Manager, Incident Response

Role overview Lead and mature a digital forensics and incident response (DFIR) practice based in the United Kingdom, combining people management with hands-on technical leadership during high-stakes investigations. The position is responsible for delivering complex incident response services across ransomware, business email compromise, cyber extortion, and large-scale recovery engagements while maintaining operational excellence.

Responsibilities - Manage, mentor, and develop a hybrid/remote team of DFIR professionals, including hiring, onboarding, performance reviews, career planning, and succession activities. - Oversee the end-to-end delivery of incident response services, scoping incoming matters, assigning personnel, balancing workloads, and stepping in as an escalation point during active engagements. - Establish operational standards, quality assurance mechanisms, KPIs, and reporting capabilities that drive consistent, scalable outcomes and continuous improvement. - Review incident reports, executive summaries, and customer deliverables to validate findings and ensure technical accuracy before release. - Lead advanced forensic investigations across Windows, Linux, macOS, Azure, AWS, and Google Cloud environments, guiding containment, eradication, recovery, and remediation activities. - Contribute to practice growth through process development, knowledge sharing, and collaboration with broader security operations stakeholders.

Requirements - Demonstrated experience managing incident response or DFIR teams, including remote or hybrid personnel across multiple regions. - Deep technical expertise in host, network, cloud, and log-based forensic analysis during major incidents such as ransomware or extortion events. - Strong working knowledge of investigative tooling across enterprise operating systems and major cloud platforms. - Proven ability to lead complex customer engagements, communicate findings to technical and executive audiences, and validate investigative conclusions produced by a team. - Track record of building operational processes, service metrics, and quality assurance practices in a security services or managed detection context. - Relevant professional background in cybersecurity, with eligibility to meet any applicable export control or background check requirements.

Nice to have - Experience shaping training, mentoring, or peer-review programs that broaden team exposure to varied investigative work.

Benefits and work setup - Hybrid/remote working arrangements based in the United Kingdom. - Compensation package including base salary, variable incentive, and equity for all employees. - 28 days annual leave plus 8 bank holidays and paid volunteering days. - Pension plan with employer match and a comprehensive private benefits plan covering medical, optical, dental, life insurance, and income protection. - Fertility support, paid parental leave, employee assistance programme with mental health services, and structured training and career development programmes.