Senior Global Cyber Incident Response Lead

EY; Sydney; On-site; AUD 180,000 - 280,000; Full time

Job summary

EY in Sydney is seeking a Senior Global Cyber Incident Response Lead to direct frontline AWS incident response, triage failures, coordinate resolver teams, and drive incidents to mitigation in real time.

You will develop metrics, dashboards, and proactive detection improvements, own operational processes end to end, and contribute to faster, more accurate incident management across the organization. The role includes participation in an on-call rotation covering weekdays, weekends, and holidays.

Responsibilities

• Lead high-severity incident response calls end to end, coordinating resolvers and driving mitigation.
• Own and run operational health reviews, dashboards, metrics, and monitoring to surface trends.
• Improve detection speed and accuracy by identifying patterns and proactive mechanisms.
• Deep-dive operational data to find systemic issues and measure response effectiveness.
• Identify gaps in operational processes, documentation, and tooling.

Job description

Senior Global Cyber Incident Response Lead

Description
As a Systems Engineer on AWS Incident Response, you will be on the front line of AWS incident response. You will lead high‑severity calls, triage complex failures across distributed systems, coordinate resolver teams, and drive incidents to mitigation in real time while millions of customers depend on the outcome. Between incidents you will obsess over metrics and detection analysis, building dashboards and mechanisms that surface problems before customers notice, and you will drive operational improvements that make the incident management ecosystem faster and more accurate.
You will make real‑time decisions under pressure, deep‑diving the largest and most complex technical environment in the world. You will develop expertise across AWS services, networking, and infrastructure, building a breadth of knowledge that few roles offer. Your scope spans all of AWS rather than a single service. You will own operational processes end to end and use data to find the next improvement in how we detect and mitigate faster. You will also have the opportunity to grow your development skills by taking on coding projects that accelerate incident response and reduce toil.
This role includes participation in an on‑call rotation covering weekdays, weekends, and holidays. On‑call shifts fall within your local daytime hours.

• Lead high‑severity incident response calls end to end: assess impact, coordinate resolvers across AWS service teams, communicate clearly under pressure, manage escalations, and drive the incident to mitigation with documentation throughout.
• Own and run operational health reviews, and build and maintain the dashboards, metrics, and monitoring that surface trends before they become incidents.
• Improve detection accuracy and speed. Identify patterns across events and build proactive mechanisms that prevent recurrence.
• Deep‑diving operational data to find systemic issues, measure response effectiveness, and prioritize improvements against what the data shows is degrading.
• Identify gaps in operational processes, documentation, and tooling