Incident Response Team Leader

About the role

The Incident Response Team Leader will head the cybersecurity incident response function, guiding investigations from detection through recovery across customer and enterprise environments. This senior position provides technical direction, operational oversight, and strategic guidance while acting as the primary escalation point for major security events.

Key responsibilities

• Lead end‑to‑end incident response engagements, including ransomware attacks, data breaches and major security incidents.
• Direct technical response teams, coordinate containment, eradication, recovery and remediation activities, and serve as incident commander.
• Oversee complex investigations involving malware outbreaks, insider threats, targeted attacks and data exfiltration.
• Validate findings, deliver response recommendations and support digital forensics when required.
• Mentor and develop Incident Response Analysts, manage performance and drive capability growth.
• Act as the primary customer‑facing lead, provide executive briefings and ensure compliance with regulatory and NCSC requirements.
• Develop and maintain incident response frameworks, playbooks, runbooks and lead tabletop exercises.
• Conduct post‑incident reviews, capture lessons learned and improve cyber‑resilience.

Required profile

• Bachelor’s degree in Information Technology or a related field.
• Minimum 5 years of experience in cybersecurity, with a strong background in incident response.
• Proven leadership experience managing technical response teams.
• Excellent communication skills for stakeholder and executive interaction.

Required skills

• Malware analysis
• Ransomware response
• Data breach investigation
• Digital forensics
• Incident response frameworks
• Playbook and runbook development