Cyber Incident Response Lead

Colt Technology Services Group Ltd.; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Flexible working hours and the option/

Option to work from home

Induction program with mentors

Development and educational opportunit

Global Family Leave Policy

Employee Assistance Program

Diversity and inclusion networks

Job summary

Colt Technology Services Group Ltd. is redefining its cyber security strategy with an industry-leading incident response function.

You will combine hands-on cyber investigation with incident leadership across the organisation to contain and review incidents. You will collaborate with internal teams and external partners to translate complex findings into business decisions, guiding responses from detection to containment and review.

Qualifications

• Experience investigating cyber incidents and coordinating responses across multiple teams.
• Provide timely and effective updates to senior leadership during high-severity incidents.
• Coordinate with third parties, MSSPs and specialist responders during investigations and recovery.
• Strong understanding of EDR products (MS Defender, CrowdStrike, SentinelOne, Trend Vision One).
• Solid SIEM knowledge with Splunk, Google SecOps or Sentinel familiarity.
• Broad technical knowledge across networks, OS, apps, identity and cloud environments.
• Knowledge of attacker techniques (MITRE ATT&CK, Cyber Kill Chain, or MITRE D3FEND).
• Familiarity with IR tools (tcpdump, Zeek, YARA, Nmap).
• Ability to test hypotheses with scripting (Python/PowerShell).
• Ability to give concise updates to technical and non-technical stakeholders.

Responsibilities

• Analyze evidence from networks, endpoints, apps, identity systems and cloud services.
• Set priorities, assign response actions, and track progress and risks.
• Make containment decisions within approved playbooks and escalate as needed.
• Explain incident impact and options in accessible language.
• Ensure threats are removed and heightened monitoring is in place.
• Lead post-incident reviews and write complex incident reports for both technical and non-technical audiences.
• Build and maintain incident plans and playbooks; participate in tabletop exercises.
• Identify detection gaps and automation opportunities to improve monitoring and response.

Skills

Incident response

Cross-team coordination

Executive communication

EDR understanding

SIEM proficiency

Networking knowledge

Scripting (Python/PowerShell)

Tools

tcpdump

Zeek

YARA

Nmap

Job description

Select how often (in days) to receive an alert:

Colt provides network, voice and data centre services to thousands of businesses around the world, allowing them to focus on delivering their business goals instead of the underlying infrastructure.

Why we need this role

Colt is redefining its cyber security strategy and building an industry-leading incident response function that operates across every level of the organisation. This role is central to that purpose and will combin e hands-on cyber investigation with incident leadership and coordination to take incidents from initial detection , business impact review , containment and incident review.

You will work with internal teams and external partners to turn complex technical findings into business level findings management to take critical decisions. As an individual contributor, you will lead incidents end to end, shape to strategy of security operations and strengthen Colt’s overall security posture to help shape how the organisation prepares for and responds to future threats.

What you will do

• Analyse evidence from networks, endpoints, applications, identity systems and cloud services. Use packet captures, logs, queries and scripts to establish what happened, the scope of compromise and the likely impact.
• Bring together technical and non-technical teams; set priorities; assign response actions; and maintain a clear view of progress, risks and decisions.
• Make timely containment decisions within delegated authority and agreed playbooks, weighing the security benefit against disruption to services and customers. Escalate decisions outside that authority.
• Explain the impact of an incident and the options available in language suited to the audience.
• Work with service owners to confirm that threats have been removed, systems can be restored safely, and heightened monitoring is in place where needed.
• Lead post incident reviews and write complex incident reports that can be understood by both technical and non-technical people. Track agreed improvements through to completion
• Build and maintain incident plans and playbooks, lead or take part in tabletop exercises.
• Identify detection gaps, automation opportunities and work with teams to improve monitoring, detection and response effectiveness
• Join the incident response rota and respond to escalations outside normal working hours in-line with the agreed expectations.
• Mentor junior and less experienced team members to ensure we maintain a high barrier of quality analysis and capa bilities.

What we looking for

Must haves:

• Experience in investigating cyber incidents and coordinating responses across multiple teams.
• Provide timely and effective updates to senior leadership and business stakeholders during high-severity incidents.
• Coordinate with third parties, suppliers, MSSPs and specialist responders during investigations and recovery activities.
• Good understand of EDR products with demonstrated IR capability in one or more of the following: Microsoft Defender, CrowdStrike, Sentinel One, Trend Vison One.
• Good understanding of SIEM tools with knowledge of one of the following: Splunk, Google SecOps or Sentinel.
• Broad technical knowledge of networks, operating systems, applications, identity and cloud environments,
• An in-depth understanding of common attacker techniques and demonstrated knowledge of one of the following: MITRE ATT&K, Cyber Kill Chain or MITRE D3FEND
• Knowledge of well-known IR tools such as tcpdump, Zeek, YARA, Nmap. Expertise in every tool is not expected; the essential skill is knowing how to investigate effectively.
• Understanding of scripting languages (Python, PowerShell) to test hypotheses, analyse evidence and build automation.
• The ability to give concise, accurate updates to both technical responders and non-technical decision-makers.

Might haves:

• Performed cyber incident response within a telecommunications environment.
• Knowledge of the Telecommunications Security Requirements.
• Understanding of telecoms technology such as network technologies, authentication, and voice services.
• Conduct or coordinate threat hunting activities based on incident learnings, intelligence and emerging threats.
• Support purple team exercises and adversary simulations to validate detection and response capabilities.
• Use of SIEM-less technologies to analyse data and find security incident.
• Understanding and experience of automation tools and using agentic capabilities to improve analysis, triage, containment and remediation.
• Lead or support cyber crisis management activities during significant incidents, ensuring coordination between technical, business, communications, legal and executive stakeholders.
• Working with external crisis IR retainer organisations.

What we offer you:

Looking to make a mark?

At Colt, you’ll make a difference. Because around here, we empower people. We don’t tell you what to do.

Instead, we employ people we trust, who come together across the globe to create intelligent solutions.

Our global teams are full of ambitious, driven people, all working together towards one shared purpose: to put the power of the digital universe in the hands of our customers wherever, whenever and however they want.

We give our people the opportunity to inspire and lead teams, and work on projects that connect people, cities, businesses, and ideas. We want you to help us change the world, for the better.

Diversity and inclusion

• Inclusion and valuing diversity of thought and experience are at the heart of our culture here at Colt. From day one, you’ll be encouraged to be yourself because we believe that’s what helps our people to thrive. We welcome people with diverse backgrounds and experiences, regardless of their gender identity or expression, sexual orientation, race, religion, disability, neurodiversity, age, marital status, pregnancy status, or place of birth.

Most recently we have:

• Signed the UN Women Empowerment Principles which guide our Gender Action Plan
• Trained 60 (and growing) Colties to be Mental Health First Aiders
• Please speak with a member of our recruitment team if you require adjustments to our recruitment process to support you. For more information about our Inclusion and Diversity agenda, visit our DEI pages .

Our benefits support you through all parts of life, for both physical and mental health.

• Flexible working hours and the option to work from home.
• Extensive induction program with experienced mentors and buddies.
• Opportunities for further development and educational opportunities.
• Global Family Leave Policy.
• Employee Assistance Program.
• Internal inclusion & diversity employee networks.

A global network

• When you join Colt you become part of our global network. We are proud of our colleagues and the stories and experience they bring – take a look at ‘Our People’ site including our Empowered Women in Tech.

Job Segment: Cyber Security, Data Center, CAPA, Telecom, Telecommunications, Security, Technology, Management