Head of Incident Response

Job not on LinkedIn

🔥 9 minutes ago

🇵🇭 Philippines – Remote

⏰ Full Time

🔴 Lead

👻 Ghost score 14%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Just posted.
• Jobs at this company usually fill in 42 days.
• No salary listed.

Apply Now

Find Similar Remote Jobs

CyberOne

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2005

🔒 Cybersecurity

🤝 B2B

Cybersecurity • B2B

CyberOne is a UK-based cybersecurity services company that provides 24x7 managed detection and response, incident response, Microsoft security integrations, penetration testing, cloud security, and professional consulting to help organisations build measurable cyber resilience. They deliver AI-augmented MXDR and other managed security services powered by Microsoft technologies, focusing on rapid detection, containment, compliance and continuous risk reduction for enterprise and regulated sectors.

📋 Description

• Own the operational delivery of the NCSC CREST accredited Cyber Incident Response service • Set standards for customer onboarding, incident management, investigation, reporting and post-incident review • Oversee CIR Lead performance during engagements and ensure delivery meets scope, commitments and client expectations • Ensure the team has appropriate tools, documentation, playbooks and processes • Oversee quality assurance of investigation reports and client deliverables • Use feedback, lessons learned and threat-landscape changes to implement service improvements • Report service performance, capacity constraints, delivery risks and improvement priorities to the Operations Director • Maintain oversight of active engagements and identify incidents requiring additional support or escalation • Participate directly in complex incidents and concurrent engagements, providing leadership and technical assistance • Support CIR Leads with difficult response decisions, executive communications and sensitive client situations • Own client technical escalations and seek appropriate resolutions • Assist with scoping incident response engagements and clarifying client needs, dependencies and limitations • Meet newly signed clients to introduce the service, establish expectations and support transition into onboarding • Ensure retained customer onboarding meets the required standard and identify response-readiness gaps • Directly manage, support and develop CIR Leads • Assess demand against team capacity and identify coverage, capability and resilience gaps • Prepare business cases for additional hiring and support interviews and candidate assessment • Coordinate additional SecOps support while maintaining delivery of the MXDR service • Support development, training and incident-response participation of SecOps team members • Monitor workload and support effective cover and handovers during prolonged or concurrent engagements

🎯 Requirements

• Demonstrable experience leading significant cyber security incidents, including complex investigations, multidisciplinary response teams and senior stakeholder communications • Experience managing or overseeing a client-facing incident response capability, with responsibility for delivery quality and service improvement • Ability to communicate confidently with executive and board-level stakeholders, translating technical findings into business impact, response options and decisions • Strong client management skills, including resolving escalations and maintaining constructive relationships during disruptive or sensitive incidents • Ability to lead and develop experienced responders while providing appropriate challenge, support and direction • Strong judgement when prioritising competing engagements and balancing incident response requirements against wider operational commitments • Experience assessing resource requirements and presenting clear, evidence-based business cases to senior management • Excellent written communication and quality assurance skills, including reviewing incident reports, executive summaries and remediation recommendations • Professional discretion and sound judgement when handling sensitive information, investigation evidence and uncertain findings • Strong practical experience responding to ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration • Ability to contribute directly to investigations and response activities, alongside providing technical oversight and incident leadership • Ability to assess and challenge investigative findings, identify evidence gaps and direct analysis to establish incident scope, attack progression and business impact • Strong understanding of Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies • Experience using SIEM, EDR and identity telemetry to investigate and correlate activity across endpoints, accounts and cloud services • Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications • Ability to assess containment, eradication and recovery options, considering business dependencies, operational consequences, evidence preservation and client approval requirements • Understanding of secure evidence handling and chain-of-custody principles, including recognising when specialist forensic support is required • Ability to assess how telemetry coverage, retention and licensing limitations affect response readiness, investigative confidence and conclusions • Practical understanding of NIST SP 800-61 and MITRE ATT&CK • Desirable: experience managing incident response delivery within a consultancy or managed security service provider • Desirable: experience with Microsoft Sentinel, Microsoft Defender XDR and KQL, alongside familiarity with other enterprise security platforms • Desirable: experience developing incident response services, delivery processes, playbooks and quality standards • Desirable: experience delivering preparedness workshops, tabletop exercises and incident response plan reviews • Desirable: experience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams • Desirable: awareness of data protection and regulatory considerations • Desirable: relevant qualifications such as GCIH, GCFA, CISSP or CISM • Desirable: ITIL 4 knowledge or certification

🏖️ Benefits

• Fully remote work arrangement • Opportunity to work with Microsoft security technologies, including Defender XDR, Sentinel, Entra, Purview, Intune and Copilot for Security • Professional development through leadership, technical expertise, knowledge sharing and training support • Support for training and participation in incident response activities • Exposure to complex cyber security incidents, enterprise clients and senior stakeholders • Potential support for relevant qualifications such as GCIH, GCFA, CISSP or CISM (listed as desirable) • ITIL 4 knowledge or certification opportunities (listed as desirable)

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume