Responsibilities
- Oversee the full incident response lifecycle, maintaining preparedness through updated playbooks, tools, and decision frameworks
- Direct security incident responses, serving as incident commander when needed, coordinating communications, forensic analysis, and recovery efforts
- Manage the full lifecycle of the MSSP partnership, including service definitions, performance metrics, escalation protocols, and service enhancements
- Enhance security monitoring and response systems by collaborating with technology teams on SIEM, SOAR, EDR/XDR, NDR, and email security platforms
- Lead the vulnerability management program covering on-premises and cloud environments, ensuring timely scanning, prioritization, remediation, and validation
- Operationalize threat intelligence to shape defensive strategies, including detection rules, system hardening, control improvements, and proactive hunting initiatives
- Improve the security defence ecosystem by streamlining tools, refining detection logic, enhancing alert quality, minimizing noise, and increasing automation
- Develop and manage a proactive threat hunting program using hypothesis-based methods, telemetry analysis, and insights from past incidents and red team exercises
- Conduct regular incident simulation exercises, including tabletop drills for ransomware and cloud breaches, to validate and refine response procedures
- Own the governance of incident response, including severity classification, on-call protocols, escalation workflows, evidence handling, and legal compliance
- Define and track key cyber defence metrics such as detection and response times, alert accuracy, incident trends, remediation rates, and control coverage
- Lead post-incident reviews and root cause investigations to drive measurable improvements in detection, security controls, identity management, backups, and training
- Support crisis and business continuity efforts during cyber incidents, providing input for executive briefings and cross-functional coordination with Legal and Privacy teams
- Maintain and evolve incident response documentation, including playbooks, runbooks, and contact lists, and ensure training is delivered to technical and business teams
- Communicate cyber risks and active incidents clearly to both technical teams and non-technical stakeholders, delivering concise executive summaries and after-action reports
