> Markdown version of [/jobs/ext/2488655-cyber-security-incident-manager](https://www.wearedevelopers.com/jobs/ext/2488655-cyber-security-incident-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Security Incident Manager - **Company:** SEP2 - **Location:** Leeds, UK (Remote available) - **Contract:** Permanent contract - **Skills:** Cyber Security, Linux, Digital Forensics, Issue Tracking Systems, Security Information and Event Management, Wireshark, Wintel, Malware, Imager, Splunk - **Published:** August 27, 2026 - **Apply:** https://uk.indeed.com/viewjob?jk=46b58c69f3924027 ## About the Role * Experience working in a similar role * Successful completion of industry certification relating to DFIR (e.g SANS, GIAC etc) * A solid technical background, having worked with a variety of technologies, such as public cloud, Linux, Wintel and a solid networking background * Experiencing in operating the following (or equivalent) tooling: Velociraptor, Wireshark, Autopsy, Cuckoo (Or sandboxing equivalent), FTK Imager & Kape * SIEM investigative capabilities (e.g. Google SecOps, SPLUNK, Sentinel) * Excellent written and verbal communication skills * Previous experience in a customer facing role PERSON SPECIFICATION * Methodical and cool headed * The ability to follow pre-documented processes and procedures as requested, as well as communicating effectively where improvements can be made, * Self-motivation to learn, improve and keep up to date with technologies and concepts within the security industry. * A 'Can-do' attitude * You have the drive to perform and excel * You are a team player that thrives in supporting others ## Description SEP2 requires an experienced Incident Manager to support our customers' growing needs in high quality Digital Forensics and Incident Response (DFIR) services. Working for one of the UKs fastest-growing specialists in Cyber Security products and services, the successful candidate will work within Wingman Security Operations, our core customer-facing team, and will be responsible for supporting leading security solutions and services for our clients. Reporting directly to the Head of Information Security, the successful candidate will need to not only be technically minded but also be adept at bringing confidence and direction to our customers during stressful incidents. This position can be performed remotely, with some travel on occasion to our Leeds office. KEY TASKS * Respond to incidents in a structured manner * Provide direction to analysts responding to incidents * Perform technical activities such as image handling, malware analysis and deep log reviews * Coordinate/Provide guidance to high value incidents with external Customer teams * Coordinate and escalate situations into internal teams * Write up post-incident reports for customer incidents * Manage onboarding customers into the Wingman DFIR service * Work within the SOC to manage Cyber Security solutions defending customer infrastructure from exploitation and cyber-attacks * Deliver high-quality technical support via phone/email and our ticketing system * Participate in the on-call rota for DFIR * Offer and feed into continual service improvement initiatives for operations of the DFIR Service ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [A practical guide to writing secure Dockerfiles](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles) - [Docker build without Docker](https://www.wearedevelopers.com/videos/100114-docker-build-without-docker) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)