Hays
Incident Response Manager/DFIR Manager
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Your new company
You will join an established international cybersecurity services organisation providing digital forensics, incident response, and post-breach support to clients worldwide.
Operating through a global follow-the-sun model, the organisation is expanding its regional leadership capability in response to continued growth. This is a remote UK role, with a preference for candidates based around London, Birmingham, or Manchester, and occasional client-site travel.
Your new role
As Incident Response Manager, you will lead complex DFIR engagements while managing and developing a regional team of approximately six to seven professionals. This is a highly hands-on role, with around 70% of your time focused on technical delivery. You will lead ransomware and business email compromise investigations, oversee activity across endpoint, cloud, and on-premises environments, and act as a senior escalation point during live incidents.
You will communicate findings and recommendations to clients, legal advisers, insurers, and internal stakeholders. You will also mentor team members, facilitate client tabletop exercises, and provide technical support during selected sales engagements.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
What you'll need to succeed
You will be an experienced, client-facing DFIR professional with:
- Strong experience of ransomware and business email compromise investigations.
- Experience managing full-lifecycle incident-response engagements.
- A background in cybersecurity consulting or professional services.
- Practical experience across endpoint, cloud, and on-premises investigations.
- Previous people-management, team-leadership, or substantial mentoring experience.
- Confidence advising senior clients during high-pressure incidents.
- Experience working with legal advisers, cyber insurers, or other third parties.
- Experience delivering incident-response tabletop exercises.
- Strong knowledge of evidence preservation and chain-of-custody requirements.
- Experience with recognised forensic tools. Magnet AXIOM knowledge would be advantageous, although equivalent experience will be considered.
- Flexibility to participate in weekend on-call coverage and occasional client travel.
This role will not suit a traditional IT Incident Manager or someone whose Incident Response experience is limited to SOC alert handling.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
What you'll get in return
- Performance-related bonus, generally between 3% and 5%.
- Remote working within the UK.
- Pension contributions after three months.
- Employer-paid health cover, including optical and dental benefits.
- A telephone allowance.
- Paid weekend on-call coverage and additional payment for active incident work.
- The opportunity to lead a regional DFIR team and work on complex international investigations.
What you need to do now
If you're interested in this role, click 'apply now' to forward an up-to-date copy of your CV, or call us now. If this job isn't quite right for you, but you are looking for a new position, please contact us for a confidential discussion about your career.
Hays Specialist Recruitment Limited acts as an employment agency for permanent recruitment and employment business for the supply of temporary workers. By applying for this job you accept the T&C's, Privacy Policy, and Disclaimers which can be found at hays.co.uk
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location