Cyber Incident Response Team Lead (CSIRT)

Blends hands-on incident command and digital forensics with programmatic capability building. Establishes the CSIRT operating model, creates scenario playbooks (ransomware, exfiltration) from scratch, and leads technical containment/recovery during active security events.

My client is a well established business, looking for a hands-on CSIRT Lead to establish and run the cyber incident response capability across a complex, multi-site industrial and corporate estate. The role blends hands-on incident command and digital forensics coordination with the programmatic build-out of incident playbooks and operational runbooks from scratch.

• Lead end-to-end response during active security events, coordinating technical triage, containment, forensic investigation, and recovery.

• Build out the internal CSIRT operating model, defining runbooks for high-impact scenarios (e.g., ransomware, supply chain compromise, data exfiltration).

• Coordinate crisis response communications across internal business functions, legal counsel, PR, and external regulatory bodies.

• Conduct thorough post-incident reviews (PIRs) to extract root cause lessons and drive continuous security control improvements.

• Proven background in incident command, digital forensics, or high-pressure incident triage.

• Experience building or maturing incident response frameworks and runbooks.

• Incident response designations such as GCIH, GCFA, GNFA, or CREST qualifications are highly desirable.

Robert Walters Operations Limited is an employment business and employment agency and welcomes applications from all candidates