Senior Manager, Incident Response

Grant Thornton Australia; Sydney; On-site; AUD 180,000 - 280,000; Full time

Job summary

Grant Thornton Australia is expanding its incident response capability with a commercially astute Senior Manager to lead it on the ground. You will oversee end-to-end client engagements, coordinate across executives, legal, insurers and technical teams, and help build a differentiated service within a global cyber network.

If you have led major incidents, stayed calm under pressure and have strong reporting skills, this role offers leadership, growth and the chance to shape the practice across

Qualifications

• Significant experience leading cyber security incident response.
• Hands-on depth across incident management, forensics, threat intel and hunting.
• Experience with platforms and tooling behind modern detection/response.
• Strong understanding of incident response frameworks and Australian obligations.
• Proven leadership and team development experience.
• Experience coordinating with executives, legal, insurers and third parties.
• Calm under pressure with crisis communications skills.
• Strong writing and executive reporting ability.
• Commercial awareness of engagement scoping, pricing and delivery.
• Willingness to travel and participate in on-call roster.

Responsibilities

• Lead client incident response engagements end to end from triage to recovery.
• Act as incident lead and escalation point for major incidents with cross‑functional teams.
• Coordinate response with executives, legal, insurers and MSSPs.
• Mentor a team of incident response professionals across disciplines.
• Manage investigations with proper staffing and documentation.
• Prepare technical reports and executive summaries for boards.
• Use threat intel and proactive hunting to anticipate threats.
• Assist clients with readiness plans, playbooks and tabletop drills.
• Shape automation and AI-enabled workflows with human oversight.
• Build client relationships and contribute to proposals and retainers.

Skills

Incident leadership

Incident management

Threat intel

Digital forensics

Australia regs

Team leadership

Executive reporting

Client communications

Commercial awareness

On-call readiness

Travel willingness

Job description

• Full time, permanent role
• Enjoy excellent career progression in a ‘hands-on’ leadership role
• Work with Partners who are truly invested in your professional development

Grant Thornton Australia is one of Australia’s leading professional services firms, providing audit, tax, and advisory services to a diverse range of clients.

Our culture is underpinned by a commitment to our clients, people and communities, and our promise to ‘Reach for Remarkable’ by providing proven expertise, principled execution, and personalised experience.

In Australia we’re proud to support the careers of more than 1,500 remarkable people. Backed by six Australian offices and a global network spanning more than 150 markets, we offer the scale, connections and opportunities to help you shape your future, wherever it takes you.

About this role

We’re growing our incident response capability for an AI-enabled threat world and looking for a commercially astute Senior Manager to help lead it on the ground.

AI is making nation states, organised crime and individual attackers faster and more effective, and many organisations are struggling to keep up. When a threat succeeds, clients need more than a plan on a shelf. They need someone who can take control, coordinate the response across executives, legal, insurers and technical teams, and get the business operating again. This role is for someone who has done that, and who wants to help build a truly differentiated incident response service as part of a global network of cyber professionals and capability.

If you’ve been in the room when a major incident hits, kept a clear head while everyone else wanted answers, and have the war stories to go with it, this is the role for you.

What you’ll do

• Lead client incident response engagements end to end, from triage and containment through to eradication, recovery and post-incident review.
• Act as incident lead and senior escalation point for major client incidents, coordinating response activity across client teams, legal counsel, insurers, managed security service providers and other third parties.
• Work alongside client executives and crisis management teams, aligning incident response with business continuity and executive decision-making to minimise impact and speed up recovery.
• Lead and mentor a team of incident response specialists across digital forensics, threat intelligence and threat hunting, with responsibility for their development and career progression.
• Manage investigations, making sure the right people are assigned and every action is accurately documented in line with established processes, standards and frameworks.
• Prepare and review technical reports and executive summaries, translating what happened, why it matters and what to do next into terms boards and executives can act on.
• Use threat intelligence and proactive threat hunting to help clients prepare for, prevent and identify the threats targeting their organisation.
• Help clients get ready before an incident happens, through readiness assessments, incident response plans, playbooks, escalation processes and tabletop exercises.
• Shape how automation and AI-enabled workflows strengthen our detection and response capability, while keeping the right human oversight, governance and accountability in place.
• Build and hold client relationships, identify follow‑on opportunities and contribute to proposals, incident response retainers and sustainable service delivery.
• Work as part of a global network of incident response professionals, drawing on shared capability while building a locally relevant and differentiated service.
• Contribute to how the practice develops, including playbooks, procedures, technology partner engagement and bringing new people through.
• Take part in an on‑call roster to support clients in an emergency.

What you’ll need

• Significant experience leading cyber security incident response, whether in a consulting or incident response provider, an in‑house CSIRT, or a security operations centre.
• Hands‑on depth across incident management, digital forensics, threat intelligence and threat hunting.
• Experience with the platforms and tooling behind modern detection and response.
• A strong understanding of incident response frameworks and best practice, and of Australian regulatory and breach notification obligations.
• A track record of leading and developing teams, and a genuine interest in doing it.
• Experience working with clients or stakeholders outside your own organisation, including executives, legal counsel, insurers and managed security service providers.
• The ability to stay calm under pressure and lead communications during a crisis, and to explain why cyber matters to people who don’t work in it.
• Strong writing skills, with reports that stand up to executive, legal and regulatory scrutiny.
• Commercial awareness, including how incident response engagements and retainers are scoped, priced and delivered sustainably.
• Comfort working as part of a team. This role suits someone who builds with others rather than around them.
• Australian citizenship or permanent residency.
• Willingness to travel for client work and be part of an on‑call roster.

Nice to have

• Experience working with cyber insurers or alongside legal counsel on breach response engagements.
• Experience designing and running cyber incident tabletop exercises or executive‑level cyber crisis simulations.
• Certifications such as GCIH, GCFA, GCFE, GREM, CISSP or equivalent.

If you’re interested in this role but don’t feel that you match every single one of our requirements, we would still love to hear from you and explore the unique skillset and attributes that you can bring to the team.

Need some help applying or participating in the recruitment process?

We are committed to ensuring our recruitment process is inclusive and accessible for anyone who wishes to apply, and we warmly encourage applications from individuals from diverse backgrounds including Aboriginal and/or Torres Strait Islanders, those in the LGBTQI+ community and individuals who identify as having disability or are neurodivergent. Click here for recruitment support information and to learn more about Diversity, Equity and Inclusion at Grant Thornton.

Should you have questions or require any adaptations or additional support for your individual circumstances so you may perform at your best during the application or recruitment process please contact our Talent Acquisition team at [e-mail]

As we provide fair consideration and evaluation to a high volume of applications, we endeavour to provide feedback on your application at the earliest opportunity.

#LI-Hybrid