Head of Incident Response

About the Role

CyberOne is seeking a Head of Incident Response to lead the delivery of their NCSC CREST-accredited Cyber Incident Response service. This role is essential for upholding high-quality standards in client onboarding, intricate investigations, and professional reporting. You will oversee a team of incident response leads, ensuring that engagements meet client expectations while providing both technical and strategic guidance. The position focuses on enhancing organizational resilience through the application of AI-driven managed security services and Microsoft-based technologies. Reporting to the Operations Director, you will manage team development, identify capacity requirements, drive service improvements based on threat intelligence, and provide critical support during high-stakes engagements.

Requirements

• Qualified candidates must possess demonstrable experience leading significant cyber security incidents, including complex investigations and multidisciplinary response teams.
• You need strong expertise in communicating with executive and board-level stakeholders, specifically translating technical findings into business impact.
• Your background should include managing client-facing incident response capabilities and demonstrating excellent written communication skills for quality assurance of reports.
• A deep practical understanding of Windows, Active Directory, Microsoft 365, and cloud services is essential, as is experience with SIEM and EDR telemetry.
• You must be adept at responding to threats like ransomware, business email compromise, and data exfiltration while adhering to NIST SP 800-61 and MITRE ATT&CK frameworks.
• Furthermore, the role requires strong judgement when prioritizing competing engagements, assessing resource needs, and presenting evidence-based business cases to leadership.
• Desirable qualifications include GCIH, GCFA, CISSP, or CISM certifications, as well as prior experience in a consultancy or managed security service provider environment.

Responsibilities

• The Head of Incident Response is responsible for setting and maintaining standards for incident management, investigation, and reporting.
• You will oversee quality assurance for all client deliverables and ensure the team is equipped with effective documentation and playbooks.
• A major part of the role involves actively managing client relationships, including meeting new clients to establish expectations and handling technical escalations during sensitive incidents.
• You will also participate directly in complex, concurrent engagements to provide leadership and support.
• Internally, you will manage staff performance, coordinate additional support from the security operations team, and handle the business side of the service by preparing hiring cases and monitoring team capacity.
• By analyzing feedback from past incidents, you will continuously drive service improvements and ensure that retained customer onboarding processes meet high professional standards.

Benefits & Perks

• This position offers a fully remote work arrangement, allowing for flexibility in a global work environment.
• Employees gain significant exposure to complex cybersecurity incidents and interaction with enterprise-level stakeholders.
• The role provides professional development opportunities through leadership coaching, technical expertise sharing, and active training support.
• Furthermore, staff have the chance to work with a comprehensive suite of Microsoft security technologies, such as Defender XDR, Sentinel, Entra, and Copilot for Security, and may receive support for obtaining relevant industry certifications like GCIH, GCFA, CISSP, CISM, or ITIL 4.