Incident Response Lead

This leadership role sits at the heart of a global CERT and DFIR operation, guiding teams through the full incident response lifecycle — from initial detection and triage through containment, remediation, and post-incident review. Day to day, the position involves identifying indicators of compromise, coordinating cross-functional response teams during active security events, and overseeing the design and execution of client incident response plans. The role also carries responsibility for mentoring analysts, developing processes and tooling, and delivering KPI reporting to drive continuous improvement. Supporting 24/7 coverage is essential. Strong candidates will bring deep forensic investigation experience, sound judgment under pressure, and proven leadership in high-stakes environments. Experience within a CERT or DFIR consultancy context and relevant industry certifications would be advantageous. This position suits a seasoned practitioner ready to step into a strategic leadership role with meaningful client impact.