Manager, Cyber Security Incident Response

University of New South Wales; Penrith City Council; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Flexible Working Options

Career development opportunities

17% Superannuation contributions and 3

Job summary

University of New South Wales (UNSW) is seeking a Manager, Cyber Security Incident Response to lead the CSIRT team in a hybrid model based in Sydney. The role drives incident management, threat hunting, and forensics, reporting to the Head of Cyber Security Operations and coordinating with MSSPs and internal teams.

The ideal candidate will have a decade of incident response experience, strong technical controls knowledge, and excellent stakeholder engagement.

Qualifications

• A relevant tertiary qualification with subsequent relevant experience or equivalent competence.
• Minimum ten years of industry experience in cyber security incident response, with a minimum three years of management experience.
• Strong technical skills in security controls including network, endpoint, application, data protection, and IAM.
• Analytical and problem-solving skills with initiative and ability to develop robust solutions.
• Strong consultation, influencing and negotiation skills with diverse stakeholders.
• Excellent written and verbal communication with attention to detail.
• Demonstrated ability to work collaboratively across levels in an organisation.
• Certifications such as CISSP, CISM, GCIH, GCFA are desirable.

Responsibilities

• Lead and mentor a team of incident response specialists in a hybrid model.
• Oversee major incidents, threat hunting, threat intelligence, and digital forensics services.
• Manage investigations and allocate resources in partnership with stakeholders.
• Coordinate incident response activities with UNSW and external partners.
• Act as escalation point for major security incidents and coordinate communications.
• Document incident actions, prepare technical reports and executive summaries.
• Present security reports analyzing trends and providing recommendations.
• Develop and maintain playbooks, procedures, standards and knowledge bases.
• Lead design and improvement of the Agentic SOC operating model with automation.

Skills

Cyber security incident response

Digital forensics

Threat intelligence

Threat hunting

SIEM

EDR

SOAR

Security Operations Center

Communication skills

Education

Relevant tertiary qualification

Tools

SIEM

EDR

SOAR

Forensic tooling

Job description

Manager, Cyber Security Incident Response

• University of New South Wales
• Australia, NSW
• Aug 21, 2026

Information Technology

About University of New South Wales

At UNSW, we take pride in the broad range and high quality of our teaching programs. Our teaching gains strength and currency from our research activities, strong industry links and our international nature; UNSW has strong regional and...

• Full time continuing role as Manager, Cyber Security Incident Response
• Excellent salary package available
• Kensington, Sydney location, 2-3 days in the office, Hybrid working

About UNSW:

UNSW isn’t like other places you’ve worked. Yes, we’re a large organisation with a diverse and talented community; a community doing extraordinary things. Together, we are driven to be thoughtful, practical, and purposeful in all we do. Taking this combined approach is what makes our work matter. It’s the reason we’re one of the top 20 universities in the world (QS top 20) and a member of Australia’s prestigious Group of Eight. If you want a career where you can thrive, be challenged and do meaningful work, you’re in the right place.

With a significant uplift within our Cyber teams, this role of Manager, Cyber Security Incident Response will lead an experienced CSIRT team responsible for managing all aspects of the incident response process operating within a hybrid operating model working closely together with our Managed Security Service Providers (MSSP). The position requires expert knowledge and significant experience in:

Cyber security incident management and response, digital forensics, threat intelligence and threat hunting, cyber security frameworks, security technologies and automation including SIEM, EDR and SOAR, and Security Operations Centre service delivery.

We need someone who has exceptional interpersonal skills, enabling effective communication and collaboration with partners, vendors, and both internal and external stakeholders. The role will also develop and maintain incident reports, playbooks, procedures, escalation processes, and response plans aligned to best practices. The role reports directly to the Head of Cyber Security Operations. There will be a team of Specialists reporting to the Manager, Cyber Security Incident Response.

