Cyber Incident Response Commander (Contract)
Prefer a full account with a password? Sign Up to Apply
Job Description
Overview of the role
The Cyber Incident Response Commander leads the response to information security incidents within our client’s Computer Emergency Response Team (CERT). Reporting to the Incident Response Manager, you will take command when incidents occur: bringing business and technical teams together, assessing severity, coordinating containment and recovery, and keeping leadership informed. Between incidents, you will strengthen the client’s Incident Response Plan, playbooks and processes so the organisation is ready for the next one. This role calls for calm leadership under pressure, sound judgement and the ability to communicate clearly with everyone from analysts to executives.
Mission timeline
• Expected start date: January 4, 2027
• Expected end date: December 31, 2027
Key Responsibilities
• Act as Incident Commander during security incidents, bringing business and technical units to the table to coordinate an effective response
• Assess incident severity, analyse and prioritise incidents, and formally declare major incidents based on risk and regulatory criteria
• Manage incidents in line with the Incident Response Plan (IRP) and playbooks, ensuring each team member operates within their defined responsibilities and collaborates effectively
• Prioritise forensic activities and follow mitigation and recovery efforts through to resolution
• Communicate, notify and report on incidents to stakeholders, management and executives
• Maintain the IRP and its appendices, keeping it current and aligned with other plans and policies in effect
• Refine incident playbooks and write scope-specific IRPs (e.g., vessels, regions, subsidiaries)
• Work with legal and communications departments to improve incident response processes
• Gather lessons learned, establish links between incidents and recommend improvements
• Provide evidence to internal and external auditors
• Contribute to Cyber Defense Center collaboration activities and to CERT-related projects, improvements and compliance efforts
Requirements
Department: Cyber Security
Function: Information Technology
Experience Level: Mid-Senior Level