Incident Response Lead

🔥 1 hour ago

🇵🇭 Philippines – Remote

⏰ Full Time

🟠 Senior

👻 Ghost score 14%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Just posted.
• Jobs at this company usually fill in 42 days.
• No salary listed.

Apply Now

Find Similar Remote Jobs

CyberOne

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2005

🔒 Cybersecurity

🤝 B2B

Cybersecurity • B2B

CyberOne is a UK-based cybersecurity services company that provides 24x7 managed detection and response, incident response, Microsoft security integrations, penetration testing, cloud security, and professional consulting to help organisations build measurable cyber resilience. They deliver AI-augmented MXDR and other managed security services powered by Microsoft technologies, focusing on rapid detection, containment, compliance and continuous risk reduction for enterprise and regulated sectors.

📋 Description

• Lead cyber incident response engagements from initial assessment and mobilisation through recovery, reporting and post-incident review • Establish incident severity, known scope, business impact and immediate priorities, updating assessments as evidence emerges • Coordinate internal technical teams, client teams and third-party providers, setting actions, owners and deadlines • Lead war room meetings and maintain communication cadence with technical teams, senior management and board-level stakeholders • Translate technical findings into business risks, response options and recommendations • Coordinate containment, eradication and recovery activities while considering operational dependencies, evidence preservation and client approvals • Maintain incident timelines, decision logs, action trackers and handover records • Deliver engagements within agreed scope and service commitments, escalating capacity constraints, delivery risks and additional requirements to the Head of Incident Response • Produce and quality-assure investigation reports and post-incident reviews • Support client preparedness through incident response plan reviews, onboarding workshops and tabletop exercises • Mentor SecOps team members training to become cross-disciplinary responders • Improve playbooks, templates and delivery processes using engagement lessons • Coordinate assigned engagements within delegated authority; provide information and recommendations supporting client decisions on risk acceptance, operational changes, recovery and legal or regulatory matters

🎯 Requirements

• Demonstrable experience leading significant cyber security incidents, including coordinating technical response activities and managing client communications • Ability to lead multidisciplinary teams during high-pressure situations, including where responders do not report directly to the role • Confident communication with executive and board-level stakeholders, including explaining uncertainty, operational risk and difficult response decisions • Strong judgement and prioritisation, with the ability to make timely recommendations using incomplete information and escalate decisions appropriately • Experience managing stakeholder expectations and maintaining constructive relationships during disruptive or sensitive incidents • Excellent written communication, with experience producing clear incident reports, executive summaries and actionable remediation recommendations • Strong organisational discipline, including maintaining accurate records, managing competing priorities and providing effective handovers • Professional discretion and sound judgement when handling sensitive client information and investigation evidence • Practical experience responding to ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration • Strong understanding of incident response activities, including preparation, detection, investigation, containment, eradication, recovery and continuous improvement • Ability to assess and challenge technical findings, identify gaps in an investigation and direct further analysis to establish scope, attack progression and business impact • Working knowledge of enterprise environments, including Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies • Experience using SIEM, EDR and identity telemetry to support investigations, including correlating activity across endpoints, accounts and cloud services • Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications • Ability to evaluate containment and recovery options, including their operational consequences, dependencies and potential effects on evidence • Understanding of evidence preservation, secure evidence handling and chain-of-custody principles, including recognising when specialist forensic support is required • Ability to recognise telemetry, retention and licensing limitations and explain how these affect investigative confidence and conclusions • Practical understanding of incident response guidance and threat frameworks, particularly NIST SP 800-61 and MITRE ATT&CK • Experience delivering incident response within a consultancy, managed security service provider or other client-facing environment • Experience with Microsoft Sentinel, Microsoft Defender XDR and KQL, alongside familiarity with other enterprise security platforms • Experience delivering incident preparedness workshops, tabletop exercises and post-incident reviews • Experience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams • Awareness of data protection and regulatory considerations, including recognising when clients require legal or privacy advice • Relevant qualifications such as GCIH, GCFA, CISSP or CISM are desirable; equivalent practical experience is equally valued • ITIL 4 knowledge or certification is desirable • Ability to work remotely from the Philippines

🏖️ Benefits

• Fully remote work arrangement • Mentoring and training opportunities to become cross-disciplinary responders

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume