CERT Lead

The Role

This role leads a team of six DFIR specialists acting as the city’s primary escalation point for high-profile cybersecurity incidents. Day-to-day responsibilities include directing investigations involving log, file, malware, memory, disk and network forensics, overseeing cloud incident response across AWS, Azure and GCP, and coordinating remediation with city agencies and external partners around the clock.

Skills & Experience

Candidates need deep practical expertise across the full incident response lifecycle, including digital forensics, malware analysis, threat hunting, and enterprise cloud environments. Experience working with cyber threat intelligence teams, designing tabletop exercises, and developing detection capabilities is expected. A relevant degree and at least four years of qualifying experience are required.

Who It Suits

This position suits a seasoned DFIR practitioner ready to step into a leadership role within government cybersecurity. Those with experience managing technical teams, engaging with law enforcement or federal partners, and operating within large, complex organisational environments will find this role a strong fit.