Senior Manager, Incident Response

Grant Thornton Australia Limited; Sydney; Presencial; AUD 180.000 - 260.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

9‑Day fortnight

Descripción de la vacante

Grant Thornton Australia Limited is growing its incident response capability for an AI-enabled threat landscape. We seek a commercially astute Senior Manager to lead on the ground, coordinate across executives, legal, insurers and technical teams, and deliver a truly differentiated incident response service within our global network.

You will guide end-to-end client engagements, mentor incident responders, and shape how automation strengthens detection and response while ensuring strong

Formación

• Significant experience leading cyber security incident response across consulting or in-house CSIRT/SEC OPS.
• Hands-on depth across incident management, digital forensics, threat intelligence and threat hunting.
• Experience with platforms and tooling behind modern detection and response.
• Strong understanding of incident response frameworks, best practice, and Australian regulatory obligations.
• Track record leading and developing teams with a client-facing focus.
• Experience working with executives, legal counsel, insurers and managed security service providers.
• Ability to stay calm under pressure and communicate cyber matters to non-technical stakeholders.
• Strong writing skills for technical reports and executive summaries.
• Commercial awareness of how incident response engagements and retainers are scoped and priced.
• Comfortable working in a team and building with others.
• Australian citizenship or permanent residency.
• Willingness to travel for client work and be on-call.
• Nice to have experience with cyber insurers or working with legal counsel on breach responses.
• Nice to have tabletop exercises or executive-level cyber crisis simulations.
• Nice to have professional certifications such as GCIH, GCFA, GCFE, GREM, CISSP or equivalent.

Responsabilidades

• Lead client incident response engagements end to end, from triage and containment through eradication, recovery and post-incident review.
• Act as incident lead and senior escalation point for major client incidents, coordinating response across client teams, legal, insurers and MSPs.
• Work with client executives and crisis management teams, align incident response with business continuity and executive decision-making.
• Lead and mentor a team of incident response specialists across digital forensics, threat intelligence and threat hunting.
• Manage investigations with proper assignment and documentation in line with processes and frameworks.
• Prepare and review technical reports and executive summaries for boards and executives.
• Use threat intelligence and proactive hunting to help clients prepare for, prevent and identify threats.
• Help clients ready for incidents through readiness assessments, playbooks, escalation processes and tabletop exercises.
• Shape automation and AI-enabled workflows to strengthen detection and response with appropriate human oversight.
• Build client relationships and contribute to proposals, retainers and service delivery.
• Collaborate in a global network of incident response professionals while maintaining a locally relevant service.
• Contribute to practice development, playbooks, partner engagements and onboarding new people.
• Participate in on-call roster to support clients.

Descripción del empleo

• Full time, permanent role
• Enjoy excellent career progression in a ‘hands-on’ leadership role
• Work with Partners who are truly invested in your professional development

Grant Thornton Australia is one of Australia’s leading professional services firms, providing audit, tax, and advisory services to a diverse range of clients. Our culture is underpinned by a commitment to our clients, people and communities, and our promise to ‘Reach for Remarkable’ by providing proven expertise, principled execution, and personalised experience. In Australia we're proud to support the careers of more than 1,500 remarkable people. Backed by six Australian offices and a global network spanning more than 150 markets, we offer the scale, connections and opportunities to help you shape your future, wherever it takes you.

About this role

We’re growing our incident response capability for an AI-enabled threat world and looking for a commercially astute Senior Manager to help lead it on the ground. AI is making nation states, organised crime and individual attackers faster and more effective, and many organisations are struggling to keep up. When a threat succeeds, clients need more than a plan on a shelf. They need someone who can take control, coordinate the response across executives, legal, insurers and technical teams, and get the business operating again. This role is for someone who has done that, and who wants to help build a truly differentiated incident response service as part of a global network of cyber professionals and capability. If you’ve been in the room when a major incident hits, kept a clear head while everyone else wanted answers, and have the war stories to go with it, this is the role for you.

What you’ll do

• Lead client incident response engagements end to end, from triage and containment through to eradication, recovery and post-incident review.
• Act as incident lead and senior escalation point for major client incidents, coordinating response activity across client teams, legal counsel, insurers, managed security service providers and other third parties.
• Work alongside client executives and crisis management teams, aligning incident response with business continuity and executive decision-making to minimise impact and speed up recovery.
• Lead and mentor a team of incident response specialists across digital forensics, threat intelligence and threat hunting, with responsibility for their development and career progression.
• Manage investigations, making sure the right people are assigned and every action is accurately documented in line with established processes, standards and frameworks.
• Prepare and review technical reports and executive summaries, translating what happened, why it matters and what to do next into terms boards and executives can act on.
• Use threat intelligence and proactive threat hunting to help clients prepare for, prevent and identify the threats targeting their organisation.
• Help clients get ready before an incident happens, through readiness assessments, incident response plans, playbooks, escalation processes and tabletop exercises.
• Shape how automation and AI-enabled workflows strengthen our detection and response capability, while keeping the right human oversight, governance and accountability in place.
• Build and hold client relationships, identify follow-on opportunities and contribute to proposals, incident response retainers and sustainable service delivery.
• Work as part of a global network of incident response professionals, drawing on shared capability while building a locally relevant and differentiated service.
• Contribute to how the practice develops, including playbooks, procedures, technology partner engagement and bringing new people through.
• Take part in an on‑call roster to support clients in an emergency.

What you’ll need

• Significant experience leading cyber security incident response, whether in a consulting or incident response provider, an in‑house CSIRT, or a security operations centre.
• Hands‑on depth across incident management, digital forensics, threat intelligence and threat hunting.
• Experience with the platforms and tooling behind modern detection and response.
• A strong understanding of incident response frameworks and best practice, and of Australian regulatory and breach notification obligations.
• A track record of leading and developing teams, and a genuine interest in doing it.
• Experience working with clients or stakeholders outside your own organisation, including executives, legal counsel, insurers and managed security service providers.
• The ability to stay calm under pressure and lead communications during a crisis, and to explain why cyber matters to people who don't work in it.
• Strong writing skills, with reports that stand up to executive, legal and regulatory scrutiny.
• Commercial awareness, including how incident response engagements and retainers are scoped, priced and delivered sustainably.
• Comfort working as part of a team.
• This role suits someone who builds with others rather than around them.
• Australian citizenship or permanent residency.
• Willingness to travel for client work and be part of an on‑call roster.
• Nice to have Experience working with cyber insurers or alongside legal counsel on breach response engagements.
• Nice to have Experience designing and running cyber incident tabletop exercises or executive-level cyber crisis simulations.
• Nice to have Certifications such as GCIH, GCFA, GCFE, GREM, CISSP or equivalent.

We are committed to ensuring our recruitment process is inclusive and accessible for anyone who wishes to apply, and we warmly encourage applications from individuals from diverse backgrounds including Aboriginal and/or Torres Strait Islanders, those in the LGBTQI+ community and individuals who identify as having disability or are neurodivergent.

We are a dynamic and authentic mix of backgrounds, perspectives and ways of thinking. We’re driven by our shared purpose – we care for our people, clients and communities and support them to thrive. We set the bar high to deliver a strikingly different working experience – in what we do but also how we do it. We understand that everyone has different needs and responsibilities outside of work. Here, you can access a range of formal and informal flexible working options including adjusted work hours, part‑time roles and hybrid working. We are also the first professional services firm in Australia to trial and permanently implement a 9-Day fortnight with no reduction in salary.