Operations · Security Operations
About this role
We are looking for an Incident Response Lead to join our Security Operations department.
You will lead the people who own our most serious cases end to end — coordinating ransomware and business email compromise investigations, doing the forensic work, and being the person on the phone when a client needs a straight answer under real pressure.
Your first responsibility is people, not just process. You’re a first-line manager distinct from a senior individual contributor, with direct accountability for the performance and development of your team — while carrying enough hands-on DFIR credibility to run the most complex case yourself, or take over one mid-flight, when the situation demands it.
What you will do
- Lead, coach, and develop the Incident Response team: regular one-to-ones, feedback, and performance/development conversations aligned with Eye’s career framework
- Lead by doing: manage the caseload and the people, but personally take point on the most complex or highest-profile incidents when needed
- Own end-to-end incident response service quality: case intake and coordination, technical execution, client communication, and closure/reporting
- Own delivery KPIs (time-to-containment, case-report quality and timeliness, client satisfaction on incident cases) and step in to unblock the team or personally lead a case when targets are at risk
- Manage on-call and case-lead rostering and workload across the team, prioritising by severity and client exposure
- Act as the senior escalation point and, when needed, incident commander for maj