Incident Response Lead

This is a fully remote position, open to applicants in Philippines.

📋 Description

• Oversee cyber incident response operations from the initial assessment and mobilization through recovery, reporting, and post-incident evaluation

• Determine incident severity, known scope, business implications, and immediate priorities, updating assessments as new evidence becomes available

• Collaborate with internal technical teams, client teams, and third-party providers, setting actions, responsibilities, and timelines

• Facilitate war room meetings and maintain regular communication with technical teams, senior management, and board-level stakeholders

• Convert technical findings into business risks, response alternatives, and recommendations

• Organize containment, eradication, and recovery efforts while taking into account operational dependencies, evidence preservation, and client approvals

• Keep incident timelines, decision logs, action trackers, and handover records up to date

• Deliver engagements within the defined scope and service commitments, escalating capacity issues, delivery risks, and additional needs to the Head of Incident Response

• Create and ensure the quality of investigation reports and post-incident reviews

• Assist clients in preparedness through incident response plan evaluations, onboarding workshops, and tabletop exercises

• Mentor SecOps team members training to become cross-functional responders

• Enhance playbooks, templates, and delivery processes based on lessons learned from engagements

• Manage assigned engagements within delegated authority; provide insights and recommendations to support client decisions regarding risk acceptance, operational changes, recovery, and legal or regulatory matters

⛳️ Requirements

• Proven experience leading significant cyber security incidents, including coordinating technical response efforts and managing client relations

• Capability to lead multidisciplinary teams in high-pressure scenarios, even when responders do not report directly to this role

• Effective communication with executive and board-level stakeholders, including articulating uncertainties, operational risks, and complex response decisions

• Strong judgment and prioritization skills, with the capacity to make timely recommendations based on incomplete information and escalate decisions as necessary

• Experience managing stakeholder expectations and fostering constructive relationships during disruptive or sensitive incidents

• Outstanding written communication skills, with a background in producing clear incident reports, executive summaries, and actionable remediation suggestions

• High level of organizational discipline, including maintaining precise records, managing competing priorities, and facilitating effective handovers

• Professional discretion and sound judgment when managing sensitive client information and investigative evidence

• Practical experience in responding to ransomware, business email compromise, identity theft, malware infections, and suspected data exfiltration

• Comprehensive understanding of incident response processes, including preparation, detection, investigation, containment, eradication, recovery, and continuous improvement

• Ability to assess and challenge technical findings, identify investigative gaps, and direct further analysis to clarify scope, attack progression, and business impact

• Familiarity with enterprise environments, including Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services, and common network technologies

• Experience utilizing SIEM, EDR, and identity telemetry to facilitate investigations, including correlating activities across endpoints, accounts, and cloud services

• Understanding of attacker methodologies involving credential theft, session compromise, persistence, privilege escalation, lateral movement, and command-and-control communications

• Capacity to evaluate containment and recovery strategies, including their operational implications, dependencies, and possible impacts on evidence

• Knowledge of evidence preservation, secure handling of evidence, and chain-of-custody principles, including recognizing when specialist forensic support is needed

• Awareness of telemetry, retention, and licensing limitations, along with the ability to explain how these factors influence investigative confidence and conclusions

• Practical understanding of incident response guidelines and threat frameworks, particularly NIST SP 800-61 and MITRE ATT&CK

• Experience delivering incident response within a consultancy, managed security service provider, or similar client-facing setting

• Familiarity with Microsoft Sentinel, Microsoft Defender XDR, and KQL, as well as other enterprise security platforms

• Experience in conducting incident preparedness workshops, tabletop exercises, and post-incident reviews

• Experience collaborating with legal advisors, cyber insurers, specialist forensic providers, and crisis communication teams

• Understanding of data protection and regulatory considerations, including recognizing when clients need legal or privacy advice

• Relevant certifications such as GCIH, GCFA, CISSP, or CISM are desirable; equivalent practical experience is equally valued

• ITIL 4 knowledge or certification is a plus

• Ability to work remotely from the Philippines

🏝️ Benefits

• Fully remote work arrangement

• Mentoring and training opportunities to develop into cross-disciplinary responders