> Markdown version of [/jobs/ext/3856964-cyber-incident-response-lead](https://www.wearedevelopers.com/jobs/ext/3856964-cyber-incident-response-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Incident Response Lead

- **Company:** Colt Technology Services
- **Location:** London, UK (Remote available)
- **Experience:** Expert
- **Salary:** £63,039.0
- **Contract:** Permanent contract
- **Skills:** User Authentication, Build Automation, Cyber Security, Statistical Hypothesis Testing, Python (Programming Language), Packet Analyzer, Nmap, Windows PowerShell, Cloud Services, Security Information and Event Management, Scripting, Cloud Platform System, Computer Network Technologies, Mitre Att&ck, Purple Team (Cyber Security), Splunk
- **Published:** October 22, 2026
- **Apply:** https://www.adzuna.co.uk/jobs/details/5935979535

## About the Role

* Experience in investigating cyber incidents and coordinating responses across multiple teams.
 * Provide timely and effective updates to senior leadership and business stakeholders during high-severity incidents.
 * Coordinate with third parties, suppliers, MSSPs and specialist responders during investigations and recovery activities.
 * Good understand of EDR products with demonstrated IR capability in one or more of the following: Microsoft Defender, CrowdStrike, Sentinel One, Trend Vison One.
 * Good understanding of SIEM tools with knowledge of one of the following: Splunk, Google SecOps or Sentinel.
 * Broad technical knowledge of networks, operating systems, applications, identity and cloud environments,
 * An in-depth understanding of common attacker techniques and demonstrated knowledge of one of the following: MITRE ATT&K, Cyber Kill Chain or MITRE D3FEND
 * Knowledge of well-known IR tools such as tcpdump, Zeek, YARA, Nmap. Expertise in every tool is not expected; the essential skill is knowing how to investigate effectively.
 * Understanding of scripting languages (Python, PowerShell) to test hypotheses, analyse evidence and build automation.
 * The ability to give concise, accurate updates to both technical responders and non-technical decision-makers.

Might haves:

 * Performed cyber incident response within a telecommunications environment.
 * Knowledge of the Telecommunications Security Requirements.
 * Understanding of telecoms technology such as network technologies, authentication, and voice services.

## Description

You will work with internal teams and external partners to turn complex technical findings into business level findings management to take critical decisions. As an individual contributor, you will lead incidents end to end, shape to strategy of security operations and strengthen Colt's overall security posture to help shape how the organisation prepares for and responds to future threats.

 * Analyse evidence from networks, endpoints, applications, identity systems and cloud services. Use packet captures, logs, queries and scripts to establish what happened, the scope of compromise and the likely impact.
 * Bring together technical and non-technical teams; set priorities; assign response actions; and maintain a clear view of progress, risks and decisions.
 * Make timely containment decisions within delegated authority and agreed playbooks, weighing the security benefit against disruption to services and customers. Escalate decisions outside that authority.
 * Explain the impact of an incident and the options available in language suited to the audience.
 * Work with service owners to confirm that threats have been removed, systems can be restored safely, and heightened monitoring is in place where needed.
 * Lead post incident reviews and write complex incident reports that can be understood by both technical and non-technical people. Track agreed improvements through to completion
 * Build and maintain incident plans and playbooks, lead or take part in tabletop exercises.
 * Identify detection gaps, automation opportunities and work with teams to improve monitoring, detection and response effectiveness
 * Join the incident response rota and respond to escalations outside normal working hours in-line with the agreed expectations.
 * Mentor junior and less experienced team members to ensure we maintain a high barrier of quality analysis and capabilities., * Conduct or coordinate threat hunting activities based on incident learnings, intelligence and emerging threats.
 * Support purple team exercises and adversary simulations to validate detection and response capabilities.
 * Use of SIEM-less technologies to analyse data and find security incident.
 * Understanding and experience of automation tools and using agentic capabilities to improve analysis, triage, containment and remediation.
 * Lead or support cyber crisis management activities during significant incidents, ensuring coordination between technical, business, communications, legal and executive stakeholders.
 * Working with external crisis IR retainer organisations.