Incident Response Team Leader

About the role

The Incident Response Team Leader drives the end‑to‑end handling of cybersecurity incidents, from detection through recovery, across customer and enterprise environments. This senior position provides technical direction, operational oversight, and strategic guidance to ensure rapid, coordinated response to major threats.

Key responsibilities

• Lead incident response engagements, acting as incident commander for ransomware attacks, data breaches and other high‑severity events.
• Coordinate containment, eradication, recovery and remediation activities across endpoint, network and cloud environments.
• Oversee complex investigations involving malware, insider threats, targeted attacks and data exfiltration.
• Mentor and develop Incident Response Analysts, manage performance, and support recruitment.
• Serve as primary customer‑facing lead, delivering executive briefings and status updates.
• Ensure compliance with NCSC licensing and reporting requirements.
• Develop and maintain response frameworks, playbooks, runbooks and conduct tabletop exercises.
• Lead post‑incident reviews and drive continuous improvement of cyber‑resilience.

Required profile

• Bachelor's degree in Information Technology or a related field.
• Minimum 5 years of cybersecurity experience, including at least 3 years in incident response.
• Valid NCSC‑approved IR certification (e.g., ECIH, CCIM, Blue Team Level 2) or equivalent.
• Proven ability to lead technical teams under pressure and communicate effectively with senior stakeholders.

Required skills

• Incident triage and containment.
• Digital forensics and malware investigation.
• Ransomware and data breach response.
• Endpoint, network and cloud security expertise.
• Incident response frameworks, playbooks and runbooks.
• Tabletop exercise design and execution.
• NCSC compliance and reporting.

What we offer

• Opportunity to shape the organization’s cyber‑resilience strategy.
• Leadership role with high visibility across customers and executive teams.
• Continuous professional development and certification support.