Specific accountabilities for this role include:

• Lead and mentor a team of incident response specialists, overseeing major incident response, threat hunting, threat intelligence, and digital forensics services within a hybrid operating model.
• Foster team development and collaboration ensuring high standards of performance in delivering these critical services.
• Manage investigations and ensure resources are appropriately assigned to perform actions in partnership with all relevant stakeholders
• Manage and co-ordinate incident response activities between UNSW and external partners.
• Act as an escalation point for major security incidents impacting the organisation, coordinating communications and response activities together with other operations teams.
• Actively participate in crisis management efforts, ensuring alignment between incident response, business continuity, and executive leadership to minimise impact and expedite recovery.
• Accurately document all actions taken during an incident, preparing detailed technical reports and executive summaries in alignment with established processes, standards, and frameworks.
• Present security reports on a regular basis analysing trends, patterns, and insights to provide recommendations
• Provide regular updates on all aspects of the incident management function to ensure issues, risks, and problems are addressed in a timely manner and services are operating effectively following a continuous improvement model
• Develop and maintain playbooks, operating procedures, technical standards, processes, knowledge base articles and other documentation as required
• Lead the design, implementation, and continuous improvement of an Agentic SOC operating model, ensuring automation and AI-enabled workflows materially strengthen detection and response capability, while embedding appropriate human oversight, governance, accountability, and operational assurance
• Analyse and report on cyber threat intelligence to prepare, prevent, and identify threats targeting the organisation
• Proactively conduct threat hunting to detect anomalous activity leveraging advanced techniques to identify emerging threats, vulnerabilities, and suspicious behaviours across the environment
• Regularly track and validate supplier performance in accordance with KPI’s, objectives, and contract terms, and resolving or escalating performance issues or disputes
• Contribute to the development, implementation, and optimisation of security controls, services, and technologies across Security Operations
• Adhere to IT Service Management practices across UNSW IT, Faculties, Divisions, and Affiliates
• Oversee and finalise effective communications with key stakeholders, both internal and external and provide influential input with stakeholders to achieve business outcomes.
• You will be required to be available on-call roster for emergencies.
• Align with and actively demonstrate the Code of Conduct and Values
• Cooperate with all health and safety policies and procedures of the university and take all reasonable care to ensure that your actions or omissions do not impact on the psychosocial or physical health and safety of yourself or others.

Who you are:

• A relevant tertiary qualification with subsequent relevant experience or equivalent competence gained through any combination of education, training, and experience.
• Minimum ten years of industry experience in cyber security incident response, with a minimum three years of management experience in a cyber security environment or in a senior support role.
• Strong technical skills and operational experience in the management, configuration, and support of security controls including network security, endpoint security, application security, data protection, and/or identity and access management.
• Comprehensive analytical and problem-solving skills and proven capacity to exercise initiative, flexibility and to be proactive in development of robust solutions to problems.
• Strong consultation, influencing and negotiation skills and proven ability to engage effectively with diverse stakeholders to achieve successful outcomes.
• Strong written and verbal communication skills, with a high level of attention to detail for deliverables produced.
• Demonstrated success working effectively and collaboratively on initiatives with a range of people at different levels within an organisation.
• Excellent time management skills, with a demonstrated ability to respond to changing priorities, manage multiple tasks and meet competing deadlines by using judgement and initiative.
• Relevant industry certifications such as CISSP, CISM, GCIH, GCFA are highly desirable but not required.
• An understanding of and commitment to UNSW’s aims, objectives and values in action, together with relevant policies and guidelines.

Benefits and Culture

• Flexible Working Options (work from home, flexible hours etc)
• Career development opportunities
• 17% Superannuation contributions and additional leave loading payments
• Additional 3 days of leave over Christmas period
• Discounts and entitlements (retail, education, fitness)

Please note: Sponsorship is not available for this role; valid Australian working rights are required on application.

Pre-Employment Checks

As part of our recruitment process candidates may be required to undergo pre-employment screening, which may include reference checks, qualification verification, right-to-work verification, and criminal history screening where relevant to the role.

Applications close:Sunday 13th of September at 11.30pm

UNSW is committed to equity diversity and inclusion. Applications from women, people of culturally and linguistically diverse backgrounds, those living with disabilities, members of the LGBTIQ+ community; and people of Aboriginal and Torres Strait Islander descent, are encouraged. UNSW provides workplace adjustments for people with disability, and access to flexible work options for eligible staff.