Cyber Incident Response Team Lead (CSIRT)

About the role

Our client, a well‑established multi‑site industrial and corporate business, is seeking a hands‑on CSIRT Lead to design, launch and run a cyber incident response capability. The role blends active incident command, digital forensics coordination and the creation of scenario‑based playbooks and runbooks from scratch.

Key responsibilities

• Lead end‑to‑end response during active security events, managing technical triage, containment, forensic investigation and recovery.
• Build the internal CSIRT operating model and author runbooks for high‑impact scenarios such as ransomware, supply‑chain compromise and data exfiltration.
• Coordinate crisis communications across business units, legal, PR and external regulatory bodies.
• Conduct post‑incident reviews to capture root‑cause lessons and drive continuous improvement of security controls.

Required profile

• Proven background in incident command, digital forensics or high‑pressure incident triage.
• Experience building or maturing incident response frameworks and playbooks.
• Relevant certifications (e.g., GCIH, GCFA, GNFA, CREST) are highly desirable.

Required skills

• Incident response
• Digital forensics

What we offer

• Competitive day‑rate (GBP 500‑600) on a full‑time or contractor basis.
• Opportunity to shape a strategic security function within a complex organisation.