> Markdown version of [/jobs/ext/2446348-director-dso-uk-data-incident-investigations-strategic-lead-permanent](https://www.wearedevelopers.com/jobs/ext/2446348-director-dso-uk-data-incident-investigations-strategic-lead-permanent). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Director - DSO - UK Data Incident Investigations Strategic Lead - Permanent - **Company:** Ernst & Young - **Location:** London, UK - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Software Documentation, Cyber Security - **Published:** August 11, 2026 - **Apply:** https://uk.indeed.com/viewjob?jk=bc318df48340de8c ## About the Role * Strong leadership and experience in incident triage/operational risk delivery: able to set standards, drive consistency and lead through ambiguity under time pressure. * Senior stakeholder management capability across technical and risk functions, enabling coordinated response and effective escalation. * Excellent written and verbal communication, able to produce executive-ready briefings and high-quality MI outputs. * Strong operational rigour with a continuous improvement mindset, able to improve processes, templates, standards and reporting routines. To qualify, you must have * Professional experience delivering triage, incident management or comparable risk-based workflow delivery. * Experience interviewing insider risk actors, witnesses and impacted individuals across both digital and human domains. * An incident investigation professional training or certification, e.g., GIAC Incident Handler. * Expertise in producing structured reporting/MI outputs and maintaining disciplined documentation standards. * Experience of working in a professional services firm or partnership would be beneficial, e.g., understanding of complex matrix organisations, working with colleagues in other functions/organisations or indirect relationships. * A passion for security and technology and identifying and solving problems. * Motivation, commitment and the desire to continue to learn and develop. ## Description * Own and lead the triage operating model to ensure consistent validation, classification, prioritisation and escalation across all suspected data incidents, including any significant data incidents, operating in a confidential environment. * Provide senior oversight on complex or high-severity incidents, ensuring early assessment quality is sufficient to inform governance and downstream investigation. * Set expectations and quality standards for triage execution (minimum information standards, MI integrity and hand-off requirements). * Ensure coordinated incident response through clear engagement pathways and structured hand-offs with relevant stakeholder groups including Privacy, InfoSec, Forensics, Legal, Talent, and Leadership. * Act as the senior escalation authority for complex triage and severity decisions, directly making or arbitrating prioritisation, classification and response decisions and engaging senior stakeholders where required to resolve risk, timing or ownership trade-offs. * Own, operate and evolve incident MI reporting as a core capability, setting the data model and standards, chairing governance routines and using MI directly to challenge performance, drive decisions and prioritise actions across the incident portfolio. * Identify and act on systemic weaknesses observed during live incidents, directly driving changes to standards, controls and ways of working to improve response quality, speed and discipline. * Lead engagement with senior executives and governance forums on data incidents, presenting insights, trends and recommendations, escalating material risks and securing decisions on risk acceptance, remediation priorities and control changes. * Represent the Data Incident function in senior forums, contributing insights, trend analysis and recommendations to influence organisational risk posture. ## Related Videos - [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management) - [Humanizing Your Documentation](https://www.wearedevelopers.com/videos/476-humanizing-your-documentation) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Why Is Software Documentation Still Static – And Why Modern Browsers Deserve Better](https://www.wearedevelopers.com/videos/2054-why-is-software-documentation-still-static-and-why-modern-browsers-deserve-better) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk) - [UK Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/326-uk-business-culture-and-etiquette) - [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)