Global 24/7 Cyber Incident Leader

vavemga; Sydney; Hybrid; AUD 90,000 - 130,000; Full time

Job summary

Canopius is seeking an Incident Responder to be the first point of contact for policyholder cyber incidents. You will triage, lead response, and coordinate an IR panel across forensics, legal, PR and advisers.

Operating in a global follow-the-sun model across Sydney, London, and Chicago, you’ll ensure true 24/7 coverage for new notifications and guide clients from containment to restoration with clear, calm communication.

Qualifications

• Minimum two years in cybersecurity with incident handling or response.
• Strong knowledge of cyber-attack methods and incident response lifecycle.
• Ability to solve complex problems quickly in high-pressure situations.
• Excellent organisational habits with accuracy and thoroughness.
• Clear and confident communication for non-technical audiences.
• Basic data skills; familiarity with Excel/Power BI; SQL/Python advantageous.

Responsibilities

• Be the first point of contact for policyholder incident notifications.
• Triage, assess severity, and set the response plan and cadence.
• Coordinate specialists (IR firms, forensics, legal, PR, ransom advisors).
• Maintain timelines, decisions, and next steps.
• Provide calm, empathetic guidance under pressure; translate technical issues into business impact.
• Set milestones for containment, restoration, notifications and costs.
• Conduct welcome/onboarding calls; explain how to notify and how the IR panel operates.
• Capture and act on policyholder feedback to improve service.

Skills

Cybersecurity

Incident response

Problem solving

Organisational skills

Communication skills

Data analytics

SQL/Python

Empathy

Tools

SQL/Python

Excel

Power BI

Job description

Canopius is seeking an Incident Responder to be the first point of contact for policyholder cyber incidents. You will triage, lead response, and coordinate an IR panel across forensics, legal, PR and advisers.

Operating in a global follow-the-sun model across Sydney, London, and Chicago, you’ll ensure true 24/7 coverage for new notifications and guide clients from containment to restoration with clear, calm communication.