Cyber Defense Incident Responder - Associate Director

Salary: £58,000 - 98,000 per year

Requirements:

• Bachelors or Masters Degree in Computer Science, Information Systems, Engineering, a related field, or equivalent experience
• 10+ years collective experience between roles such as Information Security Professional or Information System Administration/Engineering
• 5+ years collective experience between roles such as Security Operations Center (SOC) Analyst/Manager, Cybersecurity Threat Intelligence, Cybersecurity Detection Engineering, other relevant Cyber Defense functions, Attack & Penetration Testing (Active Defense), eDiscovery, or a related role performing forensic functions
• 3+ years collective experience between roles such as Cybersecurity Digital Forensics Incident Response (DFIR) Analyst/Manager or Cybersecurity Incident Coordinator
• Intricate understanding of security threats, vulnerabilities, and incident response
• Mastery of electronic investigation, forensic tools, and methodologies, including log correlation and analysis, forensically handling electronic data, knowledge of the computer security investigative processes, and malware identification and analysis
• Familiarity with legalities surrounding electronic-discovery/collection and analysis of digital evidence
• Understanding of network topography and protocols
• Understanding of and adaptability to regulatory stipulations regarding security incidents on a global scale
• Experience in operationalizing automation to support process efficiency
• Experience with SIEM technologies, cloud-based management and investigation consoles, and other digital forensics analysis tools
• Deep understanding of both Windows and Unix/Linux based operating systems, and adaptability to respond quickly to previously unknown interfaces, operating systems, consoles, and non-standard devices
• Candidates must hold or be willing to pursue related professional certifications such as GCFE, GCFA, GCIH, CISA, CISM, CISSP, or CCIM

Responsibilities:

• Independently coordinate complex response efforts to global cybersecurity incidents caused by external threats, including nontraditional working hours
• Serve as a liaison and relationship manager across businesses, Information Security teams, business partners, management, vendors, and external parties
• Establish, foster, and maintain relationships with General Counsel, Data Privacy/Protection, and Risk Management key contacts
• Drive and manage integration with other corporate incident management programs to ensure consistency and alignment with peer support teams within IT
• Oversee critical Cyber & Investigative Services projects as directed by leadership
• Serve as a counselor and manager for junior members of the Cyber Incident Response team
• Lead process and documentation development and improvements by the Cyber & Investigative Services team
• Develop and document processes to ensure consistent and scalable response operations, and support continuous improvement to our global cybersecurity incident response plan
• Develop and deliver metrics to leadership relevant to the operational improvement of the cybersecurity incident response process
• Report on team performance and deficiencies to identify areas for improvement and institute correction or enhancement programs
• Draft communications and ensure timely reports and updates to leadership for cases during and after an event or incident
• Own and/or oversee process and corresponding documentation
• Be willing to be on-call off hours in rotation with other team members

Technologies:

• Cloud
• Incident Management
• Support
• Linux
• Network
• Security
• Unix
• Windows
• AI
• Azure
• IoT
• Mobile

More:

At EY, were all in to shape your future with confidence. We help people succeed in a globally connected powerhouse of diverse teams and build a better working world. EY Technology supports our technology needs through three business units: Client Technology, Enterprise Workplace Technology, and Information Security. The Cyber & Investigative Services (CIS) Senior Cyber Incident Response Coordinator role is based in London, GB, SE1 2AF and focuses on coordinating response to cybersecurity events and incidents on a global scale. We offer a flexible environment, world-class experiences, and a diverse, inclusive culture of globally connected teams. EY also supports equitable and inclusive recruitment and provides accommodations for disability-related adjustments where needed.

last updated 37 week of 2026