Cyber Incident Responder

vavemga; Sydney; Hybrid; AUD 90,000 - 130,000; Full time

Job summary

Canopius is seeking an Incident Responder to be the first point of contact for policyholder cyber incidents. You will triage, lead response, and coordinate an IR panel across forensics, legal, PR and advisers.

Operating in a global follow-the-sun model across Sydney, London, and Chicago, you’ll ensure true 24/7 coverage for new notifications and guide clients from containment to restoration with clear, calm communication.

Qualifications

• Minimum two years in cybersecurity with incident handling or response.
• Strong knowledge of cyber-attack methods and incident response lifecycle.
• Ability to solve complex problems quickly in high-pressure situations.
• Excellent organisational habits with accuracy and thoroughness.
• Clear and confident communication for non-technical audiences.
• Basic data skills; familiarity with Excel/Power BI; SQL/Python advantageous.

Responsibilities

• Be the first point of contact for policyholder incident notifications.
• Triage, assess severity, and set the response plan and cadence.
• Coordinate specialists (IR firms, forensics, legal, PR, ransom advisors).
• Maintain timelines, decisions, and next steps.
• Provide calm, empathetic guidance under pressure; translate technical issues into business impact.
• Set milestones for containment, restoration, notifications and costs.
• Conduct welcome/onboarding calls; explain how to notify and how the IR panel operates.
• Capture and act on policyholder feedback to improve service.

Skills

Cybersecurity

Incident response

Problem solving

Organisational skills

Communication skills

Data analytics

SQL/Python

Empathy

Tools

SQL/Python

Excel

Power BI

Job description

Canopius is a market-leading cyber insurer with an in-house Cyber Incident Management Team (CIMT) that delivers immediate, expert support to our policyholders during their most critical moments. As an Incident Responder, you’ll be the first point of contact when a client faces a cyber event—whether business email compromise, ransomware, social engineering, data theft, or other attacks. You will triage and lead the response, mobilize our expert panel (forensics, legal, PR, and specialist advisors), and project‑manage recovery from containment through restoration, providing calm, clear communication throughout.

Operating in a global, follow-the-sun model across Sydney, London, and Chicago, you’ll ensure true 24/7 coverage for new notifications, collaborate closely with our Claims team to support timely coverage assessment, and help clients navigate local legal and regulatory obligations.

Own the incident from notification to closure

• Be the first point of contact for policyholder incident notifications.
• Rapidly triage, assess severity, and set the response plan and cadence.
• Orchestrate specialist vendors (IR firms, forensics, legal, PR, ransom advisors), ensuring right-sized support at the right time.
• Maintain clear timelines, decisions, and next steps
• Provide calm, empathetic guidance under pressure; translate technical issues into clear business impact and options.
• Set and manage expectations on milestones (containment, restoration, notifications) and costs.
• Conduct welcome/onboarding calls; explain how to notify, what to expect, and how the IR panel operates.
• Capture and act on policyholder feedback to continuously improve service.

Operate within a global, 24/7 team model

• Participate in rota/on call coverage to ensure true follow the sun response. -call coverage to ensure true follow-the-sun response.
• Perform structured handovers across regions; maintain accurate case notes and status.

Evolve the service offering

• Contribute to playbook/runbook enhancements and decision trees (e.g., ransomware, BEC, DDoS, data exfil).
• Recommend panel/vendor improvements and measure vendor SLAs and outcomes.

Collaborate with Claims, Underwriting and Insights & Analytics

• Partner with the Claims team to ensure smooth coverage confirmation and claim handling.
• Surface material facts, costs, and causation signals; ensure incident files are complete and timely.
• Escalate complex matters promptly and appropriately.
• Sit "at the coal face" of live incidents and distil timely, high-quality insights (threat vectors, controls efficacy, vendor performance, and industry signals). -quality insights (threat vectors, controls efficacy, vendor performance,
• Provide structured post incident summaries and trend themes for underwriters and leadership. -incident summaries and trend themes for underwriters and leadership.
• Ensure precise, consistent capture of incident metadata and outcomes (e.g., root cause, initial access, controls in place, dwell time, MTTA/MTTR, costs).
• Champion data quality standards; work with Analytics to refine taxonomies and dashboards.
• Collaborate in delivery of incident preparedness sessions, tabletops, and executive simulations for insureds. -deliver incident preparedness sessions, tabletops, and executive simulations for insureds.
• Feed real world lessons learned into control uplift recommendations. -world lessons learned into control uplift recommendations

Skills & Qualifications

• A minimum of two years working in the cybersecurity field, ideally with hands‑on involvement in incident handling or response activities.
• Strong foundational knowledge of cyber-attack methods, threat behaviors, and the end‑to‑end lifecycle of incident response.
• Demonstrate ability to solve complex problems and make sound judgements quickly, especially when operating in high pressure or fast-moving situations. -pressure or fast-moving situations.
• Excellent organisational habits with a focus on accuracy and thoroughness in all tasks.
• Clear and confident communication skills—both written and verbal—with the capability to explain technical issues in an accessible way for non-technical audiences. -technical audiences.
• Basic data skills to partner with Analytics (e.g., Excel/Power BI; familiarity with SQL/Python advantageous).
• High empathy, composure under pressure, and a service mindset.

Job Info

• Job Identification 880
• Job Category Claims
• Posting Date 10/27/2026, 02:12 AM
• Job Schedule Full time
• Locations Level 35.02, 60 Margaret St, Sydney NSW, 2000, AU (Hybrid)