Lead IT Specialist (Cybersecurity Incident Response)

The Role

This position leads end-to-end cybersecurity incident response activities, covering triage, investigation, containment, eradication, and recovery. Day-to-day work includes analysing logs across endpoints, networks, cloud, and applications, performing digital forensics across multiple device types, communicating with stakeholders, and contributing to SOAR automation and playbook development.

Skills & Experience

Candidates require strong log analysis skills spanning EDR telemetry, network traffic, cloud audit trails, and application logs, alongside hands-on digital forensics experience covering endpoints, servers, mobile devices, and cloud environments. Critical thinking, clear communication of technical concepts, and familiarity with SOAR platforms are essential to this role.

Who It Suits

This role suits an experienced incident responder ready to take a leadership position within a formal CIRT structure. Someone who is comfortable guiding decision-makers under pressure, conducting thorough root cause analysis, and translating complex technical findings into actionable recommendations for both technical and non-technical stakeholders will thrive here.