Head of Incident Response

This is a fully remote position, open to applicants in Philippines.

📋 Description

• Take charge of the operational execution of the NCSC CREST accredited Cyber Incident Response service.

• Establish standards for customer onboarding, incident management, investigation, reporting, and post-incident reviews.

• Supervise the performance of CIR Leads during engagements, ensuring that delivery aligns with the scope, commitments, and client expectations.

• Ensure the team is equipped with the necessary tools, documentation, playbooks, and processes.

• Oversee the quality assurance of investigation reports and client deliverables.

• Implement service enhancements based on feedback, lessons learned, and changes in the threat landscape.

• Report on service performance, capacity constraints, delivery risks, and improvement priorities to the Operations Director.

• Maintain oversight of ongoing engagements and identify incidents that require additional support or escalation.

• Actively participate in complex incidents and simultaneous engagements, providing leadership and technical support.

• Assist CIR Leads with challenging response decisions, executive communications, and sensitive client situations.

• Handle client technical escalations and seek appropriate resolutions.

• Aid in defining the scope of incident response engagements and clarifying client needs, dependencies, and limitations.

• Meet newly signed clients to introduce the service, set expectations, and assist in the onboarding transition.

• Ensure that retained customer onboarding meets the required standards and identify any response-readiness gaps.

• Directly manage, support, and develop CIR Leads.

• Evaluate demand against team capacity and identify gaps in coverage, capability, and resilience.

• Prepare business cases for additional hiring and support interview and candidate assessment processes.

• Coordinate additional SecOps support while ensuring the delivery of the MXDR service.

• Facilitate the development, training, and incident-response participation of SecOps team members.

• Monitor workload and provide effective cover and handovers during prolonged or simultaneous engagements.

⛳️ Requirements

• Proven experience in leading significant cybersecurity incidents, including complex investigations, multidisciplinary response teams, and senior stakeholder communications.

• Experience in managing or overseeing a client-facing incident response capability, with accountability for delivery quality and service enhancement.

• Ability to confidently communicate with executive and board-level stakeholders, translating technical findings into business impacts, response options, and decisions.

• Strong client management abilities, including conflict resolution and maintaining constructive relationships during disruptive or sensitive incidents.

• Capability to lead and develop experienced responders while providing appropriate challenges, support, and direction.

• Strong judgment in prioritizing competing engagements and balancing incident response demands against broader operational commitments.

• Experience in assessing resource requirements and presenting clear, evidence-based business cases to senior management.

• Excellent written communication and quality assurance skills, including reviewing incident reports, executive summaries, and remediation recommendations.

• Professional discretion and sound judgment when handling sensitive information, investigation evidence, and uncertain findings.

• Extensive practical experience responding to ransomware, business email compromise, identity compromise, malware infections, and suspected data exfiltration.

• Ability to directly contribute to investigations and response activities while providing technical oversight and incident leadership.

• Ability to assess and challenge investigative findings, identify evidence gaps, and direct analysis to establish the incident scope, attack progression, and business impact.

• Strong understanding of Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services, and common network technologies.

• Experience using SIEM, EDR, and identity telemetry to investigate and correlate activities across endpoints, accounts, and cloud services.

• Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement, and command-and-control communications.

• Ability to evaluate containment, eradication, and recovery options, taking into account business dependencies, operational consequences, evidence preservation, and client approval requirements.

• Understanding of secure evidence handling and chain-of-custody principles, including recognizing when specialist forensic support is necessary.

• Ability to evaluate how telemetry coverage, retention, and licensing limitations impact response readiness, investigative confidence, and conclusions.

• Practical understanding of NIST SP 800-61 and MITRE ATT&CK frameworks.

• Desirable: experience managing incident response delivery within a consultancy or managed security service provider.

• Desirable: familiarity with Microsoft Sentinel, Microsoft Defender XDR, and KQL, along with other enterprise security platforms.

• Desirable: experience in developing incident response services, delivery processes, playbooks, and quality standards.

• Desirable: experience conducting preparedness workshops, tabletop exercises, and incident response plan reviews.

• Desirable: experience coordinating with legal advisors, cyber insurers, specialist forensic providers, and crisis communications teams.

• Desirable: awareness of data protection and regulatory considerations.

• Desirable: relevant qualifications such as GCIH, GCFA, CISSP, or CISM.

• Desirable: opportunities for ITIL 4 knowledge or certification.

🏝️ Benefits

• Fully remote work arrangement.

• Opportunity to work with Microsoft security technologies, including Defender XDR, Sentinel, Entra, Purview, Intune, and Copilot for Security.

• Professional development through leadership, technical expertise, knowledge sharing, and training support.

• Support for training and participation in incident response activities.

• Exposure to complex cybersecurity incidents, enterprise clients, and senior stakeholders.

• Potential support for relevant qualifications such as GCIH, GCFA, CISSP, or CISM (listed as desirable).

• Opportunities for ITIL 4 knowledge or certification (listed as desirable).