Head of Security Operations & Incident Response

We are seeking a skilled Cybersecurity Operations and Incident Response leader to enhance and oversee our security operations, incident management, and cyber resilience initiatives.

This position will be responsible for the comprehensive detection, investigation, and response to cybersecurity incidents, ensuring effective management from the initial identification through to containment, remediation, root-cause analysis, and post-incident enhancements.

We encourage applicants with backgrounds in Security Operations, SOC, Cyber Defence, Incident Response, Threat Detection & Response, or Digital Forensics to apply.

Key Responsibilities

• Direct the Security Operations and Incident Management functions, ensuring proficient monitoring, investigation, escalation, and response to cybersecurity events and incidents.
• Serve as the primary escalation point for major and complex cyber incidents, facilitating coordination among technical teams and relevant stakeholders during containment, remediation, and recovery efforts.
• Conduct root-cause analysis and post-incident reviews, pinpointing control, technology, and process deficiencies, and ensuring the implementation of corrective measures.
• Promote ongoing improvement of Incident Response frameworks, SOPs, playbooks, and escalation procedures.
• Enhance and fortify SOC/Security Operations capabilities in the areas of monitoring, detection, investigation, and response.
• Collaborate with Threat Intelligence, Threat Hunting, Infrastructure, Cloud, Application, and Cybersecurity teams to bolster detection and response capabilities.
• Assist with digital forensic investigations as necessary; while deep forensic expertise is beneficial, it is not mandatory.
• Identify avenues for enhancing security operations through automation, SIEM, EDR/XDR, security analytics, and emerging technologies.
• Conduct cyber incident exercises and simulations to enhance organizational readiness and resilience.
• Develop operational metrics and reporting that encompass incident trends, response effectiveness, root causes, and improvement areas.
• Guide, mentor, and develop Cybersecurity Operations and Incident Response professionals.
• Engage with senior management and business stakeholders during significant cybersecurity incidents, effectively communicating technical risks and business implications.

Requirements:

• Applicants should possess experience managing substantial cybersecurity incidents and a robust understanding of the end-to-end incident lifecycle, which includes investigation, containment, remediation, recovery, and root-cause analysis.
• Experience leading a SOC, Security Operations, Cyber Defence, or Incident Response team is highly valued.
• A solid grasp of SIEM, EDR/XDR, security monitoring, threat detection, and incident-response technologies, along with familiarity with frameworks like MITRE ATT&CK, Cyber Kill Chain, and NIST CSF is essential.
• Strong stakeholder management and communication skills are critical, including the ability to coordinate various technical teams and effectively communicate with senior management during significant incidents.
• Relevant certifications such as CISSP, GCIH, GCIA, GCFE, GREM, or equivalent qualifications are preferred.