Cyber Incident Response Manager

About the role

We are supporting an organisation that needs an experienced Cyber Incident Response Manager to lead and mature its incident response capability across a complex enterprise environment. You will own the end‑to‑end handling of cyber incidents, work closely with SOC and threat intelligence teams, and drive continuous improvement of the service.

Key responsibilities

• Own and manage cyber incidents from detection through resolution in both IT and OT environments.
• Review, enhance and develop incident response frameworks, runbooks and playbooks.
• Integrate alerts from SIEM, EDR, CTI and SOC services into response processes.
• Lead tabletop exercises, testing activities and capability‑building initiatives.
• Collaborate with SOC, Threat Intelligence, Technology and Business teams to ensure effective response.
• Support day‑to‑day incidents while also developing strategic improvements.

Required profile

• Proven experience leading incident response in large enterprise environments.
• Demonstrated ability to manage and resolve cyber incidents.
• Strong background creating, reviewing and improving runbooks and playbooks.
• Experience designing or enhancing incident response frameworks.
• Track record of running tabletop exercises.
• Deep understanding of SIEM, EDR, SOC and threat intelligence integration.

Required skills

• Microsoft Sentinel
• Microsoft Defender for Endpoint
• Recorded Future
• Darktrace
• Microsoft Purview
• ThreatLocker

What we offer

• Day rate of £750‑£800 (outside IR35).
• Initial 6‑month contract with the possibility of extension.
• Hybrid working model based in Liverpool.