> Markdown version of [/jobs/ext/3059036-associate-manager-cyber-security-incident-response](https://www.wearedevelopers.com/jobs/ext/3059036-associate-manager-cyber-security-incident-response). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Associate Manager - Cyber Security Incident Response - **Company:** WTW - **Location:** London, UK - **Salary:** £60,553.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Microsoft Azure, Cyber Security, Computer Telephony Integration, Decision Support Systems, Information Security Management, Machine Learning, Open Web Application Security, Security Information and Event Management, Software Vulnerability Management, Working Model 2D, Large Language Models, Mitre Att&ck, Cybercrime - **Published:** September 25, 2026 - **Apply:** https://www.adzuna.co.uk/jobs/details/5896922495 ## About the Role * Strong work experience in SOC or incident response, with a strong understanding of cybersecurity principles, frameworks, and tools. * Understanding of AI/ML applications in security operations, including AI-augmented detection, triage, and response automation. * Awareness of AI-specific threats and incident types (prompt injection, model/data poisoning, sensitive-data exposure via GenAI), and familiarity with OWASP LLM Top 10 / MITRE ATLAS. * Hands-on cloud incident response across Azure, AWS, and/or GCP, including cloud-native log sources (Azure Activity/Entra ID sign-in logs, AWS CloudTrail) and the reality that cloud IR differs from on-prem. * Proven ability to lead high-stakes security incidents and coordinate cross-functional teams effectively. * Deep understanding of MITRE ATT&CK, cyber kill chain, and incident response methodologies. * Exceptional verbal and written communication skills, with the ability to convey complex technical concepts to non-technical audiences, including executives. * A proactive and decisive mindset with the ability to operate under pressure. * Strong analytical and problem-solving skills to make informed decisions in complex situations. * Collaborative and adaptable, with a passion for mentoring and developing team members. ## Description The Associate Manager - Cyber Security Incident Response will play a pivotal role within WTW's Global Information and Cyber Security Defence (ICSD) function, leading the response to complex security incidents and driving initiatives to enhance WTW's Cyber incident management capabilities. This mid senior-level role requires a highly experienced professional with strong expertise in incident response and cybersecurity. The individual will work as part of a global, multi-disciplined security community with strong support across the business, contributing to fostering a security-aware culture while ensuring WTW remains a great place to work. With WTW's large global footprint, this role offers a fascinating range of work, and occasional global travel may be required. The individual will work as part of a global, multi-disciplined security community with strong support across the business, contributing to fostering a security-aware culture while ensuring WTW remains a great place to work. With WTW's large global footprint, this role offers a fascinating range of work, and occasional global travel may be required. This role is based in London and follows a hybrid working model, with a minimum requirement of three days per month in the office. Applications are also welcome from candidates based elsewhere in the UK; however, travel to the London office will be required as and when needed to meet business demands., The Associate Manager - Cyber Security Incident Response will play a key role in managing and responding to security incidents within WTW's Global Cyber Security Incident Response Team. Responsibilities of this role will include: * Serve as the primary lead for significant security incidents, coordinating response efforts across technical and business teams to minimize impact and ensure timely resolution. * Establish, refine, and maintain incident response processes, playbooks, and workflows to align with industry best practices and WTW's organizational needs. * Act as the central point of contact for incident response activities, ensuring effective communication with internal and external stakeholders, including senior leadership, Legal, HR, and Compliance teams. * Leverage AI and automation to accelerate incident containment, response, and remediation - embedding AI-assisted triage, alert enrichment, and decision support into SOAR playbooks and response workflows * Lead the in-depth technical investigation of security incidents escalated from the SOC, ensuring timely containment, eradication, and recovery while identifying root causes and potential impact. * Adept at leading global response teams, integrating SIEM/SOAR platforms, and collaborating with MSSPs to mitigate cloud-native and supply chain attack. * Work closely with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability Management teams to ensure seamless coordination and information sharing during incidents. * Lead root cause analysis and post-incident reviews to identify gaps, implement lessons learned, and enhance the overall incident response program. * Evaluate and prioritize incidents based on potential impact and severity, escalating issues to higher levels of management or other teams as required. * Contribute to the development and maintenance of key performance indicators (KPIs) and metrics to measure the effectiveness of incident response processes. * Act as a liaison between technical teams and business stakeholders, ensuring clear communication during incidents and status updates. ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [WWC24 - Chris Wysopal, Helmut Reisinger and Johannes Steger - Fighting Digital Threats in the Age of AI](https://www.wearedevelopers.com/videos/926-wwc24-chris-wysopal-helmut-reisinger-and-johannes-steger-fighting-digital-threats-in-the-age-of-ai) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift) - [The Geometry of Incidents: Connecting User Impact to Architecture](https://www.wearedevelopers.com/magazine/764-the-geometry-of-incidents-connecting-user-impact-to-architecture) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)