Cybersecurity Incident Response Commander

The Role

This position serves as the primary technical and operational authority for a Digital Forensics and Incident Response function, commanding engagements across ransomware, business email compromise, data exfiltration, and complex multi-vector incidents. The role owns IR processes and playbooks, leads active client engagements, and coaches analysts to strengthen team capability.

Skills & Experience

Candidates must bring extensive hands-on experience personally commanding complex incident response and digital forensics engagements. Demonstrated expertise across major threat scenarios is essential, alongside an externally recognised profile as a subject-matter expert in DFIR. Familiarity with structured IR frameworks and retainer-based service delivery is expected.

Who It Suits

This role suits a seasoned incident response professional who thrives as a technical authority rather than a traditional people manager, remaining composed and decisive under pressure. Someone who enjoys owning processes, influencing without formal authority, and being a visible SME in the broader cybersecurity community will find this role rewarding.