Incident Response Lead - Technology & Transformation

Are you someone who enjoys getting into the detail of a cyber investigation but also has the experience and confidence to lead when things get serious? We're working with a specialist cybersecurity organisation that helps businesses navigate complex security challenges, respond to cyber incidents and strengthen their defences against evolving threats. They're looking for an experienced Incident Response Lead to join their team. This is a great opportunity for someone who enjoys the technical side of incident response but is ready to take on more ownership, lead complex investigations and work closely with customers during critical security events.

What's involved?

You'll be leading incident response engagements from the initial investigation through to containment and recovery. This means getting hands-on with forensic investigations, understanding how an attacker gained access, identifying the extent of a compromise and helping customers work out what needs to happen next. The role will also involve proactive threat hunting and compromise assessments, looking beyond the obvious to identify suspicious activity and threats that may have gone undetected. Alongside the technical work, you'll be a key point of contact for customers, helping them understand what's happening, providing clear advice and keeping stakeholders informed when the pressure is on. You'll also have the opportunity to mentor other team members, share your knowledge and help improve the way the team approaches incident response and threat hunting.

What we're looking for

We're keen to speak with people who have a strong background in incident response and digital forensics, and who are comfortable taking the lead on complex investigations. You'll ideally have:

• Experience leading cyber incident response engagements, ideally across different customer environments.
• Strong hands-on experience in digital forensics and investigations across endpoint, network and cloud environments.
• Experience with threat hunting and compromise assessments, including identifying threats that have bypassed existing security controls.
• A good understanding of attacker behaviour, threat intelligence and frameworks such as MITRE ATT&CK.
• Knowledge of incident response frameworks such as NIST and SANS, and the ability to apply these in real-world situations.
• The ability to identify what went wrong, understand the impact and recommend practical steps to prevent it happening again.
• Confidence communicating technical findings to both technical teams and senior stakeholders.
• Experience supporting or mentoring other security professionals and contributing to better processes and ways of working.

Most importantly, we're looking for someone who can combine strong technical skills with the ability to lead people, manage customer relationships and make good decisions under pressure.

Why consider it?

This isn't a role where you'll simply be overseeing a SOC team or managing incident response from a distance. You'll be involved in the investigations yourself, working through challenging security incidents and helping customers when they need specialist expertise most. You'll be joining a specialist cybersecurity business with a strong focus on incident response, threat hunting and helping organisations become more resilient to cyber threats. It's an opportunity to work across varied environments, tackle complex technical challenges and have a real influence on how incidents are handled. If you're looking for a role where you can stay technically hands-on while taking on more leadership and responsibility, this could be worth a conversation. Next Steps? To keep things simple, we ask that all applications are submitted through this advert. We’ll review applications as they come in and be in touch. For any questions give Paulina a call on and quote Job ID: 18837 for a confidential chat. To apply for this vacancy, you MUST be a New Zealand citizen, resident, or have already secured the right to work in New Zealand and therefore hold a valid visa. At the appropriate stage we will request your references, we ask that you do not include them on your CV when applying.