Head of Incident Response

About CyberOne

CyberOne is a pure-play Microsoft security partner dedicated to helping enterprises realise the full value of the Microsoft Security portfolio - across Defender XDR, Sentinel, Entra, Purview, Intune, Copilot for Security and more. We combine deep technical expertise with outcome-driven services that accelerate secure cloud adoption, modernise threat protection and simplify compliance.

Job Title:Head of Incident Response

Location:Remote

Employment Type:Full time

Role purpose

The Head of Incident Response is accountable for the management, quality and continual improvement of CyberOne’s National Cyber Security Centre (NCSC) Cyber Incident Response (CIR) Standard Level service.

The role ensures that Cyber Incident Response Leads have the direction, tools, processes and support needed to deliver effective retained customer onboarding, incident response engagements and preparedness activities.

Alongside service leadership, the Head of Incident Response retains an active operational capability, supporting concurrent engagements and contributing directly where incidents require additional leadership, technical expertise or response capacity.

Service ownership and quality

• Own the operational delivery of the NCSC CREST accredited CIR service, ensuring clear standards for customer onboarding, incident management, investigation, reporting and post-incident review.
• Oversee CIR Lead performance during engagements, providing direction and support to ensure delivery meets agreed scope, service commitments and client expectations.
• Ensure the team has appropriate tools, documentation, playbooks and processes to deliver the service effectively.
• Oversee the quality assurance of investigation reports and client deliverables, ensuring conclusions are supported by evidence, limitations are clearly explained and recommendations are practical and prioritised.
• Use engagement feedback, lessons learned and changes in the threat landscape to identify and implement service improvements.
• Report service performance, capacity constraints, delivery risks and improvement priorities to the Operations Director.

Operational leadership and client engagement

• Maintain oversight of active engagements, identifying incidents that require additional support, management intervention or escalation.
• Participate directly in complex incidents and support concurrent engagements, providing incident leadership and technical assistance as required.
• Support CIR Leads with difficult response decisions, executive communications and sensitive client situations.
• Take ownership of IR client technical escalations and seek resolutions with the best interests of both parties.
• Assist with scoping IR engagements, clarifying client needs, delivery requirements, dependencies and service limitations.
• Meet newly signed clients with the assigned CIR lead to introduce the service, establish expectations and support an effective transition into onboarding.
• Ensure retained customer onboarding is completed to an appropriate standard and that the team can identify and communicate gaps affecting response readiness.

People and resource management

• Directly manage, support and develop the CIR Leads, promoting consistent delivery, effective collaboration and knowledge sharing.
• Assess current and anticipated demand against team capacity, identifying gaps in coverage, capability and resilience.
• Prepare business cases for additional hiring and support interviews and candidate assessment following approval.
• Work with the SecOps Manager to coordinate additional SecOps support, ensuring resource allocation considers the continued delivery of the MXDR service.
• Support the development of SecOps team members who contribute to incident response, agreeing training and participation with their management.
• Monitor workload and support effective cover and handovers during prolonged or concurrent engagements.

Essential professional requirements

• Demonstrable experience leading significant cyber security incidents, including complex investigations, multidisciplinary response teams and senior stakeholder communications.
• Experience managing or overseeing a client-facing incident response capability, with responsibility for delivery quality and service improvement.
• Ability to communicate confidently with executive and board-level stakeholders, translating technical findings into business impact, response options and decisions.
• Strong client management skills, including resolving escalations and maintaining constructive relationships during disruptive or sensitive incidents.
• Ability to lead and develop experienced responders while providing appropriate challenge, support and direction.
• Strong judgement when prioritising competing engagements and balancing incident response requirements against wider operational commitments.
• Experience assessing resource requirements and presenting clear, evidence-based business cases to senior management.
• Excellent written communication and quality assurance skills, including reviewing incident reports, executive summaries and remediation recommendations.
• Professional discretion and sound judgement when handling sensitive information, investigation evidence and uncertain findings.

Essential technical requirements

• Strong practical experience responding to incidents such as ransomware, business email compromise, identity compromise, malware infections and suspected data exfiltration.
• Ability to contribute directly to investigations and response activities, alongside providing technical oversight and incident leadership.
• Ability to assess and challenge investigative findings, identify evidence gaps and direct analysis to establish incident scope, attack progression and business impact.
• Strong understanding of enterprise environments, including Windows, Active Directory, Microsoft Entra ID, Microsoft 365, cloud services and common network technologies.
• Experience using SIEM, EDR and identity telemetry to investigate and correlate activity across endpoints, accounts and cloud services.
• Understanding of attacker techniques involving credential theft, session compromise, persistence, privilege escalation, lateral movement and command-and-control communications.
• Ability to assess containment, eradication and recovery options, considering business dependencies, operational consequences, evidence preservation and client approval requirements.
• Understanding of secure evidence handling and chain-of-custody principles, including recognising when specialist forensic support is required.
• Ability to assess how telemetry coverage, retention and licensing limitations affect response readiness, investigative confidence and conclusions.
• Practical understanding of incident response guidance and threat frameworks, particularly NIST SP 800-61 and MITRE ATT&CK.

Desirable experience and qualifications

• Experience managing incident response delivery within a consultancy or managed security service provider.
• Experience with Microsoft Sentinel, Microsoft Defender XDR and KQL, alongside familiarity with other enterprise security platforms.
• Experience developing incident response services, delivery processes, playbooks and quality standards.
• Experience delivering preparedness workshops, tabletop exercises and incident response plan reviews.
• Experience coordinating with legal advisers, cyber insurers, specialist forensic providers and crisis communications teams.
• Awareness of data protection and regulatory considerations, including recognising when clients require specialist legal or privacy advice.
• Relevant qualifications such as GCIH, GCFA, CISSP or CISM. Equivalent practical experience is equally valued.
• ITIL 4 knowledge or certification, particularly in relation to incident, problem and change management.

Accountability and authority

The Head of Incident Response owns the operational management, delivery standards and continual improvement of the IR service. CIR Leads remain responsible for leading their assigned engagements, supported by the Head where additional oversight or operational assistance is required.

Where you can be based

This position is 100% remote and open to applicants based in United Kingdom and Philippines.