{"id":4168432,"url":"https://alion.io/job/sgs-senior-manager-incident-response","title":"Senior Manager: Incident Response","company":{"id":3634,"name":"SGS","domain":"sgs.com","url":"https://alion.io/company/sgs","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":75,"open_postings":631,"ghost_share":0,"stale_share":0.997,"repost_share":0,"time_to_fill_p50_days":34,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Centurion, South Africa"],"countries":["ZA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"EnCase","optional":false},{"name":"ISO 27001","optional":false},{"name":"KAPE","optional":false},{"name":"Linux","optional":false},{"name":"Magnet AXIOM","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Velociraptor","optional":false},{"name":"Volatility","optional":false},{"name":"Windows","optional":false},{"name":"X-Ways Forensics","optional":false}],"status":"live","first_seen_at":"2026-11-12T12:33:02Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-14T04:14:37Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"SGS is the world’s leading inspection, verification, testing and certification company. SGS is recognized as the global benchmark for quality and integrity. With more than 97,000 employees, SGS operates a network of over 2,600 offices and laboratories around the world.\n Purpose of the role\nTo lead CyberCom's incident response investigations as the most senior hands-on investigator in the team, and to manage the IR team day to day. The role leads complex investigations personally, directs and reviews the work of other responders, and is accountable for the accuracy, defensibility and timeliness of every investigation the team delivers. It is a people- and quality-focused management role; commercial targets and practice P&L sit elsewhere.\nKey responsibilities\n1. Senior investigation and incident leadership\nLead complex and high-severity investigations hands-on: ransomware and double extortion, business email compromise, cloud and identity compromise, insider threat and data theft.\nCarry out and direct host, memory, network, log and cloud forensic analysis, reconstruct attacker timelines and establish root cause, scope of access and data exposure.\nAct as Incident Leader on major engagements: set investigative priorities, coordinate containment and recovery workstreams, and keep a defensible decision log.\nFormulate and test investigative hypotheses, and make sure conclusions are supported by evidence and clearly separated from assumptions.\nSupport with briefing of client executives, breach counsel and insurers on findings in plain language, without overstating what the evidence shows.\nWrite and review investigation reports, executive summaries and findings; sign off all reports before release.\n2. Team management\nManage the IR team directly: allocate cases, set priorities, track progress and balance workloads across active investigations.\nRun the on-call roster and escalation process, and approve leave, overtime and time off in lieu after major incidents.\nConduct regular one-on-ones, set objectives, run performance reviews and manage underperformance in line with HR policy.\nCoach and mentor responders through case reviews and peer analysis, and own individual development and certification plans.\nTake part in recruitment, onboarding and induction of new team members, and build a succession bench for senior roles.\nMonitor team wellbeing and fatigue during long incidents, and keep on-call sustainable.\nReport on team activity, case status and resourcing to [Head of Operations / MD].\n3. Methodology, quality and tooling\nMaintain the IR methodology, playbooks and checklists in line with NIST SP 800-61 Rev. 3, ISO/IEC 27035 and the practice's 17-service catalogue.\nEnsure evidence handling and chain of custody meet ISO/IEC 27037 and court standards, working with the Cyanre lab on acquisitions and analysis.\nRun post-incident reviews internally and with clients, and feed lessons into playbooks, detections and threat-hunting hypotheses.\nEvaluate and govern the IR tool stack (EDR, forensic suites, log platforms, SOAR) and keep the team current on attacker TTPs (MITRE ATT&CK).\nSupport the group's ISO 27001 programme and any IR accreditations the group pursues (e.g. CREST CSIR).\n4. Client engagement\nServe as the senior technical point of contact for clients during investigations.\nGive sales and account management technical input on scoping, effort estimates and statements of work.\nBuild working relationships with breach counsel, insurers and law enforcement contacts.\n5. Legal, regulatory and expert work\nPrepare affidavits and expert reports, and testify where engagements move to litigation or criminal proceedings, with handoff to Lextrado EDS for litigation support.\nMake sure work under legal privilege is set up and documented correctly from the outset.\nKey performance indicators\nQuality of investigations: findings that hold up to peer, client and legal review, and QA defects found after release.\nTime to engage on retainer incidents against contracted SLAs.\nReport turnaround time against agreed deadlines.\nClient satisfaction with investigations led or supervised.\nTeam retention, performance review completion, certification progress and succession readiness.\nPlaybook and methodology updates delivered from post-incident reviews.\n Minimum requirements\n10+ years in cyber security, with at least 7 years hands-on in incident response, digital forensics or cyber investigations.\nAt least 3 years managing a technical team, including case allocation, performance management and staff development.\nA track record as lead investigator on ransomware and enterprise-wide compromises, from initial triage through root cause and final report.\nExpert, hands-on skill in Windows, Linux and cloud forensics (Microsoft 365/Entra ID, Azure, AWS), memory analysis, log and timeline analysis, and EDR-led investigations.\nProficiency with standard forensic tooling (e.g. Magnet AXIOM, EnCase, X-Ways, Velociraptor, KAPE, Volatility) and scripting for analysis (Python or PowerShell).\nRigorous evidence handling, chain of custody and report writing that holds up to legal scrutiny.\nWorking knowledge of POPIA, the Cybercrimes Act and how notification and privilege work in South Africa.\nAt least one senior IR or forensics certification: GIAC GCFA, GCIH, GCFE, GNFA or equivalent.\nRelevant degree or diploma in computer science, information security or digital forensics, or equivalent experience.\nAble to pass criminal record, credit and qualification checks; valid driver's licence and willingness to travel to client sites at short notice.\nAdvantageous\nGIAC GCIM (SANS LDR553), CREST CCIM, CISM or CISSP.\nPCI Forensic Investigator (PFI) experience, or experience delivering PCI forensic investigations.\nPrior expert witness or court testimony experience in South Africa.\nMalware analysis or reverse engineering (e.g. GREM).\nMobile forensics experience (e.g. Cellebrite).\nExperience working on insurer or breach-counsel panels.\nExposure to OT/ICS incidents or AI-related security incidents.\n Competencies\nInvestigative rigour: follows the evidence, tests alternative explanations and states the limits of what is known.\nCalm command: makes clear decisions on incomplete information and keeps a team and a client steady through long incidents.\nCommunication: turns technical findings into business risk for executives, lawyers and insurers, in speech and writing.\nIntegrity and defensibility: documents decisions, and doesn't overstate findings.\nPeople management: sets clear expectations, gives direct feedback, develops responders and holds standards without burning the team out.\nWorking conditions\nIncident work is unpredictable: extended hours, weekends and on-site attendance during major incidents are part of the role.\nOn-call participation and escalation oversight, with time off in lieu after major engagements.\nTravel within South Africa, and occasionally regionally, as engagements require.","description_format":"text","description_chars":6942,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Testing, Inspection & Certification"],"lifecycle":[{"event":"open","at":"2026-11-12T14:03:44Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":34,"reasons":["conf:1","win:early","comp:brand"],"computed_at":"2026-11-14T06:07:41Z"},"pay":null,"html_url":"https://alion.io/job/sgs-senior-manager-incident-response","json_url":"https://alion.io/job/sgs-senior-manager-incident-response.json","meta":{"generated_at":"2026-11-14T06:07:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10331,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3634},"rest":"https://alion.io/mcp/rest/get_company?id=3634"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsgs-senior-manager-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsgs-senior-manager-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsgs-senior-manager-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sgs-senior-manager-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsgs-senior-manager-incident-response"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4168432}},{"tool":"search_jobs","arguments":{"company":"sgs.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4168432},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}