• People management: sets clear expectations, gives direct feedback, develops responders and holds standards without burning the team out.

Working conditions

• Incident work is unpredictable: extended hours, weekends and on-site attendance during major incidents are part of the role.
• On-call participation and escalation oversight, with time off in lieu after major engagements.
• Travel within South Africa, and occasionally regionally, as engagements require.