Incident Response Manager

Job Description

The Incident Response Manager is responsible for leading the cybersecurity incident response program for clients. This role ensures rapid detection, containment, eradication, and recovery from security incidents while minimizing business impact. The manager will coordinate across IT, security, legal, and executive teams, and act as the primary point of contact during cyber crises.

Key Responsibilities

Incident Response Leadership

• Lead the response to cybersecurity incidents, including triage, containment, eradication, and recovery.
• Coordinate communication between technical teams, executives, and external stakeholders.

Monitoring & Detection

• Oversee security monitoring tools (SIEM, IDS/IPS, endpoint detection).
• Ensure timely detection of suspicious activity and potential breaches.

Investigation & Forensics

• Direct forensic analysis of compromised systems.
• Preserve evidence for legal or regulatory purposes.
• Document root cause analysis and lessons learned.

Collaboration & Communication

• Work closely with IT, legal, compliance, and executive leadership during incidents.
• Provide clear, concise updates to stakeholders.
• Liaise with external partners such as law enforcement, regulators, and vendors.

Training & Preparedness

• Conduct incident response drills and tabletop exercises.
• Train staff on security awareness and escalation procedures.
• Continuously improve incident response capabilities.

Policy & Compliance

• Ensure compliance with data protection laws (e.g., POPIA in South Africa, GDPR if applicable).
• Maintain alignment with industry standards (ISO 27001, NIST Cybersecurity Framework).

Qualifications

• Bachelor's degree in Computer Science and Informatics
• Honours degree in Computer Science (Specialising in Cybersecurity)
• GIAC Certified Forensic Analyst (GCFA)
• 3+ years of experience in incident response, SOC operations, or cybersecurity management.
• Strong knowledge of network security, malware analysis, and digital forensics.
• Familiarity with regulatory frameworks (POPIA, GDPR, PCI DSS).
• Excellent leadership, communication, and crisis management skills.

Additional Information

Core Competencies

• Analytical thinking and problem-solving under pressure.
• Ability to manage multiple incidents simultaneously.
• Strong leadership and team coordination skills.
• Clear communication with both technical and non-technical audiences