LT Harper Recruitment Group
Cyber Incident Response - Senior Manager
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Cyber Incident Response - Senior Manager
Salary: £92,000 – £108,000 per annum
I am recruiting for an experienced Cyber Incident Response Senior Manager to join my client’s growing Cyber Response Services team within its Risk Consulting practice. Cyber security is a significant area of investment and growth for the client, and this is an excellent opportunity for an experienced incident response professional to take on a senior, hands-on position with a clear path towards broader service line leadership.
The role combines technical incident response and digital forensics with operational leadership, client management, and team development. You will lead the response to complex cyber incidents, manage incident response practitioners and case managers, and work closely with senior cyber response leadership.
You will need significant experience handling complex cyber incidents, including ransomware and advanced network intrusions, alongside strong digital forensics capabilities across areas such as disk, memory, network traffic, and log analysis.
The Role
As Cyber Incident Response - Senior Manager, you will lead and coordinate responses to complex cybersecurity incidents on behalf of clients, often during business-critical situations. You will be expected to guide organisations through the complete incident response lifecycle, including:
- Initial scoping and triage
- Defining investigation and response objectives
- Evidence identification and preservation
- Containment
- Forensic evidence collection and extraction
- Investigation and forensic analysis
- Eradication
- Recovery
- Post-incident review and recommendations
You will manage resources and priorities throughout an incident while providing clear, pragmatic advice to senior client stakeholders. When not actively responding to incidents, you will work with clients to develop and improve their internal cyber response capabilities. This may include developing incident response tools, creating and adapting playbooks and runbooks, assessing incident response maturity, and facilitating cyber scenario and tabletop exercises. You will also contribute to the continued development of the client's own cyber response capability, including tooling, platforms, operational procedures, laboratory environments, orchestration, team development, and delivery efficiency.
Key Responsibilities
- Lead and coordinate complex cybersecurity incident response engagements.
- Manage responses to incidents including ransomware, data compromise, and advanced network intrusions.
- Perform and oversee digital forensic investigations across disk, volatile memory, network traffic, log files, and other relevant evidence sources.
- Lead incident response case managers and technical practitioners during rapid-response engagements.
- Maintain a strong understanding of the evolving cyber threat landscape and advise clients on threats relevant to their organisations.
- Support the development of in-house cyber response and forensic tooling.
- Assess the maturity of clients' incident response capabilities and recommend improvements.
- Help organisations establish or enhance their internal incident response functions.
- Develop incident response plans, procedures, runbooks, and playbooks.
- Support and facilitate cyber incident tabletop and scenario exercises.
- Scope and cost cyber response and forensic engagements.
- Take responsibility for project financial management, engagement management, and risk management.
- Produce and review high-quality technical and executive-level deliverables.
- Manage senior client relationships throughout engagements.
- Support bids, proposals, and responses to RFPs.
- Mentor and develop junior and mid-level cyber response practitioners.
- Contribute to the ongoing development of methodologies, tooling, and operational processes.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Experience Required
My client is looking for an experienced cybersecurity professional with a strong background in incident response and digital forensics.
You should have demonstrable experience leading organizations through complex and potentially unstructured cyber incidents, particularly where priorities and investigative objectives need to be established rapidly.
You should be able to demonstrate:
- Significant experience responding to complex cybersecurity incidents.
- Strong technical competency in digital forensics and incident investigation.
- Experience handling incidents such as ransomware and advanced network intrusions.
- Experience managing or leading rapid-deployment incident response teams.
- A broad understanding of the cyber threat landscape, attacker techniques, and current threat actor activity.
- Strong knowledge of enterprise IT environments, including Windows, Windows Active Directory, Linux, and networking technologies.
- Understanding of enterprise Windows security controls.
- Strong knowledge of networking and network security.
- Experience with evidence preservation, forensic acquisition, and maintaining evidential integrity.
- Experience preserving cloud-based evidence and data.
- Experience handling encrypted systems and technologies such as BitLocker, FileVault, and/or LUKS.
- Strong stakeholder management and communication skills, including the ability to advise clients during high-pressure incidents.
- Strong written communication and report-writing skills.
- Project and engagement management experience.
- The ability to manage multiple concurrent incidents and competing priorities.
- A genuine interest in mentoring and developing junior team members.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Technical Skills
Candidates should have technical proficiency in at least one or more of the following areas:
- Network security, network traffic, and log analysis
- Windows forensic investigation
- Linux and/or macOS/Unix operating system forensics
- Linux/Unix disk forensics, including ext2/3/4, HFS+, and/or APFS
- Advanced memory forensics
- Static and dynamic malware analysis
- Malware reverse engineering
- Advanced mobile device forensics
Experience with industry-standard forensic tooling is highly desirable, including:
- X-Ways
- EnCase
- FTK
- Magnet AXIOM / Internet Evidence Finder (IEF)
- TZWorks
- Cellebrite
Relevant professional certifications are also highly desirable.
General Information Security Certifications:
- CISSP – Certified Information Systems Security Professional
- CISM – Certified Information Security Manager
- CISA – Certified Information Systems Auditor
Incident Response Certifications:
- CREST Certified Incident Manager (CCIM)
- GIAC Certified Incident Handler (GCIH)
Digital Forensics / Intrusion Analysis Certifications:
- CREST Certified Registered Intrusion Analyst (CRIA)
- CREST Certified Network Intrusion Analyst (CCNIA)
- CREST Certified Host Intrusion Analyst (CCHIA)
- CREST Certified Malware Reverse Engineer (CCMRE)
- GIAC Certified Forensic Analyst (GCFA)
- GIAC Network Forensic Analyst (GNFA)
Additional Requirements
Due to the nature of cyber incident response work, candidates must:
- Be willing and able to undertake and obtain UK Security Check (SC) Clearance.
- Be willing to participate in an on-call rota.
- Be flexible regarding working hours when responding to critical incidents.
- Be prepared to travel at short notice.
- Be comfortable with occasional assignments requiring travel for periods of up to 2–3 weeks.
This is an opportunity to join a growing cyber response capability in a genuinely senior position while remaining closely involved in complex technical investigations. The role offers exposure to major cyber incidents, sophisticated threat activity, and senior client stakeholders, alongside the opportunity to shape incident response methodologies, tooling, and team capability.
For someone with a strong technical background who is ready to combine hands-on cyber incident response with team and operational leadership, the position provides a clear opportunity to develop towards senior cyber response and service line leadership.
Salary: £92,000 – £108,000 per annum
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location