Global 24/7 Cyber Incident Responder

Canopius; Sydney; On-site; AUD 110,000 - 170,000; Full time

Job summary

Canopius is seeking an Incident Responder to serve as the first point of contact for cyber incidents, triaging, leading responses, and coordinating a global panel of experts. You will manage containment through restoration, ensuring clear communication with policyholders.

In a 24/7, follow-the-sun model across Sydney, London and Chicago, you will collaborate with Claims, Underwriting and Analytics to deliver timely coverage assessments and strong incident handling workflows.

Qualifications

• Two years in cybersecurity, with hands-on incident handling or response.
• Solid understanding of cyber-attack methods and incident lifecycle.
• Ability to make quick judgments under pressure in fast-moving situations.
• Strong written and verbal communication, translating technical issues for non-technical audiences.
• Data skills to partner with Analytics (Excel/Power BI; SQL/Python a plus).

Responsibilities

• Own the incident from notification to closure.
• Be the first point of contact for policyholder incident notifications.
• Triage, assess severity, and set response plan and cadence.
• Coordinate vendors (IR firms, forensics, legal, PR) for right-sized support.
• Maintain timelines, decisions, and next steps; provide calm guidance under pressure.
• Surface facts, costs, and causation signals; ensure incident files are complete.
• Contribute to playbooks, runbooks, and vendor performance reviews.
• Collaborate with Claims, Underwriting and Insights & Analytics.

Skills

Cyber incident response

Threat intelligence

Communication under pressure

Analytical thinking

Data skills

Empathy

Problem solving

Stakeholder management

Tools

Excel

Power BI

SQL

Python

Job description

Canopius is seeking an Incident Responder to serve as the first point of contact for cyber incidents, triaging, leading responses, and coordinating a global panel of experts. You will manage containment through restoration, ensuring clear communication with policyholders.

In a 24/7, follow-the-sun model across Sydney, London and Chicago, you will collaborate with Claims, Underwriting and Analytics to deliver timely coverage assessments and strong incident handling workflows.