Cyber Incident Response Lead – Hybrid Glasgow (OT/IT)

ScottishPower; Glasgow; Hybrid; GBP 59,000 - 74,000; Full time

Benefits offered by this job

36 days annual leave

Holiday purchase program

Share Incentive Plan

Private healthcare

Pension scheme

Job summary

ScottishPower is seeking an experienced Incident Response Lead to strengthen cyber defence across IT and OT environments in Glasgow. You will lead the full incident lifecycle and coordinate IT, OT, MSPs, and vendors to ensure rapid detection, analysis, containment and recovery.

Strong governance and executive reporting experience are essential. Requirements include knowledge of MITRE ATT&CK and ICS ATT&CK, plus SC clearance eligibility and prior work in regulated sectors.

Qualifications

• Significant experience in cyber incident response, security operations or digital forensics.
• Experience leading multidisciplinary teams through major incidents.
• Experience in regulated or critical infrastructure environments (OT/IT).
• Knowledge of threat-led detection engineering and ATT&CK frameworks (MITRE ATT&CK, ICS ATT&CK).
• Ability to translate tech incidents into business/regulatory impact for senior stakeholders.

Responsibilities

• Lead the full cyber incident lifecycle from readiness to post-incident improvement.
• Coordinate multidisciplinary teams across IT, OT, MSPs, vendors and stakeholders.
• Ensure threat intelligence informs detection capabilities and response decisions.
• Maintain operational readiness through exercises and scenario planning.
• Represent Cyber Operations during major incidents and provide executive reporting.
• Drive continuous improvement through post-incident reviews and governance.

Skills

Incident response

Security operations

Digital forensics

Threat intelligence

MITRE ATT&CK knowledge

ICS ATT&CK familiarity

OT/IT parity

Stakeholder communication

Tools

MSSP relationships

Crisis communications

Job description

ScottishPower is seeking an experienced Incident Response Lead to strengthen cyber defence across IT and OT environments in Glasgow. You will lead the full incident lifecycle and coordinate IT, OT, MSPs, and vendors to ensure rapid detection, analysis, containment and recovery.

Strong governance and executive reporting experience are essential. Requirements include knowledge of MITRE ATT&CK and ICS ATT&CK, plus SC clearance eligibility and prior work in regulated sectors.