Global Cyber Incident Response Director

EY; Birmingham; On-site; GBP 90,000 - 120,000; Full time

Job summary

EY is seeking a Senior Cyber Incident Response Coordinator to lead global cybersecurity incident response efforts and coordinate across Security, Legal, Privacy, and IT teams. The role emphasizes strong communication, decision-making, and hands-on forensics and threat analysis to support EY’s security posture.

The candidate should bring extensive DFIR experience, SIEM and cloud investigation expertise, and the ability to operate in a fast-paced, on-call environment while guiding junior staff and

Qualifications

• Bachelor’s or Master’s Degree in CS or related field.
• 10+ years in information security roles.
• 5+ years in SOC/Threat Intelligence/Detection Engineering roles.
• 3+ years in DFIR and incident coordination.
• Deep knowledge of Windows and Unix/Linux systems.

Responsibilities

• Independently coordinate complex global cybersecurity incidents with potential nontraditional hours.
• Serve as liaison to businesses and IT teams, managing relationships with partners and vendors.
• Engage with General Counsel, Data Privacy, and Risk Management stakeholders.
• Align with other incident programs to ensure consistency across IT.
• Oversee major CIS projects and mentor junior team members.
• Draft communications and provide leadership reports during and after incidents.
• Develop and improve incident response processes and documentation.

Skills

Incident response

Global coordination

Communication skills

Decision making

Digital forensics

SIEM tools

Leadership

Cloud investigations

Education

Bachelor’s or Master’s in CS/IS/Engineering

Tools

SIEM: Sentinel

Azure

Job description

EY is seeking a Senior Cyber Incident Response Coordinator to lead global cybersecurity incident response efforts and coordinate across Security, Legal, Privacy, and IT teams. The role emphasizes strong communication, decision-making, and hands-on forensics and threat analysis to support EY’s security posture.

The candidate should bring extensive DFIR experience, SIEM and cloud investigation expertise, and the ability to operate in a fast-paced, on-call environment while guiding junior staff and