Incident Response Manager/DFIR Manager
Hays
London, England
The Role
This hands-on management role splits approximately 70% technical delivery and 30% leadership. Day-to-day responsibilities include leading ransomware and business email compromise investigations, overseeing endpoint, cloud and on-premises forensic activity, acting as senior escalation point during live incidents, and communicating findings to clients, legal advisers and cyber insurers. Occasional client travel and weekend on-call coverage are required.
Skills & Experience
Candidates must bring proven experience managing full-lifecycle incident-response engagements, strong knowledge of evidence preservation and chain-of-custody requirements, and practical expertise across forensic tooling — Magnet AXIOM is advantageous. A background in cybersecurity consulting or professional services is expected, alongside experience delivering tabletop exercises and working with legal and insurance stakeholders.
Who It Suits
This role suits a seasoned DFIR consultant ready to step into a player-manager position, combining deep technical expertise with team leadership and client-facing confidence. It is not suited to traditional IT incident managers or those whose experience is limited to SOC alert triage. Prior people-management or substantial mentoring experience is essential.
Typical advertised salary for Incident Response roles in United Kingdom: £58,000–£90,000 (median £70,000 — from 33 recent listings analysed by Forensic Focus).
Learn More/Apply
